Biometrics in Pharma : Politics and Privacy. Daniel Shapiro * and Sidney Shapiro + * School of Information Technology and Engineering, University of Ottawa Email: firstname.lastname@example.org + Department of Political Science, Laurentian University Email: email@example.com. Overview. - PowerPoint PPT Presentation
Biometrics in Pharma: Politics and PrivacyDaniel Shapiro* and Sidney Shapiro+*School of Information Technology and Engineering, University of OttawaEmail: firstname.lastname@example.org+Department of Political Science, Laurentian UniversityEmail: email@example.com
OverviewPrescription of Controlled SubstancesTrends in Google Searches, News, RegionsSpam and Other MarketingBiometric Prescriptions: Practical, Political, and Privacy IssuesThe Impact of TechnologyConclusions
Prescription of Controlled SubstancesThe Drug Enforcement Agency (DEA) has announced the implementation of the use of both computerized and biometric security protocols in the electronic prescription of controlled substances.Electronic prescriptions which were up until this point not allowed to be prescribed by electronic means will now be easier for physicians and the DEA to monitor and prescribe.
USA Google Searches 2004-2010Raw Data with 5% ErrorTrendsPharmacy searches Prescription, privacy searches Implication is use of illegal online pharmacies in the USAIn 2004, of Americans had looked online for drug information, and four percent purchased drugs online [Fox04]
Breakdown by Region
News Coverage in USARaw Data with 5% Error
TrendsNews coverage of privacy and prescriptions is News coverage of pharmacy is tooPrescription drugs online 2004 indicates use of online pharmacies [Fox04]pharmacyprescriptionprivacy Spam and Other Marketing
Biometric Prescriptions: Practical, political, and privacy issuesPractical Biometrics Issues:Non-repudiation Improved accountabilityDelegation preventionPossible increased costPossible information security concernsFalse acceptance and false rejection casesPossible serious medical consequences when a drug cannot be obtained due to failed biometric authentication.
Political / Privacy Biometrics Issues:RiteAid installs fingerprint scanners in their pharmacies 2004Less privacy (summarizing data)Policy issues (HIPAA/ETP/PIPEDA/others)Legal issues (selling prescription data)Human factors (fear, misconceptions)
Should a vulnerability in the electronic system be exploited, the potential for abuse could be much larger than in a system reliant on human judgment and detection.
A patient with a valid prescription that is turned away from a pharmacy due to a glitch in technology. That patient may experience severe pain, withdrawal, or even death as a result of the false rejection
8The Impact of TechnologyCryptography and SystemsService interruptions due to power failures or DDoS.Biometrics systems would be unable to function without access to communication and information unless the data was stored locally, negating the usefulness of a large scale distributed system.PKI is slow but secure.BiometricsDegraded biometricCombination of several biometrics in order to improve accuracyA certificate authority cannot reissue a biometric.Fingerprint scanners can identify fake fingerprint attempts using sensors to observe the finger temperature, pulse, oxygenation, blood pressure, movement, and electrical resistance.
The Impact of TechnologyCryptography and SystemsCertificates are preferred over scans due to data size.Digital signatures disallowed in many jurisdictions.Risk-based approach for data encryption.Clearly a prescription for a controlled substance would fall under the category of a high-risk, and would be heavily encrypted.Hardware failure in any component in the system including cameras, fingerprint scanners, barcode readers, and computers.BiometricsHackers could begin harvesting biometric information from poorly secured e-health system.Setting up a fake service with the express purpose of aggregating biometric information.Sometimes it is cheaper to pay off the bad guys.Biometric software failure due to a bug in the implementation.
The Impact of TechnologyCryptography and SystemsDEA says you need 2 IDs + biometric.This is like saying you need a biometric + password Then why use the biometric?As we said earlier, combining certificates reduces false accept/reject.BiometricsA replay attack is a case where a biometric has been copied by a third party and is being used (fraudulently) to authenticate.Picture of a doctor's face in the parking lot, and then displaying the photo to a biometric face scanner.Secure authentication, secure data transmission, cost-effective security, and fast execution of security mechanisms are all highly desirable when implementing biometrics and electronic prescriptions on a large scale.
The Impact of TechnologyImpact of Artificial "Gummy" Fingers on Fingerprint Systems Tsutomu Matsumoto, Hiroyuki Matsumoto, Koji Yamada, Satoshi HoshinoGraduate School of Environment and Information Sciences, Yokohama National University 79-7 Tokiwadai, Hodogaya, Yokohama 240-8501, Japan, email: firstname.lastname@example.org
ABSTRACT Potential threats caused by something like real fingers, which are called fake or artificial fingers, should be crucial for authentication based on fingerprint systems. Security evaluation against attacks using such artificial fingers has been rarely disclosed. Only in patent literature, measures, such as "live and well" detection, against fake fingers have been proposed. However, the providers of fingerprint systems usually do not mention whether or not these measures are actually implmented in emerging fingerprint systems for PCs or smart cards or portable terminals, which are expected to enhance the grade of personal authentication necessary for digital transactions. As researchers who are pursuing secure systems, we would like to discuss attacks using artificial fingers and conduct experimental research to clarify the reality. This paper reports that gummy fingers, namely artificial fingers that are easily made of cheap and readily available gelatin, were accepted by extremely high rates by particular fingerprint devices with optical or capacitive sensors. We have used the molds, which we made by pressing our live fingers against them or by processing fingerprint images from prints on glass surfaces, etc. We describe how to make the molds, and then show that the gummy fingers, which are made with these molds, can fool the fingerprint devices. ConclusionsOnline pharmacy popularity using legal prescriptionsPractical, political, and privacy concerns must be addressed in tandem.Market acceptance is possible (RiteAid)Biometric, hardware, cryptographic mechanisms for securing prescriptions are complex
ReferencesBackground image: http://minnesota.publicradio.org/display/web/2006/11/28/eprescriptions/#