Biometric Authentication

We’ve mentioned biometrics already. Let’s take a much deeper look now at the different types of biometric authentication. “Biometric,” as a word, means the measurement of a biological characteristic. We’re measuring some aspect of the human form, something you are. What we’re not doing is taking a complete copy of that characteristic. Usually what we’re doing is generating a representation of the physical characteristic. When you enroll your fingerprint with a smartphone, for example, it is not taking a photograph of your fingerprint. It is generating a digital template. And any attempt to authenticate compares the digital template against your fingerprint at the point of authentication.

Typically, you’ll notice when you’ve enrolled through, especially, with fingerprint scanners, your device will take multiple copies of a template. And it will ask for the edges of your fingerprint, multiple copies of the main body of your fingerprint, and this is to ensure that it has multiple templates to compare against.

For biometric authentication, in theory, this is harder to counterfeit and grants us a much higher level of assurance. In practice, though, there are some known problems with biometric authentication. And we’ll look at some more specific examples in a few slides’ time. But just for now, bear in mind that when Apple released the face identification system with the iPhone that very quickly people were taking photographs and generating 3D templates from them, so taking multiple photographs, creating 3D printed masks to represent that identity. Similarly with fingerprints, there’s work that’s been done to create master key fingerprint templates.

And these typically rely on emulating the patterns of edge fingerprints, which are much more common and less unique than the main body of the fingerprint. And so these have, the creators of this research were saying that they have fingerprints that can be used in up to 60% of authentications for different fingerprint types. So the level of counterfeiting, at the moment, is still relatively low. Potentially moving forward, we see signs of people finding different ways to exploit weaknesses around the use of biometrics. In practice, we want to consider the effectiveness related to the quality of the implementation. As with any system, how well it is implemented is critical and also the number of points and uniqueness that comprise each template.

And there’s a balance here. If we’re creating a template, if we want a very unique template, why don’t we always use hundreds of points for the template? Well, that increases the likelihood of false rejections during the authentication process. And there is something of a balance here. The number of points and the uniqueness that we take during the creation of those templates will be a compromise between the false acceptance rate and the false rejection rate – how usable we want the system to be, in effect.