Access Control

An Overview of
Biometrics
 Contents Biometric Systems

1. Introduction
2. Biometric identifiers
3. Classification of biometrics methods
4. Biometric system architecture
5. Performance evaluation

2
SECURITY INNOVATION ©2003
 Contents Biometric Systems

6. Signature recognition
7. Voice recognition
8. Retinal scan
9. Iris scan
10. Face-scan and facial thermograph
11. Hand geometry

3
SECURITY INNOVATION ©2003
 Personal Identification

Association of an individual with an identity:

• Verification (or authentication): confirms or denies a

claimed identity.
• Identification (or recognition): establishes the identity
of a subject (usually from a set of enrolled persons).

4
SECURITY INNOVATION ©2003
 Personal Identification Objects

• Token-based:
“something that you have”
• Knowledge-based:
“something that you
know”
• Biometrics-based:
“something that you are”

5
SECURITY INNOVATION ©2003
 Biometrics
• Bio + metrics:
– The statistical measurement of biological data.
• Biometric Consortium definition:
– Automatically recognizing a person using
distinguishing traits.

6
SECURITY INNOVATION ©2003
 Application Domains (I)
• Access control
– to devices
• cellular phones
• logging into a computer, laptop, or PDA
• cars
• guns
– to local services
• money from a ATM machine
• logging in to computer
• accessing data on smartcard
– to remote services
• e-commerce
• e-business

7
SECURITY INNOVATION ©2003
 Application Domains (II)

• Physical access control

– to high security areas
– to public buildings or areas
• Time & attendance control
• Identification
– forensic person investigation
– social services applications, e.g. immigration or
prevention of welfare fraud
– personal documents, e.g. electronic drivers license
or ID card
8
SECURITY INNOVATION ©2003
 Biometric Identifiers

Ideal Properties Considerations

• Universality • Performance
• Uniqueness • Acceptability
• Stability • Forge resistance
• Quantitative

9
SECURITY INNOVATION ©2003
 Biometric Technologies

• Covered in ISO/IEC 27N2949:

– recognition of signatures,
– fingerprint analysis,
– speaker recognition,
– retinal scan,
– iris scan,
– face recognition,
– hand geometry.

10
SECURITY INNOVATION ©2003
 Other Biometric Methods

• Found in the literature:

– vein recognition (hand),
– keystroke dynamics,
– palm print,
– gait recognition,
– ear shape.

11
SECURITY INNOVATION ©2003
 Classification of Biometric
Methods

• Static: • Dynamic:
– fingerprint – signature recognition
– retinal scan – speaker recognition
– iris scan
– hand geometry

12
SECURITY INNOVATION ©2003
 Biometric System Architecture

• Basic modules of a biometric system:

– Data acquisition
– Feature extraction
– Matching
– Decision
– Storage

13
SECURITY INNOVATION ©2003
 Biometric System Model

Raw data Extracted template

Data features
collection Signal matching storage
processing

score

Application decision
Authentication decision

14
SECURITY INNOVATION ©2003
 Data Acquisition Module

• Reads the biometric info from the user.

• Examples: video camera, fingerprint
scanner/sensor, microphone, etc.
• All sensors in a given system must be similar
to ensure recognition at any location.
• Environmental conditions may affect their
performance.

15
SECURITY INNOVATION ©2003
 Feature Extraction Module

• Discriminating features extracted from the

raw biometric data.
• Raw data transformed into small set of bytes –
storage and matching.
• Various ways of extracting the features.
• Pre-processing of raw data usually necessary.

16
SECURITY INNOVATION ©2003
 Matching Module

• The core of the biometric system.

• Measures the similarity of the claimant’s
sample with a reference template.
• Typical methods: distance metrics,
probabilistic measures, neural networks, etc.
• The result: a number known as match score.

17
SECURITY INNOVATION ©2003
 Decision Module

• Interprets the match score from the matching

module.
• Typically a binary decision: yes or no.
• May require more than one submitted
samples to reach a decision: 1 out of 3.
• May reject a legitimate claimant or accept an
impostor.

18
SECURITY INNOVATION ©2003
 Storage Module

• Maintains the templates for enrolled users.

• One or more templates for each user.
• The templates may be stored in:
– a special component in the biometric device,
– conventional computer database,
– portable memories such as smartcards.

19
SECURITY INNOVATION ©2003
 Enrolment

• Capturing, processing and storing of the

biometric template.
• Crucial for the system performance.
• Requirements for enrolment:
– secure enrolment procedure,
– check of template quality and “matchability”,
– binding of the biometric template to the person
being enrolled.

20
SECURITY INNOVATION ©2003
 Possible Decision Outcomes

• A genuine individual is accepted.

• A genuine individual is rejected (error).
• An impostor is rejected.
• An impostor is accepted (error).

21
SECURITY INNOVATION ©2003
 Errors

• Balance needed between 2 types of error:

– Type I: system fails to recognize valid user (‘false
non-match’ or ‘false rejection’).
– Type II: system accepts impostor (‘false match’ or
‘false acceptance’).
• Application dependent trade-off between two
error types.

22
SECURITY INNOVATION ©2003
 Tolerance Threshold
• Error tolerance threshold is crucial and
application dependent.
• Tolerance too large gives Type II error (admit
impostors).
• Tolerance too small gives Type I errors (reject
legitimate users).
• Equal error rate for comparison: false non-
match equal to false match.

23
SECURITY INNOVATION ©2003
 Biometric Technologies
• Signature recognition
• Voice recognition
• Retinal scan
• Iris scan
• Face biometrics
• Hand geometry

24
SECURITY INNOVATION ©2003
 Signature Recognition

• Signatures in wide use for many years.

• Signature generating process a trained reflex -
imitation difficult especially ‘in real time’.
• Automatic signature recognition measures the
dynamics of the signing process.

25
SECURITY INNOVATION ©2003
 Dynamic Signature Recognition

• Variety of characteristics can be used:

– angle of the pen,
– pressure of the pen,
– total signing time,
– velocity and acceleration,
– geometry.

26
SECURITY INNOVATION ©2003
 Dynamic Signature Verification
(I)

Electronic pen [LCI-SmartPen]

27
SECURITY INNOVATION ©2003
 Dynamic Signature Verification
(II)

Digitising tablet by Digitising tablet [Hesy Signature Pad

Wacom Technologies by BS Biometric Systems GmbH]

28
SECURITY INNOVATION ©2003
 Signature Recognition:
Advantages / Disadvantages
• Advantages:
– Resistance to forgery
– Widely accepted
– Non-intrusive
– No record of the signature
• Disadvantages:
– Signature inconsistencies
– Difficult to use
– Large templates (1K to 3K)

29
SECURITY INNOVATION ©2003
 Fingerprint Recognition
• Ridge patterns on fingers uniquely identify
people.
• Classification scheme devised in 1890s.
• Major features: arch, loop, whorl.
• Each fingerprint has at least one of the major
features and many ‘small’ features.

30
SECURITY INNOVATION ©2003
 Features of Fingerprints

31
SECURITY INNOVATION ©2003
 Fingerprint Recognition (cont.)

• In a machine system, reader must minimize

image rotation.
• Look for minutiae and compare.
• Minor injuries a problem.
• Automatic systems can not be defrauded by
detached real fingers.

32
SECURITY INNOVATION ©2003
 Fingerprint Authentication
• Basic steps for fingerprint authentication:
– Image acquisition,
– Noise reduction,
– Image enhancement,
– Feature extraction,
– Matching.

33
SECURITY INNOVATION ©2003
 Fingerprint Processing
a b

a) Original
b) Orientation
c d
c) Binarised
d) Thinned
e f e) Minutiae
f) Minutia graph

34
SECURITY INNOVATION ©2003
 Fingerprint Recognition

• Sensors
– optical sensors
– ultrasound sensors
– chip-based sensors
– thermal sensors
• Integrated products
– for identification – AFIS systems
– for verification

35
SECURITY INNOVATION ©2003
 Fingerprint Recognition:
Sensors (I)

Electro-optical sensor
[DELSY® CMOS sensor modul]
Optical fingerprint sensor
[Fingerprint Identification Unit
FIU-001/500 by Sony]

Capacitive sensor
[FingerTIP™ by Infineon]

36
SECURITY INNOVATION ©2003
 Fingerprint Recognition:
Sensors (II)

Thermal sensor
[FingerChip™ by ATMEL
(was: Thomson CSF)]

E-Field Sensor
[FingerLoc™ by Authentec]

37
SECURITY INNOVATION ©2003
 Fingerprint Recognition:
Integrated Systems (I)

[BioMouse™ Plus by American Biometric Company]

Physical Access Control System

[BioGate Tower by Bergdata]
[ID Mouse by Siemens]
38
SECURITY INNOVATION ©2003
 Fingerprint Recognition:
Integrated Systems (II)

Keyboard [G 81-12000
by Cherry]

[TravelMate 740 by Compaq und Acer]

System including
fingerprint sensor,
smartcard reader and
display by DELSY

39
SECURITY INNOVATION ©2003
 Fingerprint Recognition:
Advantages / Disadvantages
• Advantages:
– Mature technology
– Easy to use/non-intrusive
– High accuracy
– Long-term stability
– Ability to enrol multiple fingers
• Disadvantages:
– Inability to enrol some users
– Affected by skin condition
– Association with forensic applications

40
SECURITY INNOVATION ©2003
 Speech Recognition

• Linguistic and speaker dependent acoustic

patterns.
• Speaker’s patterns reflect:
– anatomy (size and shape of mouth and throat),
– behavioral (voice pitch, speaking style).
• Heavy signal processing involved (spectral
analysis, periodicity, etc)

41
SECURITY INNOVATION ©2003
 Speaker Recognition Systems

• Text-dependent: predetermined set of phrases

for enrolment and identification.
• Text-prompted: fixed set of words, but user
prompted to avoid recorded attacks.
• Text-independent: free speech, more difficult
to accomplish.

42
SECURITY INNOVATION ©2003
 Speaker Recognition:
Advantages/ Disadvantages
• Advantages:
– Use of existing telephony infrastructure
– Easy to use/non-intrusive/hands free
– No negative association
• Disadvantages:
– Pre-recorded attack
– Variability of the voice
– Affected by noise
– Large template (5K to 10K)

43
SECURITY INNOVATION ©2003
 Eye Biometric

• Retina:
– back inside of the eye ball.
– pattern of blood vessels used for identification
• Iris:
– colored portion of the eye surrounding the pupil.
– complex iris pattern used for identification.

44
SECURITY INNOVATION ©2003
 Retinal Pattern

• Accurate biometric measure.

• Genetically independent: identical twins have
different retinal pattern.
• Highly protected, internal organ of the eye.
• May change during the life of a person.

45
SECURITY INNOVATION ©2003
 Retinal Recognition

Retinal recognition system [Icam 2001 by Eyedentify]

46
SECURITY INNOVATION ©2003
 Retinal Scan:
Advantages / Disadvantages
• Advantages:
– High accuracy
– Long-term stability
– Fast verification
• Disadvantages:
– Difficult to use
– Intrusive
– Limited applications

47
SECURITY INNOVATION ©2003
 Iris Properties

• Iris pattern possesses a high degree of randomness:

extremely accurate biometric.
• Genetically independent: identical twins have
different iris pattern.
• Stable throughout life.
• Highly protected, internal organ of the eye.
• Patterns can be acquired from a distance (1m).
• Patterns can be encoded into 256 bytes.

48
SECURITY INNOVATION ©2003
 Iris Recognition

• Iris code developed by John Daugman at Cambridge.

• Extremely low error rates.
• Fast processing.
• Monitoring of pupils oscillation to prevent fraud.
• Monitoring of reflections from the moist cornea of the
living eye.

49
SECURITY INNOVATION ©2003
 The Iris Code

50
SECURITY INNOVATION ©2003
 Iris Recognition

System for passive iris recognition by Sensar

System for active iris recognition by

IrisScan
51
SECURITY INNOVATION ©2003
 Iris Recognition:
Advantages / Disadvantages
• Advantages:
– High accuracy
– Long term stability
– Nearly non-intrusive
– Fast processing
• Disadvantages:
– Not exactly easy to use
– High false non-match rates
– High cost

52
SECURITY INNOVATION ©2003
 Face-scan and Facial
Thermographs
• Static controlled or dynamic uncontrolled
shots.
• Visible spectrum or infrared (thermographs).
• Non-invasive, hands-free, and widely
accepted.
• Questionable discriminatory capability.

53
SECURITY INNOVATION ©2003
 Face Recognition
• Visible spectrum: inexpensive.
• Most popular approaches:
– eigen faces,
– Local feature analysis.
• Affected by pose, expression, hairstyle, make-
up, lighting, eyeglasses.
• Not a reliable biometric measure.

54
SECURITY INNOVATION ©2003
 Face Recognition

Face recognition system

[TrueFace Engine by Miros]

Face recognition system

[One-to-One™ by Biometric Access Corporation]

55
SECURITY INNOVATION ©2003
 Face Recognition:
Advantages / Disadvantages
• Advantages:
– Non-intrusive
– Low cost
– Ability to operate covertly
• Disadvantages:
– Affected by appearance/environment
– High false non-match rates
– Identical twins attack
– Potential for privacy abuse

56
SECURITY INNOVATION ©2003
 Facial Thermograph

• Captures the heat emission patterns derived

from the blood vessels under the skin.
• Infrared camera: unaffected by external
changes (even plastic surgery!) or lighting.
• Unique but accuracy questionable.
• Affected by emotional and health state.

57
SECURITY INNOVATION ©2003
 Facial Thermograph:
Advantages / Disadvantages
• Advantages:
– Non-intrusive
– Stable
– Not affected by external changes
– Identical twins resistant
– Ability to operate covertly
• Disadvantages:
– High cost (infrared camera)
– New technology
– Potential for privacy abuse

58
SECURITY INNOVATION ©2003
 Hand Geometry

• Features: dimensions and shape of the hand,

fingers, and knuckles as well as their relative
locations.
• Two images taken: one from the top and one
from the side.

59
SECURITY INNOVATION ©2003
 Hand Geometry Reading

Hand geometry reader by Recognition Systems

Hand geometry reader for

two finger recognition by BioMet Partners

60
SECURITY INNOVATION ©2003
 Hand Geometry:
Advantages / Disadvantages
• Advantages:
– Not affected by environment
– Mature technology
– Non-intrusive
– Relatively stable
• Disadvantages:
– Low accuracy
– High cost
– Relatively large readers
– Difficult to use for some users (arthritis, missing
fingers or large hands)
61
SECURITY INNOVATION ©2003
 Multimodal Biometric Systems

• Combination of biometric technologies

– Fingerprint and face recognition
– Face recognition and lip movement
– Fingerprint recognition and dynamic signature
verification
• Increase the level of security achieved by the
system
• Enlarge the user base

62
SECURITY INNOVATION ©2003
 How good are biometric
products?
• How can we find out, how good a biometric
product is?
– Empirical tests of the product
• There have been independent tests on a series
of biometric products
– in Japan
– in Germany

63
SECURITY INNOVATION ©2003
 Different Threat Scenarios

1. Regular biometric
sensor using
artificially generated
biometric data

2. Replay attack of
eavesdropped
biometric data

3. Manipulation of
stored biometric
reference data

64
SECURITY INNOVATION ©2003
 Japanese Test
• Tsutomu Matsumoto, a Japanese
cryptographer working at Yokohama
National University
• 11 state-of-the-art fingerprint sensors
• 2 different processes to make gummy fingers
– from live finger
– from latent fingerprint

Gummy fingers fooled fingerprint sensors

80% of the time

65
SECURITY INNOVATION ©2003
 Test in Germany (I)
• 11 biometric sensors
– 9 fingerprint sensors,
– 1 face recognition system, and
– 1 iris scanner
• Fingerprint sensors –
– reactivate latent fingerprints (optical and capacitive sensors)
– apply latex finger (thermal sensor)
• Face recognition system –
– down- (up-) load biometric reference data from (to) hard
disk
– no or only weak life detection

66
SECURITY INNOVATION ©2003
 Test in Germany (II)

• Iris recognition –
– picture of iris of enrolled person with cut-out
pupil, where a real pupil is displayed

All tested biometric systems could be

fooled, but the effort differed
considerably
67
SECURITY INNOVATION ©2003
 Choosing the Biometrics

• Does the application need identification or

authentication?
• Is the collection point attended or
unattended?
• Are the users used to the biometrics?
• Is the application covert or overt?

68
SECURITY INNOVATION ©2003
 Choosing the Biometrics (cont.)

• Are the subjects cooperative or non-

cooperative?
• What are the storage requirement
constraints?
• How strict are the performance
requirements?
• What types of biometrics are acceptable to the
users?

69
SECURITY INNOVATION ©2003
 Conclusions

• Biometric technology has great potential

• There are many biometric products around,
regarding the different biometric technologies
• Shortcomings of biometric systems due to
– manufacturers ignorance of security concerns
– lack of quality control
– standardisation problems
• Biometric technology is very promising
• Manufacturers have to take security concerns
serious
70
SECURITY INNOVATION ©2003