Drawbacks of Biometric Methods
Martin Kákona, martin.kakona@i.cz, 2001
Abstract
The paper points to the drawbacks of four particular principles of fingerprint taking and presents examples why these and similar methods cannot be used for users authentication.
Key Words: biometrics, fingerprint, papillary terrain, fingerprint sensor.
Last year I was concerned about the fact that a number of well-established companies have introduced on the market fingerprint sensor chips and launched commercial sale of several very attractively priced solutions using fingerprint-based authentication. Biometrics has even become a popular topic at some international fairs in presentations of companies dealing with data security. Advertising materials of some manufacturers of biometric devices even claim that users no longer need to remember any passwords. The method is therefore very attractive from the viewpoint of users.
However, the situation on the market is in sharp contradiction to my practical experience with biometrics. This is why I have decided to submit some results of my investigations and to point to some pitfalls associated with the use of biometric methods.
The text below deals exclusively with the identification of users based on fingerprints. It is because I have the biggest practical experience in this very field and also because this method is now the most frequently used biometric method. I will pay a particular attention to the question of possible user authentication with fingerprints.
Optical sensors usually contain an optical prism with a source of light on one side and a camera on the other side to sense the transmitted light. A CCD sensor is usually used as the camera and an LED as the source.
The sensor principle is shown in Figure 1. Once a finger is placed on the prism the boundary glass-air causes that most light from the LED source is reflected into the CCD. With a finger or another body part featuring papillary terrain is placed on the prism a contact is established on the papillary lines through sweat on the surface. The sweat alters the refraction index at the contact points with the prism. The boundary glass-air along the papillary line is replaced with the boundary glass –liquid. The CCD camera then receives less reflected light from such lines.
Figure. 1: Optical Sensor Principle
Once the finger is removed from the sensor some traces of sweat remain on the prism. The traces retain the optical properties of the glass-liquid boundary and the sensor sees a latent image of the papillary terrain. The optical sensor must therefore be cleaned after each use.
The pressure sensor seeks to eliminate the drawbacks of the optical one - the latent image of papillary terrain - by sensing pressure on a fingerprint pad. As the pressure is higher on papillary lines the resulting image is actually three-dimensional.
One of the possible designs of the sensor is shown in Figure 2. It is a modified optical sensor, with a plastic-coated surface of the prism. The light passing through the prism is again mostly reflected into the CCD sensor. The plastic layer is deformed with papillary lines and the light is diffused. As a result the lines again reflect less light into the CCD sensor.
Figure 2: Pressure Sensor Principle
The chief drawback of the pressure sensor is its lower resolution compared to the optical one, particularly due to limited deformability of the thin plastic layer. The practical resolution ability is so poor that this sensor is not capable of discerning between a real finger and a fingerprint image from a laser printer. The fingerprint image from a laser printer is indeed three-dimensional and its depth is sufficient to deform the thin plastic layer and to create an image which cannot be distinguished from the real papillary terrain.
The sensor is an electrode matrix with gradually connected power supply to measure surface resistance of the skin. See Figure 3.
Figure 3: Resistance Sensor Principle
The surface resistance is determined mainly by conductivity of a liquid (sweat) covering the skin. However, it is fairly easy to imitate the electric properties of sweat. In terms of electric parameters it may replaced with a salt solution of suitable concentration.
Another method is shown in Figure 4. It demonstrates transferring of a thin graphite layer from paper on a fake finger, made with a technique used for rubber stamps. The resulting resistance on the stamp surface is then comparable with that on human skin.
Figure 4: Graphite application on the stamp
It would be more precise to describe this sensor as the one with a capacity coupling. The principle is similar to the resistance sensor, however the direct contact is replaced with a capacity coupling. Figure 5 presents two options of impedance measuring. The more common method is the impedance measuring between individual electrodes. Alternatively, impedance measurements related to the ground may be used or related to a common reference electrode.
Figure: Capacitor Sensor Principle
Drawbacks of the capacitor sensor are similar to those of the resistance one.
There is another potential method of attack against this sensor to be mentioned here. In usual office environment it is possible to initiate water condensation on the sensor surface, by simply breathing on it. Traces of sweat from previous measurements mix with the condensed water and generate conductive routes simulating previously sensed papillary lines!
Other fingerprint sensors also manifest similar drawbacks. The key problem of fingerprint sensors is not in their identification ability but in authentication of fingerprints. This means that the commercially available technologies using fingerprint sensors fail to assure their authentication.
The author has not been able to find any specialized literature supporting his findings. Therefore more general literature is recommended to the readers, e.g. the Feynman, Leighton, Sands: The Feynman Lectures on Physics, Addison Wesley Longman, Inc. (1985).