Liveness Detection in Fingerprint Recognition Systems19729/FULLTEXT01.pdf · Liveness Detection in Fingerprint Recognition Systems Författare Author Marie Sandström Sammanfattning

Liveness Detection in FingerprintRecognition Systems

Examensarbete utfort i Informationsteorivid Linkopings tekniska hogskola

av

Marie Sandstrom

Reg nr: LITH-ISY-EX-3557-2004Linkoping 2004

Liveness Detection in FingerprintRecognition Systems

Examensarbete utfort i Informationsteorivid Linkopings tekniska hogskola

av

Marie Sandstrom

Reg nr: LITH-ISY-EX-3557-2004

Supervisor: Fredrik Claesson

Examiner: Viiveke Fak

Linkoping 10th June 2004.

Avdelning, Institution Division, Department

Institutionen för systemteknik 581 83 LINKÖPING

Datum Date 2004-06-04

Språk Language

Rapporttyp Report category

ISBN

Svenska/Swedish X Engelska/English

Licentiatavhandling X Examensarbete

ISRN LITH-ISY-EX-3557-2004

C-uppsats D-uppsats

Serietitel och serienummer Title of series, numbering

ISSN

Övrig rapport ____

URL för elektronisk version http://www.ep.liu.se/exjobb/isy/2004/3557/

Titel Title

Detektering av Artificiella Fingeravtryck vid Användarautenticiering Liveness Detection in Fingerprint Recognition Systems

Författare Author

Marie Sandström

Sammanfattning Abstract Biometrics deals with identifying individuals with help of their biological data. Fingerprint scanning is the most common method of the biometric methods available today. The security of fingerprint scanners has however been questioned and previous studies have shown that fingerprint scanners can be fooled with artificial fingerprints, i.e. copies of real fingerprints. The fingerprint recognition systems are evolving and this study will discuss the situation of today. Two approaches have been used to find out how good fingerprint recognition systems are in distinguishing between live fingers and artificial clones. The first approach is a literature study, while the second consists of experiments. A literature study of liveness detection in fingerprint recognition systems has been performed. A description of different liveness detection methods is presented and discussed. Methods requiring extra hardware use temperature, pulse, blood pressure, electric resistance, etc., and methods using already existent information in the system use skin deformation, pores, perspiration, etc. The experiments focus on making artificial fingerprints in gelatin from a latent fingerprint. Nine different systems were tested at the CeBIT trade fair in Germany and all were deceived. Three other different systems were put up against more extensive tests with three different subjects. All systems were circumvented with all subjects' artificial fingerprints, but with varying results. The results are analyzed and discussed, partly with help of the A/R value defined in this report.

Nyckelord Keyword biometrics, identification, verification, fingerprints, fingerprint scanners, sensor attacks, artificial fingerprints, liveness detection

Abstract

Biometrics deals with identifying individuals with help of their biological data.Fingerprint scanning is the most common method of the biometric methods avail-able today. The security of fingerprint scanners has however been questioned andprevious studies have shown that fingerprint scanners can be fooled with artificialfingerprints, i.e. copies of real fingerprints. The fingerprint recognition systems areevolving and this study will discuss the situation of today.

Two approaches have been used to find out how good fingerprint recognition sys-tems are in distinguishing between live fingers and artificial clones. The first ap-proach is a literature study, while the second consists of experiments.

A literature study of liveness detection in fingerprint recognition systems has beenperformed. A description of different liveness detection methods is presented anddiscussed. Methods requiring extra hardware use temperature, pulse, blood pres-sure, electric resistance, etc., and methods using already existent information inthe system use skin deformation, pores, perspiration, etc.

The experiments focus on making artificial fingerprints in gelatin from a latentfingerprint. Nine different systems were tested at the CeBIT trade fair in Germanyand all were deceived. Three other different systems were put up against moreextensive tests with three different subjects. All systems were circumvented with allsubjects’ artificial fingerprints, but with varying results. The results are analyzedand discussed, partly with help of the A/R value defined in this report.

i

ii

Acknowledgment

A number of people have helped me making this thesis work possible. First ofall, I would like to thank everybody at ISY, especially my examiner Viiveke Fak,my supervisor Fredrik Claesson, the Data Transmission group for lending me theircamera, and Soren Hansson, who helped me with the PCB production part ofthe experiments. I would also like to take the opportunity to thank the Finger-print Group at the National Laboratory of Forensic Science (SKL), especially LenaHallberg and Goran Kidfelt.

I could not have performed the experiments without the participants. Thank youfor lending me your fingerprints! The experiments at CeBIT would not have beenable to perform without the companies who let me try their products. Thank youall for being patient with me!

I would also like to thank the following people who helped me in various ways: UlfSoderholm, Fredrik Larsson, Bjorn Mellstrom, Bo Thuner, Susanne Edlund, MariaMagnusson Seger, Johan Blomme, and Andreas Bergner.

Last but not least, I would like to thank Hannes Lindblom, whom I could not havedone this thesis without.

iii

iv

Be aware. . .

Before you start reading this report, take a close look at your fingertips. Yourpapillary lines might form a loop, a whorl, or maybe it looks more like an arch.If you look even closer, you might be able to see some lines that split into two, adelta pattern somewhere, and maybe you can even see some sweat drops comingout of the pores on your fingertips.

Your fingerprint patterns are most certainly unique in the whole world. In theory,it is thus possible to identify you with help of a single fingerprint. If it was possibleto make a copy of your fingerprint, your identity could then be used. Do youremember every single thing you touched today? Maybe you touched a few doorhandles, a glass, or a cup. Are you sure nobody has been watching you to be ableto steal your fingerprint? Remember that a password can be changed, a new creditcard can be bought, but a finger is not as easily changed.

v

vi

Contents

1 Introduction 11.1 Background . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11.2 Basic terminology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11.3 Goal . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21.4 Purpose . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21.5 Method . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21.6 Method criticism and limitations . . . . . . . . . . . . . . . . . . . . 21.7 Target group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31.8 Reading guide . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31.9 Notes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4

2 Biometric overview 72.1 Identification and verification . . . . . . . . . . . . . . . . . . . . . . 7

2.1.1 Methods of identification and verification . . . . . . . . . . . 82.1.2 Results from identification and verification procedures . . . . 9

2.2 Biometric techniques . . . . . . . . . . . . . . . . . . . . . . . . . . . 102.2.1 Physical characteristics . . . . . . . . . . . . . . . . . . . . . 102.2.2 Behavioral characteristics . . . . . . . . . . . . . . . . . . . . 10

3 Fingerprints 133.1 History . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 133.2 Today . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 143.3 Fingerprint characteristics . . . . . . . . . . . . . . . . . . . . . . . . 15

3.3.1 Classification and pattern types . . . . . . . . . . . . . . . . . 163.3.2 Terminology . . . . . . . . . . . . . . . . . . . . . . . . . . . 16

3.4 Enhancement techniques . . . . . . . . . . . . . . . . . . . . . . . . . 193.4.1 Processing techniques . . . . . . . . . . . . . . . . . . . . . . 19

4 Fingerprint scanners 214.1 Fingerprint images . . . . . . . . . . . . . . . . . . . . . . . . . . . . 224.2 Scanning techniques . . . . . . . . . . . . . . . . . . . . . . . . . . . 22

4.2.1 Optical sensors . . . . . . . . . . . . . . . . . . . . . . . . . . 224.2.2 Solid-state sensors . . . . . . . . . . . . . . . . . . . . . . . . 25

vii

viii Contents

4.2.3 Ultrasonic sensors . . . . . . . . . . . . . . . . . . . . . . . . 274.3 Touch versus sweep . . . . . . . . . . . . . . . . . . . . . . . . . . . . 284.4 Algorithms in fingerprint scanners . . . . . . . . . . . . . . . . . . . 29

4.4.1 Image enhancement . . . . . . . . . . . . . . . . . . . . . . . 304.4.2 Feature extraction and comparison . . . . . . . . . . . . . . . 30

4.5 Sensor attacks and protection schemes . . . . . . . . . . . . . . . . . 314.5.1 Registered finger . . . . . . . . . . . . . . . . . . . . . . . . . 314.5.2 Unregistered finger . . . . . . . . . . . . . . . . . . . . . . . . 324.5.3 A twin’s fingerprint or a genetic clone . . . . . . . . . . . . . 324.5.4 Artificial fingerprint . . . . . . . . . . . . . . . . . . . . . . . 324.5.5 Others . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32

5 Liveness detection 355.1 Liveness detection in biometric systems . . . . . . . . . . . . . . . . 355.2 Using extra hardware . . . . . . . . . . . . . . . . . . . . . . . . . . 37

5.2.1 Temperature . . . . . . . . . . . . . . . . . . . . . . . . . . . 375.2.2 Optical properties . . . . . . . . . . . . . . . . . . . . . . . . 375.2.3 Pulse . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 375.2.4 Pulse oximetry . . . . . . . . . . . . . . . . . . . . . . . . . . 385.2.5 Blood pressure . . . . . . . . . . . . . . . . . . . . . . . . . . 385.2.6 Electric resistance . . . . . . . . . . . . . . . . . . . . . . . . 385.2.7 Relative dielectric permittivity . . . . . . . . . . . . . . . . . 395.2.8 Combining ECG, pulse oximetry, and temperature . . . . . . 395.2.9 Detection under epidermis . . . . . . . . . . . . . . . . . . . . 405.2.10 Other claims . . . . . . . . . . . . . . . . . . . . . . . . . . . 40

5.3 Using existing information . . . . . . . . . . . . . . . . . . . . . . . . 415.3.1 Skin deformation . . . . . . . . . . . . . . . . . . . . . . . . . 415.3.2 Pores . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 415.3.3 Unique characteristic for each individual . . . . . . . . . . . . 415.3.4 Perspiration . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42

5.4 Testing of liveness detection methods . . . . . . . . . . . . . . . . . . 455.5 Relevance of liveness detection . . . . . . . . . . . . . . . . . . . . . 455.6 Other methods to limit spoofing . . . . . . . . . . . . . . . . . . . . 45

5.6.1 Multiple snapshots of the same finger . . . . . . . . . . . . . 455.6.2 Multiple fingers . . . . . . . . . . . . . . . . . . . . . . . . . . 465.6.3 Challenge-response . . . . . . . . . . . . . . . . . . . . . . . . 465.6.4 Supervision . . . . . . . . . . . . . . . . . . . . . . . . . . . . 465.6.5 Multi-modal biometrics . . . . . . . . . . . . . . . . . . . . . 475.6.6 Multiple identification/verification methods . . . . . . . . . . 47

5.7 Additional comments . . . . . . . . . . . . . . . . . . . . . . . . . . . 47

6 History of artificial fingerprints 496.1 Albert Wehde’s work . . . . . . . . . . . . . . . . . . . . . . . . . . . 496.2 Six biometric devices point the finger at security . . . . . . . . . . . 506.3 Biometrical fingerprint recognition: don’t get your fingers burned . . 50

Contents ix

6.4 Impact of Artificial ”Gummy” Fingers on Fingerprint Systems . . . 516.5 Body Check – Biometric Access Protection Devices and their Pro-

grams Put to the Test . . . . . . . . . . . . . . . . . . . . . . . . . . 526.6 An Investigation Into the Vulnerability of the Siemens ID Mouse

Professional Version 4 . . . . . . . . . . . . . . . . . . . . . . . . . . 526.7 Spoofing and Anti-Spoofing Measures . . . . . . . . . . . . . . . . . 536.8 Fooling Fingerprint Scanners – Biometric Vulnerabilities of the Pre-

cise Biometrics 100 SC Scanner . . . . . . . . . . . . . . . . . . . . . 546.9 Evaluation of biometric security systems against artificial fingers . . 54

7 Experiment description 557.1 Making of the artificial fingerprint . . . . . . . . . . . . . . . . . . . 55

7.1.1 Enhancing the fingerprint . . . . . . . . . . . . . . . . . . . . 557.1.2 Photographing the fingerprint . . . . . . . . . . . . . . . . . . 587.1.3 Image processing . . . . . . . . . . . . . . . . . . . . . . . . . 587.1.4 Printing the image . . . . . . . . . . . . . . . . . . . . . . . . 597.1.5 PCB production . . . . . . . . . . . . . . . . . . . . . . . . . 597.1.6 Gelatin solution . . . . . . . . . . . . . . . . . . . . . . . . . 59

7.2 Experiments at CeBIT . . . . . . . . . . . . . . . . . . . . . . . . . . 627.3 Extensive experiments . . . . . . . . . . . . . . . . . . . . . . . . . . 63

7.3.1 Subjects and input . . . . . . . . . . . . . . . . . . . . . . . . 637.3.2 Software and hardware . . . . . . . . . . . . . . . . . . . . . . 647.3.3 Experiment procedure . . . . . . . . . . . . . . . . . . . . . . 65

8 Results 678.1 CeBIT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 678.2 Extensive experiments . . . . . . . . . . . . . . . . . . . . . . . . . . 68

8.2.1 Results in numbers . . . . . . . . . . . . . . . . . . . . . . . . 688.2.2 Results in percent . . . . . . . . . . . . . . . . . . . . . . . . 71

9 Discussion and analysis 759.1 Experiment method . . . . . . . . . . . . . . . . . . . . . . . . . . . 75

9.1.1 Enhancing the fingerprint . . . . . . . . . . . . . . . . . . . . 759.1.2 Photographing the fingerprint . . . . . . . . . . . . . . . . . . 789.1.3 Image processing . . . . . . . . . . . . . . . . . . . . . . . . . 789.1.4 Printing the image . . . . . . . . . . . . . . . . . . . . . . . . 809.1.5 PCB production . . . . . . . . . . . . . . . . . . . . . . . . . 809.1.6 Gelatin solution . . . . . . . . . . . . . . . . . . . . . . . . . 81

9.2 Experiments at CeBIT . . . . . . . . . . . . . . . . . . . . . . . . . . 829.2.1 Sweeping sensors . . . . . . . . . . . . . . . . . . . . . . . . . 82

9.3 Extensive experiments . . . . . . . . . . . . . . . . . . . . . . . . . . 839.3.1 Experience . . . . . . . . . . . . . . . . . . . . . . . . . . . . 839.3.2 Subjects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 849.3.3 Initial test results . . . . . . . . . . . . . . . . . . . . . . . . . 849.3.4 The A/R value . . . . . . . . . . . . . . . . . . . . . . . . . . 85

x Contents

9.3.5 Comparison with results from previous studies . . . . . . . . 889.4 Additional comments about artificial fingerprints . . . . . . . . . . . 89

9.4.1 Finding a quality latent fingerprint . . . . . . . . . . . . . . . 899.4.2 Alternative acquisition of fingerprint image . . . . . . . . . . 899.4.3 Economies of scale . . . . . . . . . . . . . . . . . . . . . . . . 899.4.4 Forging fingerprints . . . . . . . . . . . . . . . . . . . . . . . 909.4.5 Cooperation using latent print . . . . . . . . . . . . . . . . . 909.4.6 Using the artificial fingerprint . . . . . . . . . . . . . . . . . . 91

10 Conclusion 9310.1 Final conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9310.2 Future work . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94

10.2.1 Liveness detection . . . . . . . . . . . . . . . . . . . . . . . . 9410.2.2 Artificial fingerprints . . . . . . . . . . . . . . . . . . . . . . . 9410.2.3 Fingerprint scanners . . . . . . . . . . . . . . . . . . . . . . . 9510.2.4 Alternative biometrics . . . . . . . . . . . . . . . . . . . . . . 95

Bibliography 97

A Dictionary 103

B Material 109B.1 Enhancing the fingerprint . . . . . . . . . . . . . . . . . . . . . . . . 109B.2 Photographing the fingerprint . . . . . . . . . . . . . . . . . . . . . . 109B.3 Image processing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 110B.4 Printing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 110B.5 PCB production . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 110B.6 Gelatin solution . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 112

C Experiment details 113C.1 Photographing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113C.2 Image processing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 114C.3 Fingerprint images before and after image processing . . . . . . . . . 116C.4 PCB production . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 117

D Scanners used in extensive experiments 119

E Software used in extensive experiments 121

F Test results 123F.1 Results per fingerprint scanner . . . . . . . . . . . . . . . . . . . . . 123

F.1.1 Identix . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123F.1.2 Targus DEFCONTMAuthenticatorTM . . . . . . . . . . . . . 124F.1.3 PreciseTMBiometrics 100 MC . . . . . . . . . . . . . . . . . . 125

F.2 Results per subject . . . . . . . . . . . . . . . . . . . . . . . . . . . . 126F.2.1 Real fingerprints . . . . . . . . . . . . . . . . . . . . . . . . . 126

Contents xi

F.2.2 Artificial fingerprints . . . . . . . . . . . . . . . . . . . . . . . 127

xii Contents

List of Figures

2.1 Enrollment, verification, and identification. [41] . . . . . . . . . . . . 82.2 The relationship between FRR, FAR, and EER. [34] . . . . . . . . . 9

3.1 The three major pattern types: arches, loops, and whorls. [22] . . . 163.2 Core and delta points. [7] . . . . . . . . . . . . . . . . . . . . . . . . 173.3 Minutiae details. [7] . . . . . . . . . . . . . . . . . . . . . . . . . . . 173.4 Sweat pores. [41] . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 183.5 Cross-section of a papillary line. [48] . . . . . . . . . . . . . . . . . . 18

4.1 An FTIR-based fingerprint sensor. [41] . . . . . . . . . . . . . . . . . 234.2 A fingerprint sensor using FTIR with a sheet prism. [41] . . . . . . . 244.3 Fingerprint sensing using optical fibers. [41] . . . . . . . . . . . . . . 244.4 Electro-optical fingerprint sensor. [41] . . . . . . . . . . . . . . . . . 254.5 Capacitive fingerprint sensor. [41] . . . . . . . . . . . . . . . . . . . . 264.6 An ultrasonic fingerprint sensor. [41] . . . . . . . . . . . . . . . . . . 274.7 A sweeping sensor. [41] . . . . . . . . . . . . . . . . . . . . . . . . . 294.8 Typical structure of a fingerprint recognition system. [3, 42] . . . . . 29

5.1 West Virginia perspiration detection method. [9, 34] . . . . . . . . . 43

7.1 An overview of the process of making the mold. . . . . . . . . . . . . 567.2 Soot powder mixture and squirrel hair brush. . . . . . . . . . . . . . 577.3 A mold with a gelatin solution on top of it. . . . . . . . . . . . . . . 617.4 A fingertip with a wafer-thin gelatin fingerprint on top of it. . . . . . 62

8.1 The number of successful logins with real fingerprints. . . . . . . . . 698.2 The number of false acceptances with artificial fingerprints. . . . . . 708.3 The success rate with real fingerprints. . . . . . . . . . . . . . . . . . 718.4 The FAR with artificial fingerprints. . . . . . . . . . . . . . . . . . . 728.5 Mean values, in percent, for real and artificial fingerprints. . . . . . . 74

9.1 Results of unofficial tests with subject S2. . . . . . . . . . . . . . . . 85

B.1 Materials used during production of PCB. [14] . . . . . . . . . . . . 111B.2 Gelatin used for making artificial fingerprints. [3] . . . . . . . . . . . 112

C.1 S1’s fingerprint before and after image processing. . . . . . . . . . . 116C.2 S2’s fingerprint before and after image processing. . . . . . . . . . . 117C.3 S3’s fingerprint before and after image processing. . . . . . . . . . . 117

D.1 Identix fingerprint scanner. [30] . . . . . . . . . . . . . . . . . . . . . 119D.2 Targus DEFCONTMAuthenticatorTM. [54] . . . . . . . . . . . . . . . 120D.3 PreciseTMBiometrics 100 MC. [2] . . . . . . . . . . . . . . . . . . . . 120

E.1 Screenshot of BioLogonTMfor Windows. [3] . . . . . . . . . . . . . . 121

Contents xiii

E.2 Screenshot of Softex Omnipass. [3] . . . . . . . . . . . . . . . . . . . 122E.3 Screenshot of Precise BioManagerTMincluded in Precise Logon soft-

ware. [3] . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 122

xiv Contents

List of Tables

6.1 Characteristics of a live finger compared to a gelatin artificial fin-gerprint. [42] . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51

6.2 Experiment types. [42] . . . . . . . . . . . . . . . . . . . . . . . . . . 52

7.1 Possible experiment types. [42] . . . . . . . . . . . . . . . . . . . . . 637.2 Testing order for the scanners in round one and two. . . . . . . . . . 66

8.1 Results from attacks with artificial fingerprints at CeBIT. . . . . . . 68

9.1 The A/R value for all subjects, round one. . . . . . . . . . . . . . . . 869.2 The A/R value for all subjects, round two. . . . . . . . . . . . . . . . 86

F.1 Results of the Identix fingerprint scanner for real fingerprints. . . . . 123F.2 Results of the Identix fingerprint scanner for artificial fingerprints,

round one. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 124F.3 Results of the Identix fingerprint scanner for artificial fingerprints,

round two. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 124F.4 Results of the Targus fingerprint scanner for real fingerprints. . . . . 124F.5 Results of the Targus fingerprint scanner for artificial fingerprints,

round one. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125F.6 Results of the Targus fingerprint scanner for artificial fingerprints,

round two. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125F.7 Results of the Precise fingerprint scanner for real fingerprints. . . . . 125F.8 Results of the Precise fingerprint scanner for artificial fingerprints,

round one. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 126F.9 Results of the Precise fingerprint scanner for artificial fingerprints,

round two. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 126F.10 Sum of values per user for real fingerprints. . . . . . . . . . . . . . . 126F.11 Success rate, FRR, and FAR, per subject for real fingerprints. . . . . 127F.12 Sum of values per subject for artificial fingerprints, round one. . . . 127F.13 Sum of values per subject for artificial fingerprints, round two. . . . 127F.14 Values in percent, per subject for artificial fingerprints, round one. . 128F.15 Values in percent, per subject for artificial fingerprints, round two. . 128

Chapter 1

Introduction

This chapter contains a short introduction to the thesis. The goal, purpose,method, and target group will be presented, method criticism and limitations willbe discussed, and a reading guide will give the reader a quick guide to each chapter.

1.1 Background

The use of biometric systems are growing every day. Fingerprint scanning is the onebiometric identification method available today that is mostly used. The security offingerprint scanners has however been questioned and previous studies have shownthat fingerprint scanners can be fooled with artificial fingerprints, i.e. copies of realfingerprints. The fingerprint systems are evolving and this study will discuss thesituation of today.

1.2 Basic terminology

The term artificial fingerprint will be used in this report to refer to artificiallycreated fingerprints, as compared to fake fingers/fingerprints which may also in-clude modifications of live fingers. Many other writings in the area use the termsartificial finger or artificial fingertip, but these terms have not been used in thisreport to emphasize that the artificial fingerprints made from latent fingerprints,are in fact thin small prints and not entire artificially created fingers or fingertips.The terms live finger/fingerprint and real finger/fingerprint will be used to denotea finger/fingerprint which is part of a living body.

1

2 Introduction

1.3 Goal

Two different approaches to the fingerprint scanner area will be covered in thisreport. The theoretical approach will discuss liveness detection, i.e. the fingerprintscanners’ ability to distinguish between live fingers and artificial clones. Differentliveness detection methods will be presented and analyzed with regards to attackswith artificial fingerprints.

The empirical approach consists of examining the fingerprint scanners’ ability towithstand an attack of an artificial fingerprint using techniques based on earlierresearch made in [42] and [57]. More information about the method is found insection 1.5.

1.4 Purpose

Several reports [3, 42, 57] have noted successful attacks on fingerprint systemsusing artificial fingerprints. Since the fingerprint scanner market is growing andthe technology is evolving, new products that can withstand attacks with artificialfingerprints might have seen the light today. This report will give a further exami-nation of the fingerprint scanner area to clarify whether or not fingerprint systemscan be trusted or if they are too insecure to be used today.

1.5 Method

For the theoretical approach, a literature study has been performed. Articles,proceedings, books, etc. have been read, discussed and analyzed.

Prior to this report, a number of experiments have been performed based on earlierresearch made in [42, 57]. A latent fingerprint on a piece of glass was the starting-point for the creation of the artificial fingerprint. This starting-point was chosento simulate the user’s lack of awareness that the fingerprint was being stolen fromhim/her, as if the latent print was taken from a drinking-glass. The method usedis described in more detail in chapter 7 on page 55.

1.6 Method criticism and limitations

Glasslike surfaces is only one of the possible surfaces a fingerprint can be found on.To investigate all possible surfaces, would require an enormous effort and a lot oftime, and is therefore not part of this thesis.

1.7 Target group 3

Using an artificial fingerprint is only one of the possible attacks on a fingerprintsystem. Attacks at the sensor level will be described shortly in section 4.5 onpage 31, but describing all the other possible attacks is outside the scope of thisreport.

1.7 Target group

This report has a number of different target groups:

• Manufacturers of fingerprint recognition systems.

• Companies considering starting to use a fingerprint recognition system.

• Users of fingerprint recognition systems.

• Researchers who want to continue researching the field of fingerprint recogni-tion systems, especially when it comes to liveness detection and attacks withartificial fingerprints.

• Students in the field of computer science, information technology, etc., whohave an interest in the security field and especially biometrics.

Since this report has so many different target groups, different parts of the reportare relevant to different groups of people. The reader is not presumed to haveprevious knowledge about computer security, biometrics, or fingerprint recognitionsystems. The reading guide in section 1.8, is recommended for the reader whoquickly wants to find the relevant parts for his/her specific purpose.

1.8 Reading guide

This section contains a short description of each chapter and appendix in the report.

• Chapter 1 on page 1 contains a short introduction to the thesis. The goal,purpose, method, and target group are presented, and method criticism andlimitations are discussed.

• Chapter 2 on page 7 gives the reader an introduction to the biometric area,describes important terms, and is a good starting point for the followingchapters.

• Chapter 3 on page 13 presents the historical and present use of fingerprints,physical characteristics of fingerprints, and different enhancement techniquesof fingerprints.

• Chapter 4 on page 21 discusses the use of fingerprint scanners, different scan-ning technologies, and briefly explains the algorithms used in the scanners.

4 Introduction

The chapter also describes possible ways of intrusion at the sensor level offingerprint scanning systems, as well as the available protection schemes.

• Chapter 5 on page 35 presents and discusses ideas about liveness detection,i.e. fingerprint scanners’ ability to distinguish between live fingers and arti-ficial clones.

• Chapter 6 on page 49 summarizes the most important previous work in thefield of artificial fingerprints.

• Chapter 7 on page 55 describes the method used in the experiments, thecreation process of artificial fingerprints, and the material and software usedin the experiments.

• Chapter 8 on page 67 presents the results from the experiments described inthe previous chapter.

• Chapter 9 on page 75 analysis and discusses the method used in the experi-ments and the results acquired.

• Chapter 10 on page 93 contains a final conclusion and ideas about futurework in the fields of liveness detection, artificial fingerprints, and fingerprintscanners.

• Appendix A on page 103 contains an alphabetized explanatory list of abbre-viations, technical terms, and medical terms used in this report.

• Appendix B on page 109 contains detailed information about the materialused in the experiments.

• Appendix C on page 113 describes some parts of the experiment method inmore detail.

• Appendix D on page 119 contains detailed information about the scannersused in the extensive experiments.

• Appendix E on page 121 contains detailed information about the softwareused in the extensive experiments.

• Appendix F on page 123 presents the detailed data (in numbers) of the resultsfrom the extensive experiments.

1.9 Notes

An extensive list with explanations of all important technical and medical termsand abbreviations, can be found in appendix A on page 103. The most importantterms used will still be explained in the appropriate sections.

If nothing else is stated, references placed before a period in a sentence, refers tothe sentence only, while a reference placed after the period refers to the whole

1.9 Notes 5

paragraph. A reference placed right before the colon before the beginning of a list,refers to the list after the colon. A reference which is placed after the last periodin a figure subtitle, refers to the picture included and the whole subtitle.

Note that the results from the experiments performed prior to this report, onlydescribe how good the systems are at protecting against attacks with gelatin arti-ficial fingerprints and not against any other attacks. The systems tested, do haveother good and bad qualities that must be considered when purchasing a system.The experiments were performed to check the security of the systems with regardsto attacks with artificial fingerprints, and not with regards to any other attacks orqualities of the systems.

6 Introduction

Chapter 2

Biometric overview

Biometrics (also known as biometry) is defined as “the identification of an individ-ual based on biological traits, such as fingerprints, iris patterns, and facial features”[43].

2.1 Identification and verification

Identification and verification (also known as authentication) are both used todeclare the identity of a user. Since the two terms identification and verificationare easily mixed up, definitions are given below [41]:

• Identification: In an identification system, an individual is recognized bycomparing with an entire database of templates to find a match. The systemconducts one-to-many comparisons to establish the identity of the individual.The individual to be identified does not have to claim an identity (Who amI? ). [41]

• Verification (authentication): In a verification system, the individual to beidentified has to claim his/her identity (Am I whom I claim to be? ) andthis template is then compared to the individual’s biometric characteristics.The system conducts one-to-one comparisons to establish the identity of theindividual. [41]

Before a system is able to verify/identify the specific biometrics of a person, thesystem requires something to compare it with. Therefore, a profile or templatecontaining the biometric properties is stored in the system. Recording the charac-teristics of a person is called enrollment. [57]

The processes of enrollment, verification, and identification are depicted graphicallyin figure 2.1 on page 8.

7

8 Biometric overview

Figure 2.1. Enrollment, verification, and identification. [41]

2.1.1 Methods of identification and verification

As a user, you can be identified or verified on the basis of:

• Something you know : e.g. a password or a PIN.

• Something you hold : e.g. a credit card, a key, or a passport.

• Something you are (biometrics): e.g. a fingerprint or iris patterns.

Using something you know and hold are two easy identification/verification solu-tions widely used today. Using something you know only requires a good memory,but can on the other hand easily be overheard, seen, or even guessed. An itemyou hold can be stolen and later on used or copied. Using biometrics might at firstseem to overcome these problems, since fingerprints, iris patterns, etc. are part of

2.1 Identification and verification 9

your body and thus not easily misplaced, stolen, forged, or shared. This reportmight however give you some new insight about this subject.

One way to increase security in an identification/verification system is to combinetwo or more different identification/verification methods.

2.1.2 Results from identification and verification procedures

When results from identification or verification procedures are discussed, the fol-lowing terms will be used in this report:

• Success rate: The rate at which successful verifications or identifications aremade compared to the total number of trials. [3]

• False rejection rate (FRR): The rate at which the system falsely rejects aregistered user compared to the total number of trials. [3]

• False acceptance rate (FAR): The rate at which the system falsely acceptsa nonregistered (or another registered) user as a registered one compared tothe total number of trials. The FAR is in this report used in the identificationversion, as a contrast to verification procedures, where it measures if a useris accepted under a false claimed identity. [3]

• Equal error rate (EER): The common value of the FAR and FRR when theFAR equals the FRR. This is the value where both the FAR and FRR arekept as low as possible at the same time (see figure 2.2). A low EER valueindicates a high accuracy of the system. [47]

Figure 2.2. The relationship between FRR, FAR, and EER. A big FRR often means alow FAR, and a big FAR often means a low FRR. The small EER value indicates thatthe security of the system is better. [34]


2.2 Biometric techniques

Currently, there are many different techniques available to identify/verify a personbased on biometrics [57]. These techniques can be divided into physical character-istics and behavioral characteristics. All techniques have in common that acquireddata is compared with templates enrolled earlier.

2.2.1 Physical characteristics

The following are examples of biometric techniques based on physical characteristics[3]:

• Fingerprint recognition: Fingerprint recognition systems scan the fingerprintpattern for recognition.

• Recognition of hand or finger : Recognition of hand or finger systems scan theentire hand or larger parts of the finger and makes a comparison of patterns inthe skin (similar to fingerprint recognition systems). The difference betweena fingerprint recognition system and a hand/finger recognition system, liemostly in the size of the scanner and the resolution of the scanning array.

• Face recognition: Face recognition systems detect patterns, shapes, and shad-ows in the face.

• Face geometry : Face geometry systems work similar to face recognition sys-tems, but focus more on shapes and forms instead of patterns.

• Vein pattern recognition: Vein pattern recognition systems detect veins inthe surface of the hand. These patterns are considered to be as unique asfingerprints, but have the advantage of not being as easily copied or stolenas fingerprints are.

• Retina recognition: Retina recognition systems scan the surface of the retinaand compare nerve patterns, blood vessels and such features.

• Iris recognition: Iris recognition systems scan the surface of the iris to com-pare patterns.

2.2.2 Behavioral characteristics

The following are examples of biometric techniques based on behavioral character-istics [3]:

• Voice recognition: Voice recognition systems use characteristics of the voice,such as pitch, tone, and frequency.

2.2 Biometric techniques 11

• Signature recognition: Signature recognition systems measure pressure of thepen and frequency of writing to identify a person via a signature.

• Keystrokes dynamics: Keystrokes dynamics systems use statistics, e.g. timebetween keystrokes, word choices, word combinations, general speed of typingetc.

The authors of the book Handbook of Fingerprint Recognition suggest that allbiometric identifiers are a combination of distinctive physiological and behavioralcharacteristics. For example, fingerprints may be physiological in nature but theusage of the input device (e.g. how a user presents a finger to the fingerprintscanner) depends on the person’s behavior. [41]


Chapter 3

Fingerprints

Already at the age of seven months, a foetus’ fingerprints are fully developed. Thecharacteristics of the fingerprint does not change throughout the lifetime exceptfor injury, disease, or decomposition after death. However, after a small injury onthe fingertip, the pattern will grow back as the fingertip heals. [41, 49]

This chapter will begin with some important historical events concerning finger-prints, and specifically fingerprints as an identification tool. Then, a short glimpsewill be taken at how society today looks at fingerprints. Fingerprint characteris-tics and enhancement techniques will also be discussed to give the reader a betterplatform to stand on, before reading the following chapters.

3.1 History

It is not justifiable to say that one single person was first to discover fingerprintpatterns. Every human being has had papillary lines in front of her eyes for avery long time. It has only been a question of looking down at one’s own hands.However, there still exist some important historical events connected to fingerprints,which will be described shortly here.

• Already in ancient times, fingerprints appeared on pottery and cave paintingsin Asia, Europe, and North America to denote authorship or identity [7].

• Fingerprints were not described in writing until the 17th century. In 1686,Marcello Malpighi, a professor of anatomy at the University of Bologna, de-scribed papillary ridges in his treatise. [7, 44]

• In 1823, the Czech physician Jan Evangelista Purkyne, classified fingerprintpatterns into nine basic types. Purkyne’s classification system, laid the foun-dation for future fingerprint identification systems. [7]

13

14 Fingerprints

• It was not until the later part of the 19th century that fingerprints found itsuse in personal identification through the two colonials in British India; SirWilliam Herschel and Dr. Henry Faulds. Dr. Faulds also devised a methodof classification. [7, 44]

• Sir Francis Galton, a British anthropologist and a cousin of Charles Darwin,scientifically proved in the late 19th century that fingerprints do not changeover the course of an individual’s lifetime, and that no two fingerprints areexactly alike. According to his calculations, the odds of two individual finger-prints being the same, are 1 in 64 billion. Galton identified the characteristics(minutiae) by which fingerprints can be identified, and these characteristicsare therefore sometimes referred to as Galton’s details today. [7, 44]

Galton classified fingerprints as one of the three patterns, ”arches”, ”loops”,and ”whorls”. He found out that approximately 60 percent of all fingerprintsare loops, around 30 percent whorls, and the remaining 10 percent are arches.Because of this uneven distribution, Galton then further subdivided the loopsinto ”inner” and ”outer” loops depending on whether the loop opened uptoward the little finger or the thumb. Galton also was the founder of theclassical fingerprint cards used in forensics. [7]

• In 1901, fingerprints were introduced for criminal identification in Englandand Wales. Galton’s observations, and revisions of those by Sir EdwardRichard Henry, were used. This was the foundation of the Henry Classifica-tion System. [44]

• In 1918, Edmond Locard wrote that if 12 points (Galton’s deatils) were thesame between two fingerprints, it would suffice as a positive identification.This is often referred to as the ”12 point rule”. Different countries have differ-ent rules though for identification, including own standards with a minimumnumber of points. [44]

• With the introduction of computers in the 20th century, the storing of fin-gerprint cards became computerized. [44]

• Sweden has since the 1st of April 2003 abandoned the 12 point rule. Today, anonnumerical standard is used with no required minimum number of pointsfor positive identification. [12]

3.2 Today

Fingerprint usage can be divided into three different areas [3]:

• Security, as identification of individuals.

• Forensics, also as an identification method.

3.3 Fingerprint characteristics 15

• Personal characteristics and dermatoglyphics, often involved with horoscopesand similar nonscientifically proven prophesies.

The two first are by far the greatest areas. Fingerprint-based systems, used forsecurity reasons, are so popular today that they have almost become the synonymfor biometric systems [41]. Fingerprint-based systems will be further discussed inchapter 4 on page 21.

Enormous amounts of information is stored in a fingerprint database. For example,the total number of fingerprint cards (each card contains one impression each of the10 fingers of a person) in the FBI fingerprint database has now exceeded 200 million,and is growing continuously. Most law enforcement agencies in the world use anAFIS (Automatic Fingerprint Identification System) today. These systems haveincreased the productivity and greatly reduced the cost of hiring and traininghuman fingerprint experts. [41]

Since the discovery of the DNA structure in 1953, DNA has become more and moreimportant in the society as a whole, as well as in forensics. With the science ofcloning though, it can be questioned whether or not DNA can actually be used foridentification purposes. If individuals can be cloned, DNA typing is as much helpas it is in distinguishing identical twins. By definition, identical twins cannot bedistinguished by DNA. The same problem does not occur with fingerprints. Eventhough the fingerprints of identical twins are very similar, automatic fingerprintsystem can successfully distinguish identical twins though with a slightly loweraccuracy than nontwins. It should however be noted that the algorithms in somefingerprint systems may not be robust enough to detect these differences. [7, 35,41, 51]

3.3 Fingerprint characteristics

You have probably looked at your own fingerprint at some point in your life andnoticed the papillary lines on it. In fingerprint literature, the terms ridges andvalleys are used to describe the higher and lower parts of the papillary lines. Thereason we have ridges and valleys on our fingers, is the frictional ability of the skin[48].

The formation of the ridges and valleys is a combination of genetic and environ-mental factors. The DNA gives directions in the formation of the skin of the foetus,but the exact formation of the fingerprint is a consequence of random events. Theexact position of the foetus in the womb at a particular moment, and the exactcomposition and density of surrounding amniotic fluid, decide how every individualridge will form. [25]

This is also the reason why the fingerprints on different fingers on the same individ-ual are different, and why identical twins have different fingerprints, see section 3.2on page 14.

16 Fingerprints

3.3.1 Classification and pattern types

Fingerprints can be and have been classified in different ways throughout history,see section 3.1 on page 13. The Henry Classification System was the basis of modernday AFIS classification methods up until the 1990s. In recent years, the HenryClassification System has in most forensic departments been replaced by ridgeflow classification approaches. These new classification methods use the distancebetween core and delta points, minutiae locations, and pattern type (the latterusing the Henry Classification System). [22]

Fingerprints can be divided into the three major pattern types arches, loops, andwhorls, depicted in figure 3.1. Loops are the most common fingerprint pattern [27].These major pattern types can appear in different variations. For example, you canfind plain or tented (narrow) arches, right or left loops, and spiral or concentriccircles as whorls. Also, the different pattern types can be combined to form afingerprint, e.g. a double loop, or an arch with a loop [5].

Figure 3.1. The three major pattern types: arches, loops, and whorls. These majorpattern types can be divided further into different subgroups: right or left loops, plainor tented (narrow) arches, and spiral or concentric circles as whorls. There are alsocombinations of these different pattern types. [22]

3.3.2 Terminology

To understand the basics of fingerprints, the same approach as [41] uses, will bepresented here. A fingerprint can be looked at from different levels; the global level,the local level, and the very-fine level [41].

At the global level, you find the singularity points, called core and delta points, seefigure 3.2 on page 17. These singularity points are very important for fingerprintclassification, but they are not sufficient for accurate matching [41].

3.3 Fingerprint characteristics 17

Figure 3.2. Core and delta points marked on sketches of the two fingerprint patternsloop and whorl. Loops have one delta, whorls have two. Minutiae details are not shown.The number of intervening ridges from delta to core in the leftmost pattern (loop) is 12.A ridge tracing from left to right delta on the rightmost pattern (whorl) determines aninner tracing, meaning that when following a ridge emanating from the left delta, theridge passes inside the other delta. [7]

At the local level, you find the minutiae details (sometimes called minutiae points).One way to classify the minutiae details are in terms of ridge termination, bifur-cation, independent ridge, dot or island, lake, spur, and crossover [7]. These aredepicted in figure 3.3. The two most prominent minutiae details, are ridge termi-nation (ending) and ridge bifurcation [41].

Figure 3.3. Minutiae details, also known as ridge characteristics, ridge details, or Gal-ton’s details. Most of the identifications of fingerprints during this century, were made bymatching corresponding minutiae details between two prints. [7]

At the very-fine level, you find essentially the finger sweat pores, see figure 3.4 on

18 Fingerprints

page 18. The position and shape of the pores can be used to help identify a person.To be able to use this information, a high-resolution image of the fingerprint isrequired. [41]

Figure 3.4. Part of a fingerprint image with sweat pores and minutiae details visible.The black lines in the image correspond to the ridges in the fingerprint, and the whitelines in the image correspond to the valleys in the fingerprint. The white dots on theridges correspond to the sweat pores in the fingerprint and are marked with empty circleson a single ridge line. Minutiae details are marked with black-filled circles. [41]

Figure 3.5 shows a cross-section of a papillary line. The sweat glands supply thepapillary skin with moisture and when touching a surface with a finger, the sweatfrom these pores is transferred to the pattern of the fingerprint, see figure 3.4. Theouter skin layer is called epidermis, and the inner skin layer is called dermis.

Figure 3.5. Cross-section of a papillary line of a fingerprint. [48]

3.4 Enhancement techniques 19

3.4 Enhancement techniques

A latent fingerprint results from the reproduction of friction ridges found on fingers.To be able to identify the owner of the fingerprint, the fingerprint must in mostcases first be enhanced in order for it to be visible. Enhancing a fingerprint willalso be used in the experiments described in chapter 7 on page 55.

A print consists of a combination of different chemicals that originate from naturalsecretions, blood, and contaminants. Some contaminants found in fingerprintsresult from contact with different materials in the environment. [56]

Latent fingerprints can be found on all types of surfaces. In general, surfacescan be characterized as porous, nonporous, or semiporous. Understanding thesecharacteristics helps in deciding the processing technique of the latent fingerprint.[56]

3.4.1 Processing techniques

In addition to the type of surface, another determining factor in choosing the properprocess is the residue of the latent fingerprint, including perspiration, blood, oil orgrease, and dust. [56]

The condition of the surface also contributes to determining the correct process.Such surface characteristics include dryness, wetness, dirtiness, and tackiness orstickiness. [56]

A variety of techniques, including use of chemicals, powders, lasers, alternate lightsources, and other physical means, are employed in the detection and developmentof latent prints. For a detailed description of these different techniques and inwhich situations to use which techniques, see [56].

Two techniques will though be described more in detail here, since they have beenfound easily available for nonprofessionals and can be used on nonporous surfaces.

Fingerprint powders

Powdering is the application of finely ground, colored powder to a nonporous objectto make latent prints visible. Powder clings to moisture, oil, and other residues.[56]

Different colored powders can be used, e.g. black, white, and gray. The color ofthe powder depends on the surface, e.g. on a white surface, a black or gray powderwill enhance the fingerprint much better than a white powder.

The recommended brushes to use with colored powders are fiberglass filamentbrushes, camel-hair brushes, feather dusters, and squirrel-hair brushes. [1, 56]

20 Fingerprints

A finely ground magnetic powder can also be used together with a magna brushwand. [56]

One important thing to take notice of when using powder and a brush, is to brushin the direction of any ridges that begin to appear. A detailed description of theprocedure can be found on pages 26-27 in [56].

When the fingerprint has been powdered, the print has to be lifted in order tophotograph it. If the fingerprint is already placed on a flat surface, you might nothave to lift it, but can instead photograph it directly. When lifting the fingerprint,it is important to avoid air bubbles, which will easily form underneath the tape.

Cyanoacrylate fuming

Cyanoacrylate fuming is also used to develop latent prints on nonporous specimens.

This technique is not recommended to perform at home since it includes risks ofgetting allergic reactions and the fumes are life threatening. It should however benoticed that it is in fact possible to do at home with materials a nonprofessionalcan buy. Liquid cyanoacrylate can be found in adhesives available at most hobbyshops.

Since cyanoacrylate fuming was only tried out in the experiments prior to thisreport, and not used to the same extent as powdering, it will not be describedfurther here. A detailed description of the processing procedure can be found in[56] and a more amateur approach can be found in [20].

Chapter 4

Fingerprint scanners

Even though the first fingerprint scanners were introduced more than 30 years ago,it is not until the recent years that the interest for fingerprint scanning has increasedconsiderably [41]. With the terrorist attack in New York on September 11, 2001,the US Government and other governments and organizations, became increasinglyinterested in the biometrics industry. Passport, border control, and identificationcards are areas were fingerprints, as a means of authentication, have become in-creasingly interesting. The fingerprint scanner market has grown rapidly the lastyears. With this development, the scanners are shrinking in size, the price is goingdown, and fingerprint systems are being integrated into electronic equipment suchas laptops, mouses, and keyboards.

A fingerprint scanner has basically two tasks; to acquire an image of a fingerprint,and to decide whether or not this image matches the image of a previously enrolledfingerprint. The decision phase is done by extracting features from the image andthen comparing these features to templates stored in a database.

A fingerprint contains a lot of information. Storing and using all this information,would take too much space and unnecessary effort when a lot of the information infact is redundant. Instead, fingerprint scanners focus on the essential informationto make the fingerprint as unique as possible and thus useful in identification andverification situations. [3]

This chapter will describe the characteristics of a digital fingerprint image, thedifferent scanning techniques used today, the algorithms behind the surface of thescanners, protection schemes, and possible ways of intrusion.

21

22 Fingerprint scanners

4.1 Fingerprint images

A digital fingerprint image can be characterized by the following main character-istics [41]:

• Resolution: The minimum resolution for FBI-compliant sensors are 500 dotsper inch (dpi), and this is also met by many commercial devices. The sensorsused in the extensive experiments have resolutions of 250 dpi and 380 dpi.

• Area: The larger the area, the more ridges and valleys are captured, andthe more distinct the pattern becomes. The minimum area size required byFBI specifications is 1×1 square inches. Many sensors today have an areaa lot smaller than that, thus making it impossible for the entire print to becaptured. A small area keeps the cost and size down, but does also lead tounnecessary false rejections. The sensors used in the extensive experimentshave area sizes of 9.8×9,8 mm, and 17×17 mm.

• Dynamic range (or depth): The number of bits used to encode the intensityvalue of each pixel. Grayscale is used and the FBI standard for pixel bitdepth is 8 bits. Some sensors capture however only 2 or 3 bits of information.

• Geometric accuracy : Can be defined as the maximum geometric distortionintroduced by the acquisition device, and is expressed as a percentage withrespect to x and y directions.

• Image quality : Difficult to measure, especially since it is hard to decouple itfrom the intrinsic finger quality or status.

All the characteristics mentioned above work together to set the accuracy of thesystem.

4.2 Scanning techniques

While the first generation scanners used optical techniques, a variety of sensingtechniques are used today and almost all of them belong to one of the three families:optical, solid-state, and ultrasound. [41, 57]

The main technologies used today are optical and solid-state sensors (mainly capac-itive sensors). Solid-state sensors are now gaining great popularity because of theircompact size which facilitates in embedding them into laptop computers, cellularphones, smart cards, and the like. [25, 41]

4.2.1 Optical sensors

The advantages with optical sensors include withstanding temperature fluctuations(to some degree), a fairly low cost, resolutions up to 500 dpi, better image quality,

4.2 Scanning techniques 23

and the possibility of larger sensing areas. [24, 41]

The drawbacks of optical sensors are size and problems with latent prints [24, 53,55]. Cuts, abrasions, calluses, and other damage, as well as dirt, grease and othercontamination, can also be a problem with optical scanners [29].

Frustrated Total Internal Reflection (FTIR)

When you place your finger on an FTIR-based optical sensor (see figure 4.1), theridges will be in contact with the prism surface, while the valleys will remain at adistance. One side of the prism is illuminated through a diffuse light (a bank oflight-emitting diodes (LED) or a film planar light). The light is reflected at thevalleys and randomly scattered (absorbed) at the ridges. The lack of reflectionfrom the ridges, makes it possible to acquire an image of the fingerprint. In theearly days’ FTIR sensors, a CCD camera was used to acquire the fingerprint image.Today, the FTIR sensors have shrunk considerably in size and cost with help ofthe new CMOS technology. [41, 57]

Since FTIR devices sense a three-dimensional surface, it is difficult to fool themwith a photograph or image of a fingerprint [41]. Latent prints are however still aproblem [53, 55]. Furthermore, it is difficult to make a small enough FTIR devicesuitable to embed into a PDA or a mobile phone, even though they can be used inmouses and keyboards. [41]

Figure 4.1. An FTIR-based fingerprint sensor. [41]

FTIR with a sheet prism

This type of optical sensor, use a sheet prism made of a number of ”primlets”adjacent to each other, instead of a single large prism, see figure 4.2 on page 24.


With the advantage of size reduction, the quality of the acquired images is howeverlower than traditional FTIR techniques using glass prisms. [41]

Figure 4.2. A fingerprint sensor using FTIR with a sheet prism. [41]

Optical fibers

This technique uses a fiber-optic plate (see figure 4.3) instead of a prism and lens.The finger is in direct contact with the upper side of the plate, while the lowerside of the plate is tightly coupled with a CCD or CMOS camera, which receivesthe light conveyed through the glass fibers. Since the CCD/CMOS is in directcontact with the plate (without any intermediate lens as in the FTIR techniques),its size has to cover the whole sensing area. High costs will thus be the downsideof producing large area sensors with this technique. [41]

Figure 4.3. Fingerprint sensing using optical fibers. Residual light emitted by the finger,is conveyed through the glass fibers to the CCD/CMOS camera. [41]

Electro-optical

These type of sensors, consist of two layers: a light-emitting polymer, and a pho-todiode array, see figure 4.4 on page 25. When the polymer is polarized with theproper voltage, it emits light that depends on the potential applied on one side.As the ridges touch the surface, and the valleys do not, the potential, and thus


also the amount of light, will be different. The photodiode array (embedded inglass) receives the light and generates the digital fingerprint pattern. Some com-mercial sensors use the light-emitting polymer together with an ordinary lens andCMOS instead of the photodiode array. Images acquired electro-optically, are yetnot comparable in quality with FTIR images. [41]

Figure 4.4. Electro-optical fingerprint sensor. [41]

Direct reading

A variation of optical sensors are the not so common touchless sensors. Instead ofpressuring the finger against a plate, the finger is put on an area with a hole, about2-3 inches from the optics behind. This technique may seem more hygienic, andsaves time by not having to clean the sensor surface. It is however very difficult toobtain well-focused and high-contrast images. [21, 41]

4.2.2 Solid-state sensors

Solid-state sensors (also known as silicon sensors), were first introduced to overcomethe problems with size and cost of optical sensors. However, considering a high-security device, a large sensing area is needed, and thus the cost will in fact not beany smaller for solid-state sensors than for optical sensors. [41]

All silicon sensors consist of an array of pixels, where each pixel is a tiny sensor itself.Four different types of silicon sensing techniques have been proposed to convert thephysical information into electrical signals: capacitive, thermal, electric field, andpiezoelectric. [41]

Capacitive sensors

A capacitive sensor consist of a two-dimensional array of micro-capacitor platesembedded in a chip, see figure 4.5 on page 26. The finger skin works as the otherside of each micro-capacitor plate. This way, variations in electrical charge willappear due to distance variations from a ridge on the fingerprint to the sensor, and


from a valley on the fingerprint to the sensor. These small capacitance differencesis then used to acquire an image of the fingerprint. [57]

Figure 4.5. Capacitive fingerprint sensor. [41]

Even though being widely used nowadays, capacitive sensors do have a number ofdisadvantages:

• Small sensor area: It can be questioned whether or not a small image scanarea is enough to accurately identify an individual. The reduction in sensorsize does also require more carefully performed enrollments. A poor enroll-ment may not capture the center of the fingerprint, thus forcing the subse-quent identification/verification fingers to be misplaced in the same way. Thesensing area can of course be increased, however resulting in a higher cost.[24, 29, 41]

• Electrostatic discharge (ESD): Electrostatic discharges from the fingertip cancause large electric fields that could severely damage the device. [41]

• Chemical corrosion: The silicon chip needs to be protected from chemicalsubstances (e.g. sodium) that are present in fingerprint perspiration. Pro-tecting the surface with a too thick coating will increase the distance betweenthe pixels and the finger too much and make it more difficult to distinguishbetween a ridge and a valley. Therefore, the coating must be as thin as pos-sible, yet not too thin, or it will not be resistant to mechanical abrasion.[41]

Thermal sensors

Thermal sensors are made of pyro-electric material that generates current basedon temperature differentials. The temperature differentials between the skin (theridges) and the air (in the valleys) is used to acquire the fingerprint image. Sincethermal equilibrium is reached quickly, it might be necessary to use a sweepingtechnique when it comes to thermal sensors. Thermal sensors are not sensitive toESD, nor do they have any problems with a thick (10 to 20 microns) protectivecoating. [41]


Electric field sensors

The problems optical and capacitive sensor have with dry skin conditions, calluses,cuts, etc. is not the case of electric field sensors. These sensors enter the skin andcreates a fingerprint image from below the damaged surface layer. The variationsof the electric field is measured in the conductive layer, the boundary between theouter layer of damaged skin and the pristine skin. [4]

Piezoelectric (pressure)

The sensor surface is made of a non-conductive dielectric material. When pressureis applied by the finger, a small amount of current, dependent on the pressure,is generated (this effect is called the piezoelectric effect). The different pressurefrom the valleys and ridges, therefore result in different amounts of current. Oneof the disadvantages of this technique, is the materials used, which are often notsensitive enough to detect the differences between ridges and valleys. Additionally,the protective coating blurs the resulting image. [41]

4.2.3 Ultrasonic sensors

In an ultrasonic sensor (see figure 4.6), a transmitter sends acoustic signals towardthe fingertip, and a receiver detects the echo signals which bounce off the fingerprintsurface. The difference in acoustic impedance of the skin (ridges) and the air(valleys) is used to measure the distance, thus acquiring an image of the fingerprint.The frequency range used by these sensors, varies from 20 kilohertz to severalGigahertz. The top frequencies are required to get the required resolution to beable to differentiate fingerprints from each other. [41, 57]

Figure 4.6. An ultrasonic sensor uses sound waves which penetrate materials and givea partial echo at each impedance change. [41]

It has been stated that the improved image quality from ultrasonic sensors results


in accuracy rates approximately a factor of 10 better than any other fingerprintsensing technology on the market today. [29]

Except electric fields, ultrasound is one of the few technologies that images thesubsurface of the finger skin, thus penetrating dirt, grease, etc. on the sensorsurface and the finger. Ultrasound technology, though considered perhaps themost accurate of the fingerprint technologies, is not yet widely used due to largesize and a quite high cost. Moreover, it takes a few seconds to acquire an image.[24, 41]

4.3 Touch versus sweep

Most sensors used today are touch sensors (area sensors). When using a touchsensor, you simply put your finger on the sensor and hold it for a few secondswithout moving it. Very little user training is required to use a touch sensor.However, there are a few drawbacks with touch sensors as well:

• The sensor quickly becomes dirty and must be cleaned. Some users mighthave issues with using the device if it does not look clean. [41]

• Problems with latent prints exist. Depending on the type of sensing tech-nique, studies have shown that it is possible to reactivate a latent print on afingerprint sensor. [53, 55]

• Rotation of the finger may be a problem for recognition. Some matchingalgorithms do not accept large rotations (e.g. more than 20 degrees) of thefinger. [41]

• Tradeoff between cost and size of the sensing area. This is especially truefor solid-state sensors, where the cost mainly depends on the area of the chipdie. [41]

Because of these drawbacks, a new type of sensor was introduced: the sweepingsensor, see figure 4.7 on page 29. Sweeping sensors are as wide as a finger, but onlya few pixels high. Therefore, the main advantage of sweeping sensors, especially insilicon sensors, is reduced cost. The sweeping consists of a vertical movement only.At the end of the swipe or ”on-the-fly”, the fingerprint image is reconstructed fromall the images earlier acquired. [41]

The sweeping method was originally introduced in conjunction with thermal sen-sors, but is nowadays used in many different types of sensors. Unlike touch sen-sors, sweeping sensors look clean since each user’s finger ”cleans” the sensor duringsweeping. No problem with latent prints exist with sweeping sensors, and in mostcases, rotation of the finger is neither a problem. Sweeping sensors do still havesome drawbacks as well [41]:

4.4 Algorithms in fingerprint scanners 29

Figure 4.7. When a user is sweeping his/her finger on a sweeping sensor, a number ofimage slices are combined to form an image of the entire fingerprint. [41]

• Learning time. It takes a number of tries, before a user gets used to sweepingproperly (i.e. without sharp speed changes, or discontinuity).

• The interface must be able to capture a sufficient number of fingerprint slicesto follow the finger sweep speed.

• Reconstructing the fingerprint image from the slices is a time consumingprocess which usually produces errors.

4.4 Algorithms in fingerprint scanners

A typical fingerprint recognition system (see figure 4.8) consists of a scanning device(capture and enhancement), a feature extraction part, and a comparison part wherean identification/verification decision is taken. This section will shortly describethese different parts in more detail.

Figure 4.8. Typical structure of a fingerprint recognition system. [3, 42]


4.4.1 Image enhancement

When a fingerprint image is captured, it contains a lot of redundant information.Problems with scars, too dry or too moist fingers, or incorrect pressure must alsobe overcome to get an acceptable image. Therefore, a number of filters, some ofwhich will be described below, are applied to the image. [3]

• Normalization: By normalizing an image, the colors of the image are spreadevenly throughout the gray scale. A normalized image is much easier tocompare with other images, and the quality of the image is easier determined.[3]

• Binarization: Making an image binary, transforms the gray scale image intoa binary image (black and white). Either a global or localized threshold valueis used. [3]

• Low pass filtering : The process of low pass filtering smoothens the imageto match the pixels nearby so that no points in the image differ from itssurroundings to a great extent. By low pass filtering an image, errors and in-correct data are removed, and it simplifies the acquisition process of patternsor minutiae. [3, 27]

• Quality markup: Redundant information needs to be removed from the im-age before further analysis can be performed and specific features of thefingerprint can be extracted. Therefore segmentation, i.e. separating the fin-gerprint image from the background, is needed. Furthermore, any unwantedminutiae (can appear if the print is of bad quality) needs to be removed.[3, 27]

4.4.2 Feature extraction and comparison

Many algorithms have been developed to match two different fingerprints and theycan be divided into the following groups:

• Minutiae-based matching : This is the most popular and widely used matchingmethod, partly because it is the same technique as used by fingerprint exam-iners. As described in section 3.3.2 on page 16, a fingerprint pattern is fullof minutiae points, which characterize the print. In minutiae-based match-ing, these points are extracted from the print, stored as sets of points in thetwo-dimensional plane, and then compared with the same points extractedduring the enrollment phase. It is very unlikely that the fingerprint duringenrollment and the fingerprint during identification/verification had the ex-act same angle, horizontal and vertical placement. Therefore, the core point(see section 3.3.2 on page 16), is used as a reference point for the coordinatesystem and the distance and angle from the core point is calculated and used

4.5 Sensor attacks and protection schemes 31

for each minutiae point. For identification/verification a certain number ofminutiae points should match for the user to be successfully logged in. [3, 41]

• Correlation-based matching : The fingerprint image to be identified/verified, issuperimposed with the fingerprint image acquired during the enrollment. Thecorrelation between corresponding pixels is computed for different alignments(e.g. various displacements and rotations). [41]

• Ridge feature-based matching : This matching method uses features of theridge pattern, e.g. local orientation and frequency, ridge shape, and textureinformation. Even though minutiae-based matching is considered more reli-able because of its indistinctness, there are cases where ridge feature-basedmatching is better to use. In very low-quality fingerprint images, it can bedifficult to extract the minutiae points, and using the ridge pattern for match-ing is then preferred. Ridge feature-based matching can be conceived as asuperfamily of minutiae-based matching and correlation-based matching. [41]

4.5 Sensor attacks and protection schemes

A biometric system can be defeated in different ways, from attacks at the sensorlevel, to replay attacks on the data communication stream, and attacks on thetemplate database [55]. This report focuses on the attack at the sensor level,which can be performed in a number of ways. Independent of the attack method,the false acceptance rate (FAR) and the false rejection rate (FRR), should be keptlow.

4.5.1 Registered finger

The intruder can force the legitimate user to press his/her finger against the fin-gerprint sensor under duress [42]. Also, the intruder can give the legitimate usera sleeping drug, in order to use either the finger directly against the sensor, or bymaking a mold of the finger as described in [3, 42, 57].

Another way of using the registered finger, is by separating the finger from thelegitimate user’s body [42]. This finger can then be used directly on the sensor, orby one of the methods described in [42].

To make it more difficult to attack a fingerprint system as described above, afingerprint scanner can be combined with another authentication method, e.g. aPIN, a password, or an ID card. Another way to deter these crimes, is by using away to alarm when under duress, e.g. with help of a special secret code or manner.Also, a two-persons control, where the system requires e.g. fingerprints from twodifferent persons, would be helpful. Using a two-persons control is however veryinefficient and not realizable in most situations. [42]


4.5.2 Unregistered finger

This attack means that the intruder uses his/her own finger to try (intentionallyor unintentionally) to log in as another user. An important indication for how easythis type of attack is on a special system, is the false acceptance rate, described insection 2.1.2 on page 9. Also, by knowing the pattern type of the legitimate user,an intruder with the same pattern type (see section 3.3.1 on page 16) will have ahigher probability of successfully logging in as the legitimate user. [42]

4.5.3 A twin’s fingerprint or a genetic clone

As described in section 3.2 on page 14, the fingerprints of identical twins are verysimilar, even though not identical. Using a genetic clone of a fingerprint or theidentical twin’s fingerprints to deceive a system could be possible if the algorithmused is not robust enough to distinguish the live finger from the intruder’s finger.The attack with a genetic cloned finger could be detected with help of a livenessdetection mechanism in the system. Using a combination with another authenti-cation method, or using a two-persons control, would also be helpful to deter thesecrimes. However, protection against the identical twin is not as easy as protectionagainst a genetic clone. [42]

4.5.4 Artificial fingerprint

An artificial fingerprint, is a fingerprint made to imitate a real (living) fingerprint.It can be made of gelatin, silicone, play-doh, clay, or other materials. There aretwo ways to make an artificial fingerprint; either by directly making a mold of thelegitimate user’s finger, or by using a residual fingerprint to produce an artificialfingerprint [42]. The experiments prior to this report, focus on attacks with artificialfingerprints made from a residual fingerprint.

Again, liveness detection in the system, a combination with another authenticationmethod, or a two-persons control would be helpful to deter these crimes. [42]

4.5.5 Others

Some fingerprint systems can be fooled by flashing a light against the scanner,heating up, cooling down, humidifying, impacting on, or vibrating the scanneroutside its environmental tolerances. Another way to fool a fingerprint system isto use a residual fingerprint on the sensor surface to reactivate the fingerprint. Thiscan be done by breathing on the sensor’s surface, placing a thin-walled water-filledplastic bag on the sensor’s surface, or by dusting graphite powder and then pressingan adhesive film on the sensor’s surface. On an optical sensor, the method with

4.5 Sensor attacks and protection schemes 33

graphite powder and adhesive film can be used together with a halogen lamp tocreate a kind of snow blindness in the sensor. [42, 55]

To protect against attacks using reactivation of a latent fingerprint, a sweepingsensor can be used instead of an area sensor.


Chapter 5

Liveness detection

Liveness detection (sometimes called vitality detection) in a biometric systemmeans the capability for the system to detect, during enrollment and identifica-tion/verification, whether or not the biometric sample presented is alive or not.Furthermore, if the system is designed to protect against attacks with artificialfingerprints, it must also check that the presented biometric sample belongs to thelive human being who was originally enrolled in the system and not just any livehuman being.

Many people believe that biometric systems can detect liveness in biometric sam-ples. Some manufacturers of biometric system also claim that they have livenessdetection in their system. It has however been shown that fingerprint systemscan be fooled with artificial fingerprints, that static facial images can be used tofool face recognition systems, and that static iris images can be used to fool irisrecognition systems [23].

After a general description of the concept liveness detection in biometric systems,this chapter will focus on liveness detection in fingerprint systems, which techniquesfingerprint scanners can use to detect liveness, and how these fingerprint scannerscan be fooled. This chapter also includes a discussion of liveness detection, ascompared to the other chapters in the thesis which are discussed in chapter 9 onpage 75.

5.1 Liveness detection in biometric systems

Liveness detection can be performed either at the acquisition stage, or at the pro-cessing stage. For example, an optical fingerprint scanner would create an imageof an eraser, but not extract any features; the liveness detection takes place at theprocessing stage. A capacitive fingerprint sensor on the other hand, would not even

35

36 Liveness detection

create an image of the eraser; the liveness detection takes place at the acquisitionstage. [23]

There are two approaches in determining if a finger is alive or not; liveness detectionand non-liveness detection. The material or data used to spoof a system often havea number of different non-liveness characteristics that could be used to detect non-liveness. An example of a non-liveness detection detection method would be todetect air bubbles in gelatin artificial fingerprints. Most biometric systems todayhave a decision process which first checks liveness:

if data = liveperform acquisition and extraction

else if data = not livedo not perform acquisition and extraction

This means that an intruder has the simpler task of imitating a live finger than cir-cumventing a non-liveness detection mechanism. In fact, any detection mechanismcan and will be defeated according to [23].

There are essentially three different ways to introduce liveness detection into abiometric system [51]:

• Using extra hardware to acquire life signs.

• Using the information already captured by the system to detect life signs.

• Using liveness information inherent to the biometric.

The first of these methods introduces a few other problems; (1) it is expensive,(2) it is bulky, and (3) it could still be possible to present the artificial fingerprintto the fingerprint sensor and the real fingerprint of the intruder to the hardwarethat detects liveness. Also, in some cases it is still possible to fool the additionalhardware with a wafer-thin artificial fingerprint. The second method does not havethese disadvantages, except maybe that it could be possible to still fool with anartificial fingerprint. It is on the other hand a bit more complicated to extract thelife signs using no additional hardware.

The third method of using inherent liveness information to the biometric, is notapplicable to fingerprint recognition. Other biometric systems including facial ther-mograms, gait, body odor, keystroke dynamics, etc. use this however. Thesetechnologies are not widely implemented and still need to be validated as reliablebiometric identifiers [34].

The main problem of distinguishing between an artificial fingerprint and a realfingerprint, is that the epidermis (outer skin) of the finger is in fact not aliveeither. Many different techniques have been suggested to detect liveness, and someof them will be presented in the following sections. For each of these techniques, amethod to fool the system with an artificial fingerprint will also be suggested.

5.2 Using extra hardware 37

5.2 Using extra hardware

The main problem with liveness detection methods based on extra hardware, isthat the scanners have to be adjusted to operate efficiently in different kinds ofenvironments, leading to problems when using a wafer-thin artificial fingerprintglued on to a live finger. Furthermore, using extra hardware will in many cases beinconvenient for the user.

Only in the US, many patents have been filed the last years concerning livenessdetection in fingerprint scanners based on physiological properties. Some of themost common methods will be described here. Most of these systems are notavailable commercially.

5.2.1 Temperature

The temperature of the epidermis is about 26–30◦C. When using a thin siliconeartificial fingerprint, this results in a decrease by a maximum of 2◦C of the tem-perature transfer to the sensor. Obviously, it will not be difficult to have thetemperature of the artificial fingerprint within the working margins of the sensor.Sensors that are used outdoors often have a broader working margin, giving theintruder even better prerequisites. [57]

Even though [57] writes about silicone artificial fingerprints, it can be expected thatthe same reasoning can be done when it comes to gelatin artificial fingerprints.

5.2.2 Optical properties

Optical sensors can use the optical properties of human skin versus other materialsas a liveness detection method. These properties include e.g. absorption, reflection,scattering, and refraction under different lighting conditions (such as red, blue,green, infrared, laser lights). A gelatin artificial fingerprint does however haveoptical properties which are very similar to human skin. [41]

5.2.3 Pulse

The pulse in the tip of the finger can be detected and used as a liveness detectionmethod. With a wafer-thin artificial fingerprint, the underlying finger’s pulse willhowever be sensed. Also, practical problems arise due to changes in the pulse.A person with a pulse of 40 beats per minute implicates that the finger must beheld for at least four seconds on the sensor for the pulse to be detectable. Thesame person could have a pulse of 80 beats per minute if he or she worked outimmediately before the fingerprint scanning. The emotional state of the personalso affects the pulse. [57]


A US patent entitled Anti-Fraud Biometric Sensor that Accurately Detects BloodFlow by SmartTouch LLC describes how two light emitting diodes (LEDs) anda photo-detector are used to determine whether blood is flowing through the fin-ger. Earlier similar solutions have been possible to fool by simulating blood flow(through the use of a flashing light or by moving the imposters finger). This patentdeclares to have solved these problems by checking if the background light levelis above a threshold and by detecting movement of the finger. This liveness de-tection method basically implements pulse oximetry, but only uses the pulse rateinformation, see section 5.2.4. [37]

5.2.4 Pulse oximetry

Pulse oximetry is used in the medical field to measure the oxygen saturation ofhaemoglobin in a patient’s arterial blood. A pulse oximeter also measure the pulserate. The technology involved is based on two basic principles. First, haemoglobinabsorbs light differently at two different wavelengths depending on the degree ofoxygenation. Second, the fluctuating volume of arterial blood for each pulse beatadds a pulsatile component to the absorption. [11]

Detection of pulse oximetry can be fooled using a translucent artificial fingerprint(e.g. gelatin) which covers only the live finger’s fingerprint. The pulse oximetry willmeasure the saturation of oxygen of haemoglobin in the intruder’s finger’s blood.[51]

5.2.5 Blood pressure

Apart from the same disadvantages as with measuring the pulse, measuring bloodpressure adds another problem. The sensors available today (excluding the singlepoint sensors that must be entered directly in the vein), require measurementat two different places on the body, e.g. on both hands. Also, blood pressuremeasurement devices are easy to fool by using a wafer-thin artificial fingerprintand the underlying finger’s blood pressure.

5.2.6 Electric resistance

The electric resistance of the skin can range from a couple of kilo-Ohms to severalmega-Ohms depending on the humidity of the finger. With some people havingdry fingers, and others being sweaty, it is easy to realize that the span of allowedresistance levels will be great enough for an intruder to easily fool the system. Forexample, by putting some saliva on the silicone artificial fingerprint, the systemwill be fooled into believing it is the live finger. [57]

5.2 Using extra hardware 39

In [42], the electric resistance was measured to 16 MOhms/cm (sic!) in a live fingerand 20 MOhms/cm (sic!) for the corresponding gelatin artificial fingerprint. Inother words, the difference is so small between the two that it would be impossibleto create liveness detection with this method without getting a too high FRR.

Matsumoto and colleagues also showed that a live finger has a moisture level of16 %, while a gelatin fingerprint has a moisture level of 23 % [42]. Since the moistureaffects the resistance, and the weather conditions and psychological conditions canchange the dryness or sweatiness of human skin, the difference in moisture levelbetween live fingers and gelatin artificial fingerprints, is small enough to be able tofool sensors with gelatin prints.

5.2.7 Relative dielectric permittivity

The relative dielectric permittivity (also known as relative dielectric constant orRDC), is a measurement of the degree to which a medium resists the flow of electriccharge divided by the degree to which free space resists such charge [50]. Thedifferent values of RDC between a live finger and an artificial fingerprint is thebasis of this liveness detection method.

Just like electric resistance, the RDC is also affected by the humidity of the finger,so to get an acceptable FRR, the range of acceptable RDCs will include the RDCof a gelatin fingerprint. An artificial fingerprint made of silicone on the other hand,has to be prepared with a solution of 90 % alcohol and 10 % water to fool a system.The RDCs of alcohol and water are 24 and 80 respectively, while the RDC of humanskin has a value in between these. Since the alcohol will evaporate quicker thanwater, the RDC will soon be within the acceptance range of the sensor. [42, 57]

5.2.8 Combining ECG, pulse oximetry, and temperature

A US patent from 1998, suggests using one or preferably more biometrical featuresfor liveness detection [46]. Many examples of non-specific biometric parameters aregiven, but most preferably a combination of pulse oximetry, electrocardiography(ECG), and a temperature sensor is used. A CCD camera is used for the fingerprintidentification/verification, and the skin temperature, pulse (both from ECG andoptical readings which should correlate), and oxygen saturation of haemoglobin inthe arterial blood, are used for a liveness measurement.

As mentioned earlier, the temperature sensor can be easily fooled with an artificialfingerprint. Also, detection of pulsation, pulse oximetry, and electrocardiogramcan be fooled using a translucent artificial fingerprint (e.g. gelatin) which coversonly the intruder’s live finger’s fingerprint [51].

Additionally, because of the ECG sensor, the user has to hold his/her finger stillfor six to eight seconds. This is quite a long time when it comes to these types of


applications. If the user moves the finger, the measurement has to be started allover again. Because of this and other various reasons, the project was discontinued.[34]

5.2.9 Detection under epidermis

The fingertip consists of bone, fatty tissue, and two layers of skin; the epidermis(the outer layer) and the dermis (the inner layer). The fingerprint pattern is foundnot only in the epidermis, but the exact same pattern can also be found in betweenthese layers, and this is the information that some liveness detection systems use.[38]

Two different kinds of sensors using information underneath the epidermis, willbe mentioned here; the ultrasonic sensor, and the electric field sensor. Ultrasonicsensors focus on the fact that the underlying layer is softer and more flexible thanthe epidermis. Electric field sensors focus on the higher electric conductivity of thelayer underneath the epidermis as compared to the epidermis. Even though thesetypes of sensors use the information underneath the epidermis, this does not meanthat they cannot be fooled with an artificial fingerprint. In [57] it is suggestedthat with a knowledge of the liveness detection method used, two different layersof artificial fingerprints with the appropriate characteristics, can be created to foolthe scanner. E.g. to fool an ultrasonic sensor, first a more flexible and soft printis made, and then a second regular artificial print is made and attached to thefirst while making sure that the two line patterns are in exact matching positions.Matching the patterns should be no problem for a dental technician. [57]

Interesting to note here is that in the experiments performed, one electric fieldsensor (in two different scanners) was tested in the extensive experiments, and fourdifferent electric field sensors were tested at CeBIT. All of them were deceivedwithout using a two-layered artificial fingerprint, but simply an ordinary gelatinartificial fingerprint. What it does not show however is whether or not ultrasonicsensors could be deceived in the same easy manner. Testing an ultrasonic sensorby a third party with regards to artificial fingerprints is needed.

5.2.10 Other claims

Some manufacturers claim to have other liveness detection methods than the onesdescribed in this section. Additionally, some of them refuse to reveal that secretmethod. Security by obscurity (keeping things secret by keeping the method se-cret), will make the system more difficult to break in the beginning, but will in theend often be broken and is therefore not appropriate as a security method. [57]

5.3 Using existing information 41

5.3 Using existing information

To the author’s knowledge, there exists only one thoroughly researched method forliveness detection using existing information today. This method, using perspira-tion as liveness detection, is therefore the only method which will be presented indetail in this section. Some other methods will however first be mentioned.

5.3.1 Skin deformation

This liveness detection method uses the information about how the fingertip’s skindeforms when pressed against a surface. If for example, the user is required toplace his/her finger on the sensor twice, or to move it once it is in contact with thesensor surface, there will be some non-linear distortions between the two fingerprintimpressions. Using a comparably thick artificial fingerprint with the same type ofrequirements, will only give a rigid transformation between the two fingerprintimpressions. Using a thin artificial fingerprint glued on to a live finger, will onthe other hand still produce quite similar non-linear deformations as a live fingerwould. [41]

5.3.2 Pores

By using a fingerprint sensor which can acquire an image of the print with a veryhigh resolution, it is possible to use details in the fingerprint, such as sweat pores,as a liveness detection method [41]. These fine details might be difficult to copy inartificial fingerprints. According to [41], the work by Matsumoto et al. [42], showedthat a coarse reproduction of intra-ridge pores is feasible with gelatin artificialfingerprints. The experiments performed prior to this report, showed that it isdifficult to reproduce the exact size and position of the pores on the mold andthus also on the gelatin print, see section 9.1.3 on page 79. The pores can howeverbe coarsely reproduced, and even this should make you think twice before using afingerprint device which uses the position and size of pores as liveness detection.

5.3.3 Unique characteristic for each individual

In [41], the authors argue that a good liveness detection method should dependon characteristics that are unique to each individual and which are also difficult tocopy. They suggest a method where the recognition is done using the ordinary printon the fingertip, but when it comes to liveness detection, a side impression (nearthe nail) which has been enrolled earlier, should also be subject to recognition. [41]

The advantage of this method is that people usually do not leave their side impres-sions as latent prints very often. Therefore, the problems with artificial fingerprints


made from latent prints will dramatically decrease. Also, this method would notrequire any major changes in the software of the fingerprint scanner. [41]

The main drawback with this method is artificial fingerprints created with helpof a willing or coerced legitimate user. Also, the acquisition and processing timewould be longer.

5.3.4 Perspiration

The Biomedical Signal Analysis Laboratory at West Virginia University, USA, isdeveloping a liveness detection algorithm which is based on the detection of perspi-ration in a time progression of fingerprint images. To be able to fully understandthe algorithm developed at the West Virginia University, a theory background ofperspiration will be presented first.

Skin characteristics

There are about 600 sweat glands per square inch, and the sweat (a dilute sodiumchloride solution) diffuses from the sweat glands on to the surface of the skinthrough small pores. Skin pores do not disappear, move, or spontaneously changeover time. The pore-to-pore distance is approximately 0.5 mm over the fingertips.[9]

Sweat has a very high dielectric constant and electrical conductivity compared tothe lipid-soluble substances absorbed by the outmost layer of the skin. Generally,the dielectric constant of sweat is around 30 times higher than the lipid. [9]

Fingerprint scanner

When laying a fingertip with moist skin on a capacitive sensor, the capacitancewill be much higher (resulting in a darker captured image), than if the skin wasnot moist. The reason is the high dielectric constant of sweat. Because of this,capacitive scanners are specifically suited for detection of perspiration. [9]

Perspiration over time

In live fingers, perspiration starts from the pores. The sweat then diffuses alongthe ridges during time, making the semi-dry regions between the pores moister ordarker in the image. The perspiration process does not occur in cadaver fingers orartificial fingerprints. [9]

There are mainly two ways to use the perspiration information. Either you can usethe fact that perspiration starts from the pores (static approach), or you can use the

5.3 Using existing information 43

fact that perspiration changes the image darkness over time (dynamic approach).[9]

The algorithm

The algorithm maps a 2-dimensional fingerprint image to a signal which representsthe gray-level values along the ridges. A pair of consecutive fingerprints are cap-tured in 5 seconds. The last image collected (at time 5 s) is used to determine thelocation of the ridges, since it usually has darker ridges and better quality. Varia-tions in gray levels in the signal correspond to variations in moisture both statically(in one image) and dynamically (difference between first and last image). A fouriertransform of the signal (see figure 5.1) is used to quantify the static variability ingray level along the ridges due to the pores and the presence of perspiration. Inparticular, the algorithm focuses on frequencies corresponding to the spatial fre-quency of the pores. Secondly, the dynamic features quantify the change in thelocal maxima and minima in the ridge signal. [9]

Figure 5.1. West Virginia perspiration detection method. The two plotted lines are thecapacitance plots across a ridge of the live finger, measured five seconds apart. The localmaxima in the plot corresponds to the pores in the fingerprint ridge that are saturated withmoisture. The two sensor readings (solid line=initial reading and dashed line=readingafter five seconds), show that the areas between the pores tend to fill up with perspirationover time as the moisture spreads across the ridges. If this tendency cannot be observed,the fingerprint is assumed to be fake. [9, 34]

The algorithm develops one static measure and four dynamic measures. Classi-fication can be performed based on each of the individual measures developed.While the individual measures give equal error rates (EERs) of between 5.56 %and 38.89 %, much lower EERs can be achieved by combining all measures. Toclassify the finger as live or fake/dead, a back-propagation neural network (BPNN)is used with the static measure and dynamic measures as input. [9]


Testing of the algorithm

Using a training set of 12 subjects each for live fingers, and equally many cadaverfingers and artificial prints, the BPNN was trained using a number of iterations.A special criterion can be set to decide how good the BPNN should be, and theBPNN is then trained with as many iterations as needed until this criterion is met.The artificial fingerprints were made from play dough using rubber-based casts.Using a test set of six live fingers, and equally many cadaver and spoof fingers, theBPNN classified all of the cases correctly. [9]

Discussion of perspiration

This liveness detection method does only require a software upgrade and not anyextra hardware. There are however a few things to keep in mind before actuallystarting to use this liveness detection method outside the laboratory.

First of all, more testing is needed, and the team that developed the algorithm hasalready started working on this. Still, one could argue that the algorithm shouldalso be tested by an independent party.

The perspiration process will be somewhat different between different subjects, andwill also depend on the initial moisture level of the skin. Therefore, a much largertest set is needed, including subjects with different skin conditions in differentclimates and seasons as well as a more diverse background (race, age, etc.). Thisis the work of an ongoing study. [9]

Perspiration disorders (finger too moist or too dry) and other abnormal skin con-ditions could be a problem when it comes to the algorithm developed. However,people with these skin conditions usually have problems with using fingerprintscanners in general. When it comes to too moist fingers, wiping the finger beforescanning, is sufficient to overcome these problems. [9]

The algorithm could be optimized to make it more time efficient [9]. Also, thetime issue when using a scanner is crucial. Tradeoffs between precision and speedof liveness verification/identification will have to be made [9]. How close can twocaptures be made for the algorithm to still work moderately? To keep your fingeron a scanner for five seconds is a comparably long time and this time must bedecreased to make the method worth using.

The current algorithm averages data from the whole image. Using e.g. the top25 % of ridge signals which exhibit the most variation could optimize the algorithm.Another optimization could be to develop device specific algorithms. [16]

More research is needed in the area of creating artificial fingerprints which havepores and imitate the perspiration process.

5.4 Testing of liveness detection methods 45

5.4 Testing of liveness detection methods

Many liveness detection methods have been suggested and some have been im-plemented. An independent testing on the effectiveness of these methods for per-forming liveness detection is still missing. Liveness detection is only a part of thefingerprint recognition system, and must therefore be tested with regards to theeffects it has on the whole system when it comes to FAR, FRR, failure to enroll,and other statistics. In addition, user convenience, universality, cost, time, etc.,need to be considered for evaluation. [51]

5.5 Relevance of liveness detection

Imagine a system that is used for passport bearer authentication, air travel authen-tication, or access to nuclear facilities. This system would require a high level ofsecurity and the consequences would be severe if the system was defeated. In fact,all these usage areas have been considered for biometric applications and might ina few years be reality. In a system requiring a high security level, liveness detec-tion would be necessary if the system was not combined with other authenticationmethods or other biometrics.

On the other hand, a system used for logging in at your home computer mightnot be interesting enough for an intruder to spend days in creating an artificialfingerprint. In this case, the ease of use of the system is probably more importantfor the user than having a system with liveness detection.

Stephanie Schuckers, Ph.D. at the Clarkson University and West Virginia Univer-sity in USA, puts the usage of fingerprints in perspective: ”While someone couldsteal and make a copy of my office key to gain unauthorized entry, this does not dis-credit the use of keys” [51]. However, you do not leave your keys all over the placefor anyone to gain access to them like you do with your fingerprints. Furthermore,a key and lock is much easier to change than a fingerprint.

5.6 Other methods to limit spoofing

Liveness detection has been thoroughly discussed in this chapter, but there arealso other methods to limit the impact of attacks with artificial fingerprints onfingerprint systems. Some of these other methods will be presented in this section.

5.6.1 Multiple snapshots of the same finger

By taking multiple snapshots of the same finger and requiring each of these tobe identified/verified correctly, the FAR when it comes to artificial fingerprints,


could be decreased. This would probably increase the FRR however, leading toinconvenience for ordinary users of the system.

5.6.2 Multiple fingers

If users were required to enroll more than one finger, then identification/verificationcan be performed in two different ways to increase the security of the system. Thefirst scenario involves randomization of requested fingers to identify/verify. Theother scenario involves requesting all fingers enrolled for identification/verification.[23]

5.6.3 Challenge-response

Challenge-response is another method to determine the presence of a person. Theresponse can be either voluntary (behavioral) or involuntary (reflexive). In a vol-untary challenge-response system, the user will hear, see, or feel something anddo something in response. In an involuntary challenge-response system, the user’sbody automatically responds to a stimulus. Examples of this are muscles respond-ing to electrical stimulation, the dynamic change in the color of skin when pressureis applied, and the reflex of a knee when struck. [34]

An implemented example of an involuntary challenge-response is found in the USpatent Detector for recognizing the living character of a finger in a fingerprintrecognizing apparatus by Kallo et al. The method involves a small impulse cur-rent being applied to the finger and the finger’s electrical reaction to the impulseis the involuntary response. If the signals returned by the finger are outside thepredefined range of acceptable values, the fingerprint is assumed to be fake. Guard-ware Systems Ltd. uses this patented liveness detection method in their products.[36, 34]

One problem with this method is to know that the person is in fact the same asthe true owner of the fingerprint presented to the sensor. Furthermore, methodsinvolving shocking for example, are probably not comfortable for the users. [51]

5.6.4 Supervision

Both identification, verification, and enrollment, can be subject to supervision toincrease security. It will be more difficult to bypass a system when being watched.Still, when using a thin transparent gelatin artificial print glued on to a live finger,it should be very difficult for a supervisor to detect it, especially if being tiredafter having supervised the system many hours already without detecting anythingsuspicious.

5.7 Additional comments 47

5.6.5 Multi-modal biometrics

By using multi-modal biometric systems, i.e. systems combining two or more bio-metric techniques, security can be increased. For example, by combining fingerprintrecognition with iris recognition, the security of the system will be higher than us-ing one of those systems alone. When it comes to fooling a multi-modal biometricsystem with artificial biometrics, it will be more difficult to create both an artificialfingerprint and an artificial iris that will be accepted by the system. Much researchis being performed in the area to find the best way to combine the available bio-metric methods. Except choosing the biometric traits to combine, the method tocombine them must also be decided. The methods can for example be combinedat the feature extraction level or at the decision level. [51]

According to [23], ”implementing multiple biometrics is currently much more diffi-cult than it seems”. Reasons mentioned are environmental issues, cost, and equip-ment limitations.

5.6.6 Multiple identification/verification methods

Combining a biometric method with something you know and/or hold, will increasethe security of the system. For example, a fingerprint recognition system can becombined with a smart card and a password. To deceive that system, the intruderwould have to get hold of both the smart card, the password and the fingerprint.Furthermore, if the fingerprint template is stored on the smart card, it will beimpossible for an intruder to attack the non-existent centrally stored templatedatabase.

The downside of this method is the inconvenience for the user of the system, possiblehigh FARs and FRRs, and that it is not possible to use in identification systems[23].

5.7 Additional comments

The discussion about liveness detection has yet been very hidden and companiesdo often not openly discuss their liveness detection solutions, if they have any.

What kind of liveness traits that are measured is of less relevance than how theliveness detection method is implemented. If possible, it is best to acquire thefingerprint information and the liveness information simultaneously, i.e. at thesame time and place. Furthermore, to stay one step ahead of adversaries, livingtechniques that evolve over time could be used for liveness detection. [34]

It must always be remembered that liveness detection is not a definite solution toa perfectly secure system. Liveness detection does minimize the risk of successful


attacks with artificial fingerprints, but it is not guaranteed that it can not bebroken. When considering the security of a fingerprint recognition system, theentire system must be looked at, and not only attacks with artificial fingerprints.Comparing the security of fingerprint recognition systems with other biometricsystems or other authentication methods, all systems will have its weaknesses andstrengths and it is impossible to say that one system is the best.

Chapter 6

History of artificialfingerprints

The work of creating artificial fingerprints, started earlier than most people know.This section will give an historical overview of how artificial fingerprints have de-veloped over the years and how successful they have been previously in foolingfingerprint systems. It should be noted that the degree of how scientific the follow-ing works are, varies.

6.1 Albert Wehde’s work

According to [7], it was already in the 1920’s that Albert Wehde, an engraver,photographer, former self-described political prisoner, and worker for the identifi-cation bureau at Leavenworth, devised a way to forge fingerprints. (It was commonpractice to employ prison inmates as fingerprint clerks.) Wehde’s training as anengraver and photographer came in handy for his method. He left a fingerprint im-pression in grease on a piece of black tin, dusted the print with white powder, andphotographed it. Finally, he made a copper etching of the negative. The copperplate could then be used to ”forge” latent prints. [7]

Notice that the information about Wehde’s forgery comes originally from the bookFinger-Prints Can Be Forged, written by Wehde himself together with John Beffel,a radical journalist. [7]

49

50 History of artificial fingerprints

6.2 Six biometric devices point the finger at secu-rity

By D. Willis and M. Lee, Network Computing, June 1998.

Fooling fingerprint scanners with help of artificial fingerprints is not a new method.Already in 1998, David Willis and Mike Lee at the Network Computing magazine,noted that artificial fingerprints can be created by making a wax mold and usingsilicone to create the artificial fingerprints [60]. Their artificial fingerprints fooledfour out of six tested fingerprint scanners.

The testing team also managed to get past two of the six fingerprint scanners usinganother method. Latent prints on a table were enhanced with help of a fine brushand dry toner from a laser printer cartridge and then lifted with adhesive tape.The images were transferred to a transparency material on a photocopier and bywetting the ink side of the transparency, this could be used to fool the scanners.[60]

6.3 Biometrical fingerprint recognition: don’t getyour fingers burned

By T. Putte and J. Keuning, September 2000.

Whether or not Wehde’s or Willis’ and Lee’s work inspired Ton van der Putteand Jeroen Keuning in 2000 to do further experiments, is not known. Putte andKeuning used two methods for creating artificial fingerprints [57]:

• Duplication with cooperation: Using plaster, a mold is formed. The mold isfilled with silicone and a pounder is used to make the artificial finger wafer-thin.

• Duplication without cooperation: A powder and a brush is used to enhancethe latent fingerprint. Scotch tape is used to remove the powder from thebackground. The tape is placed on the photosensitive side of a film, and withhelp of a camera, a photo is taken. The negative is attached to a printedcircuit board (PCB), exposed to UV light, and the PCB is developed andetched. The slim profile of about 35 micron is deepened and the mold isfinished. Again, silicone is used to create the artificial fingerprint.

Six fingerprint sensors were tested (optical and solid-state sensors), all of whichaccepted a silicone fingerprint as a real finger, almost all at the first attempt. Moreoptical sensors have also been tested at various fairs (mainly at the CeBIT tradefair in Hannover, Germany) and all sensors tested, accepted the silicone fingerprintat the first attempt. [57]

6.4 Impact of Artificial ”Gummy” Fingers on Fingerprint Systems 51

6.4 Impact of Artificial ”Gummy” Fingers on Fin-gerprint Systems

By T. Matsumoto, H. Matsumoto, K. Yamada, and S.Hoshino, January 2002.

Even though Putte and Keuning were the first well-known to perform experimentssimulating the legitimate user not cooperating, the real breakthrough for artificialfingerprints came with the results from a research group led by Tsutomu Mat-sumoto at the Yokohama National University in Japan.

Matsumoto and colleagues tested fingerprint systems with silicone artificial finger-prints. From the results they concluded that systems with capacitive sensors andsome systems with optical sensors could reject silicone fingerprints. In order toinvestigate the security of the systems further, they carried out experiments withgelatin fingerprints to determine whether or not fingerprint systems could detecta gelatin artificial fingerprint or not. Gelatin is made by dissolving collagen (aprotein found in bone and connective tissues) in a hot solution . Since gelatin ismade out of collagen, it resembles the surface of human skin in ways of moisture,electric resistance, and texture (see table 6.1). [3, 42, 45]

Type Moisture Electric resistance (sic!)Live finger 16 % 16 MOhm/cmGelatin artificial fingerprint 23 % 20 MOhm/cm

Table 6.1. Characteristics of a live finger compared to a gelatin artificial fingerprint.[42]

As with Putte’s and Keuning’s work, Matsumoto and colleagues also made twotypes of experiments [42]:

• Cloning with a plastic mold : With help of the legitimate user’s cooperation,a molding plastic was used to make a mold. Solid gelatin leaves were solvedin hot water and this solution (50 % gelatin and 50 % water) was then pouredinto the mold to create an artificial fingerprint.

• Cloning from a residual fingerprint : A latent fingerprint on a glass platewas enhanced with cyanoacrylate adhesive, as described in section 3.4.1 onpage 20. A digital microscope was used to make the fingerprint digital. Afterusing an image processing software to improve the contrasts etc., the picturewas printed and used as a mask to create a photo sensitive coated PCB witha copper fingerprint on it. Having the mold ready, a gelatin solution of 40 %gelatin and 60 % water, was used to create the artificial fingerprint.

The different types of experiments performed are shown in table 6.2 on page 52.The experiments were performed with five subjects for the method of cloning witha plastic mold and one subject for the method of cloning from a residual fingerprint.They all attempted one to one verification 100 times in each type of experiment


for each fingerprint system, thus acquiring acceptance rates in verification for thefingerprint systems. Eleven fingerprint systems were tested, all of which used ei-ther optical or capacitive scanning techniques. When different security levels wereavailable, the highest was used. [42]

Experiment type Enrollment Verification/Identification1 Live fingerprint Live fingerprint2 Live fingerprint Artificial fingerprint3 Artificial fingerprint Live fingerprint4 Artificial fingerprint Artificial fingerprint

Table 6.2. Experiment types. [42]

All fingerprint scanners tested, falsely accepted the artificial fingerprints. For bothtypes of experiments (cloning with a plastic mold and from a residual fingerprint),the artificial fingerprints were all enrollable and in experiment type 2, the finger-print systems accepted the artificial fingerprints more than 67 % of the time. [42]

6.5 Body Check – Biometric Access ProtectionDevices and their Programs Put to the Test

By L. Thalheim, J. Krissler, and P-M. Ziegler, c’t magazine, May 2002.

Lisa Thalheim, Jan Krissler, and Peter-Michael Ziegler for c’t magazine, testedeleven fingerprint scanners at the CeBIT trade fair in Hannover, Germany, in 2002.Six capacitive scanners, two optical scanners, and one thermal scanner, were tested.Several of the capacitive scanners could be fooled by breathing on the latent print,using a water bag on a latent print, or by dusting with powder and using anadhesive film as described in section 4.5.5 on page 32. One optical scanner wasalso fooled using the adhesive film method. [55]

Attacks with silicone artificial fingerprints were also performed where the moldswere made by heating the wax on tea-warming candles. Both the optical andthermal scanners were fooled using this method. [55]

6.6 An Investigation Into the Vulnerability of theSiemens ID Mouse Professional Version 4

By A. Ligon, September 2002.

The security of the Siemens ID Mouse Professional Version 4 was examined withhelp of the following experiments [39]:

6.7 Spoofing and Anti-Spoofing Measures 53

1. Latent print reactivation through breathing.

2. Latent print reactivation with a water-filled plastic bag.

3. Latent print reactivation with latent print powder.

4. Print lifting with latent print powder.

5. Gummy finger from a live finger mold.

6. Gummy finger from a photolithographic PCB mold.

The first four types of attacks are described in section 4.5.5 on page 32. In thefifth experiment, Sculpy clay was used to make the mold, and a gelatin solutionof 50 % was used to make the artificial fingerprint. Due to lack of equipment, thepicture taken by the scanner itself was used to produce the PCB in the sixth typeof experiment. [39]

The results showed that none of the first four gave an acceptance rate of morethan 10 % (out of forty trials). The fifth experiment however, was very successfuland managed to fool the scanner up to 90 % of the trials. The sixth method wasunsuccessful in fooling the scanner. The probable reason is the bad picture qualityproduced by the scanner itself. [39]

6.7 Spoofing and Anti-Spoofing Measures

By S. A. C. Schuckers, December 2002.

The Biomedical Signal Analysis Laboratory at West Virginia University, USA, hasdeveloped spoofing techniques (i.e. attacks with artificial fingerprints) in order totest a new liveness detection algorithm, see section 5.3.4 on page 42.

The molds are made from dental impression material (combination of type 0 and 3)and casts are made from Play-Doh and clay, since they are moisture based and mostfingerprint scanners were able to image them. Eleven different subjects were used,and six casts were made for each of these subjects. Various fingerprint scannerswere tested, including capacitive DC, capacitive AC, optical, and opto-electronictechnologies. For certain fingerprint scanners, most subjects’ casts were able tospoof the system. For all technologies, at least 3 of 11 subjects’ casts were ofsufficient quality to spoof fingerprint devices at least once. [51]

Schuckers and colleagues, also tested the systems with cadaver fingers in an at-tempt to address the possibility that dismembered fingers could be used to spooffingerprint devices. For one device, 6 out of the 14 available cadaver fingers, werenot able to enroll. For the other scanners and fingers, cadaver fingers were falselyaccepted 40-94 % of the verification trials. [51]


6.8 Fooling Fingerprint Scanners – Biometric Vul-nerabilities of the Precise Biometrics 100 SCScanner

By A. Sten, A. Kaseva, and T. Virtanen, March 2003.

The next interesting work in the field of artificial fingerprints, was performed byAntti Sten, Antti Kaseva, and Teemupekka Virtanen at the Helsinki University ofTechnology. To examine the security of fingerprint scanners, they chose an exampledevice and examined it using the following methods [53]:

1. Using grease stains left on the pad.

2. Creating a mold using a live finger.

3. Creating a mold using a latent fingerprint.

The first of these attacks was performed in two ways; breathing on the latent printon the sensor, and pressing a gummy bear on the latent. In neither case, the attackwas successful. [53]

In the second and third attack, gelatin was used to make the artificial fingerprint.A similar method as Matsumoto and colleagues used (see section 6.4 on page 51),was also used in these experiments. Both attacks managed to fool the scanner in afew out of a hundred trials (the third attack had a FAR with artificial fingerprintsof 2 %) [53].

6.9 Evaluation of biometric security systems againstartificial fingers

By Johan Blomme, October 2003. [3]

This report evaluates the security of fingerprint scanners with a focus on artificialfingerprints. The experiments were based on cooperation from the legitimate user.The molds were made from a silicone clay, and the artificial fingerprints were madeof a gelatin solution. Artificial fingerprints were based on ten subjects whose realfingerprints and artificial counterparts were tested on three different fingerprintscanners, one optical (FTIR with a sheet prism) and two electric-field. All scannerstested accepted artificial fingerprints as substitutes for real fingerprints. Resultsvaried between users and scanners but the artificial fingerprints were acceptedabout 25–50 % of the trials. [3]

Chapter 7

Experiment description

This chapter explains how the experiments were performed. First, a descriptionof how to make the artificial fingerprints used in the experiments, is presented.Then, the two types of experiments performed are described. The first type ofexperiment tested nine fingerprint systems at the CeBIT trade fair in Germany,2004. The second type of experiments was more extensive than the first, but withfewer fingerprint systems. This chapter will together with appendix B on page 109,and appendix C on page 113, make it possible to fully recreate the performedexperimental procedure.

7.1 Making of the artificial fingerprint

The making of an artificial fingerprint without a subject’s cooperation is quitecomplicated and requires a number of steps. The process is graphically depicted infigure 7.1 on page 56, and all the steps will be described in detail in this section.

7.1.1 Enhancing the fingerprint

The material used in these experiments are partly due to a limited budget. Withmore money, more advanced methods and materials could be used for the enhance-ment of the fingerprints, see [1]. A limit budget would also show that, if possibleto circumvent the tested systems, a very advanced equipment or a lot of money isnot needed.

The subjects’ right index fingers were checked for scars and dirt before the testingbegan. If any scars or dirt would have been found, the right middle finger wouldhave been chosen instead. This was however not the case for any of the subjects.

55

56 Experiment description

Figure 7.1. An overview of the process of making the mold.

The subjects were informed to press their right index finger on a micro slide (asmall glass plate) three to four times. Before pressing the finger on the micro slide,they were however informed to rub the finger to the side of the nose. This wasdone to get some substance, like fat and grease on the finger, so that a latent printof good quality would be achieved.

7.1 Making of the artificial fingerprint 57

Powdering

A soot powder mixture together with a squirrel hair brush (see figure 7.2), bothfrom KTM, were used during the experiments. This equipment is used by forensiclaboratory assistants. For more detailed information about the powder and brush,see appendix B on page 109.

With help of the squirrel hair brush, the soot powder mixture was carefully brushedonto the fingerprints on the micro slide. Brushing a fingerprint might seem easyat first, but it is more complicated than ”simply dipping a brush into the jar ofpowder and then painting it onto a surface” [59].

First, the brush was dipped carefully in the jar of powder to load the brush fiberswith some powder. Then, before starting to paint, the brush was tapped againstthe dish to get rid of the excess powder. While letting the brush gently touch thesurface, the brush was moved in the direction of the papillary lines where possible.For some fingerprints, this motion becomes similar to twirling the brush. Care wastaken at this step, not to overdevelop nor erase the latent prints. The trick lies inletting the brush extremely gently touch the surface, and not having superfluouspowder on the brush.

Figure 7.2. A soot powder mixture and a squirrel hair brush were used in the experimentsto enhance the latent fingerprints.

Lifting the fingerprint

Adhesive tape from KTM was used to lift the dusted prints from the glass surfaceto a white piece of paper. This might also seem very easy at first, but proved tobe a bit tricky as well, see section 9.1.1 on page 76.

When applying the tape to the micro slide, a ruler with a piece of cloth on it (toavoid making scratches on the tape), was used. After having applied the tape to


the end of the micro slide, the ruler with the cloth was slid at a constant speed (toavoid folds) over the latent enhanced fingerprints.

When removing the tape from the micro slide, again a constant speed was used toavoid folds on the tape. The tape was then attached to a white paper in the samemanner as when the tape was attached to the micro slide.

Care should also be taken, not to let any grease or dust get attached to any of thesides of the tape. Therefore, make sure your hands are clean.

7.1.2 Photographing the fingerprint

The next step was to photograph the lifted fingerprint. A Minolta DiMAGE 5digital camera was used with the detailed settings described in appendix C onpage 113. Since taking close-up photographs can be very difficult, a tripod wasused so that a lower ISO value could be used. The photos were taken indoors withsome light from outside together with fluorescent lighting. The camera was heldabout 25 cm from the print since that was the closest you could get in macro modewith the camera used.

7.1.3 Image processing

Adobe r©Photoshop r©CS from Adobe Systems Inc., was used for the image pro-cessing performed. To start off with, a picture in jpeg format with the size of1600×1200 pixels, was used. The main steps used in the image processing were thefollowing:

• The image was sharpened with the filter ”unsharp mask”.

• The image was reversed by flipping the canvas horizontally.

• The papillary lines were sharpened and pores were removed with help of thebrush tool.

• The colors of the fingerprint were inverted.

• The size of the image was adjusted to the real size of the image.

• With help of the threshold option, the image was turned black and whiteinstead of being grayscaled.

• Any remaining traces from pores or the soot powder mixture were erased.

Both the reversing and the inverting of the image are needed to make the outcome ofthe etching reversed and inverted, in order to make the gelatin artificial fingerprintidentical to the real fingerprint. Subject S2 has very wide ridges compared to thevalleys. Therefore, the valleys (showing up as black lines) on S2’s fingerprint image,had to be widened a bit to make the etching possible. The detailed description


of the image processing, can be found in appendix C.2 on page 114. Images ofpart of the subjects’ fingerprints before and after image processing, can be foundin appendix C.3 on page 116.

7.1.4 Printing the image

The printer used in the experiments was a HP LaserJet 5Si/5Si MX PS with aresolution of 600 dpi. The picture of the fingerprint was printed on a transparencyfor the etching to work the best.

7.1.5 PCB production

An epoxy laminate, which created a copper thickness of 35 µm, was used for sub-ject S1, and epoxy laminates, which created a copper thickness of 70 µm, wereused for subjects S2 and S3. See section 9.1.5 on page 80, for an explanation ofthe chosen thicknesses.

The epoxy laminate is in fact a copper clad board coated with a layer of lacquer,i.e. photoresist. The photoresist is sensitive to UV light and even though it is notvery sensitive to ordinary light, it should not be exposed to ordinary light for avery long time. [15]

The procedure for the production of the PCB can be summarized as follows:

• The developer and etching solution were mixed.

• The laminate was exposed for 3 minutes in the UV light box.

• A first developing was performed until the pattern appeared. Then, a seconddeveloping was done to get rid of any remaining photo resist. The board waswashed with water.

• The laminate was put in the etching solution, and to keep a temperature ofabout +50◦C (for the best result), the etching bowl was placed in a hot waterbath in the sink. After having stirred for about 10-20 minutes, the board waswashed with water again.

The detailed description of the production of the PCB, can be found in appendix C.4on page 117.

7.1.6 Gelatin solution

This section discusses the choice of gelatin as material to make the artificial fin-gerprints. It also describes how the gelatin solution was prepared and how theartificial fingerprint was made.


Material choice

When making an artificial fingerprint for fooling a fingerprint scanner, the artificialfingerprint need not resemble a real fingerprint to every detail. The main focus liesin getting the same appearance as a live finger would on the scanner’s surface. [3]

In previous studies, a range of different materials have been used, see section 6on page 49. These studies show that different materials work better or worsefor different types of sensors. Knowing what kind of sensor you want to fool isthus an advantage. In this study, many different sensors were tested, and theartificial fingerprints could therefore not be made to fool only one specific sensor.As described in section 6.4 on page 51, gelatin is one of the best materials to createan artificial fingerprint out of.

Making of the gelatin solution

Since the fingerprint scanners can be sensitive to humidity, the same percentageof water as found in the human skin, had to be used in the artificial fingerprints.Therefore, a solution of about 44 % gelatin and 56 % water was used to makethe artificial fingerprints (e.g. 17 g of gelatin together with 21.5 ml of water). Inprevious studies performed, the amount of gelatin has ranged from 40 % to 50 %and since no clear distinction between 40 % and 50 % of gelatin could be found inthe early testing stage, a value in between which was easy to measure, was chosen.

The solid gelatin leaves were soaked in the water in a square plastic container forabout five minutes, and then both the gelatin leaves and the remaining water wasput in a glass jar with the cap on to avoid reducing any water. The glass jar withgelatin and water was then put in a water bath in a sauce pan on a stove. Thesauce pan and contents were heated and the jar was left in the hot water until thegelatin had dissolved. The jar was rotated and moved gently during the dissolvingof the gelatin. A violent moving of the jar caused a lot of air bubbles to form. Airbubbles are not wanted since they would appear on the artificial fingerprint andcould make the fingerprint scanners realize an artificial fingerprint is being used.Sometimes the gelatin formed lumps that were difficult to dissolve, and in thosecases a kitchen knife was used to help stirring.

When the gelatin had dissolved in the water, often there were still air bubbles inthe solution. Heating the solution up (still in the jar in a water-bath) and thenletting it cool down a couple of times made most bubbles disappear.

Making of the gelatin artificial fingerprint

The liquid gelatin solution was poured on top of the mold (see figure 7.3 on page 61)and thinned with help of a knife. The thinner the gelatin fingerprint becomes, themore invisible it will be for any person watching you using it. In these experiments


however, the gelatin was used for quite some time, and it was then easier to handlea somewhat thicker gelatin fingerprint. The thickness of the gelatin prints used inthese experiments, was about 1-2 mm. Less, and it would have been more difficultto peel it off afterwards without destroying the print. A thinner gelatin print wouldalso have been more difficult to handle without destroying the print, and last butnot least, it would have dried out too fast (a gelatin fingerprint had to last about45 minutes in room temperature and humidity).

Figure 7.3. A mold with a gelatin solution on top of it.

The mold with the gelatin solution was placed in a refrigerator for about ten min-utes until the gelatin had stiffened. The gelatin can also be left in room temperatureto stiffen, but it will become drier then. With help of a knife, the gelatin was peeledoff from the PCB. Care had to be taken when peeling the gelatin off from the PCBso it would not be damaged. After having peeled off the gelatin, it was cut witha pair of scissors to a small fingerprint. Some surroundings of the fingerprint washowever left, because of the fingerprint drying out too fast otherwise during thetime consuming experiments. A gelatin artificial fingerprint on top of a live fingeris shown in figure 7.4 on page 62.

The remainder of the gelatin solution can be stored in the glass jar in a refrigeratorfor a couple of weeks, and heated in a water-bath the next time needed. Storinga gelatin solution in the refrigerator for more than a couple of days, will howevermake it go mouldy.


Figure 7.4. A fingertip with a wafer-thin gelatin fingerprint on top of it.

Storing of the artificial fingerprint

The artificial fingerprints were stored in a refrigerator in small film jars with a pieceof moist cloth covering about 75 % of the jar. At the top, the gelatin fingerprintwas placed with the flat side down and the print side turned upwards to avoidmaking the print too moist and risk destroying the pattern. With the lid on, thefingerprint can be stored a couple of days in this environment. After about a week,the gelatin will have gone mouldy, and will soon after that not be able to fool thefingerprint scanners any more.

7.2 Experiments at CeBIT

Some fingerprint systems were tested at the CeBIT trade fair in Hannover, Ger-many, year 2004. The products tested were not chosen due to any special reasons,but simply because they were available and were allowed to be tested.

The gelatin fingerprints brought to CeBIT were made on the 19th of March 2004and tested the two following days. During this period, the artificial fingerprintswere stored in a cool bag in small film jars with a piece of moist cloth, as describedin section 7.1.6 on page 62.

Nine different sensors were tested. The software and security levels (thresholds)used during the experiments are unknown. For each system tested, first subjectS2’s finger was enrolled and identified/verified. Then subject S2’s gelatin artificialfingerprint was tested for identification/verification. If the system could not befooled with S2’s artificial fingerprint in a few tries, subject S1’s fingerprint wastested in the same manner.

7.3 Extensive experiments 63

7.3 Extensive experiments

The extensive experiments were performed with three different subjects and threedifferent fingerprint scanners. For each subject, 50 identifications/verifications wereperformed for each fingerprint scanner, both using their real fingerprints, and usingtwo different copies of their artificial counterparts. The reason for testing twodifferent gelatin prints for each subject, is that the results depend a lot on thequality of the gelatin. The tests with the two different gelatin prints, will bereferred to as round one and round two in the remaining of the report.

7.3.1 Subjects and input

Since there were only three subjects (due to limited experimental time), it was notpossible to get a standardized representation of the population. Still, subjects werechosen depending on age and gender. The subjects varied between 18 and 65 yearsof age and both genders were represented.

In table 7.1, four types of experiments are shown. Matsumoto and colleagues,performed all four types of experiments, see section 6.4 on page 51. In the experi-ments prior to this report, only experiment type number 1 and 2 were performedsince these are the two types of experiments that resemble biometric security sys-tems’ normal use. Experiment types number 3 and 4 are normally used to check ifenrollment of an artificial fingerprint might complicate or simplify recognition [3].

Experiment type Enrollment Verification/Identification1 Live fingerprint Live fingerprint2 Live fingerprint Artificial fingerprint3 Artificial fingerprint Live fingerprint4 Artificial fingerprint Artificial fingerprint

Table 7.1. Possible experiment types. Only experiment type number 1 and 2 wereperformed. [42]

If the FRR was very high for a special subject and fingerprint scanner, the enroll-ment for that subject and fingerprint scanner was redone. The reason being thata poor enrollment may not for example capture the center of the fingerprint, thusforcing the subsequent verifications/identifications to the same type of misplace-ment of the finger.

For each subject, one mold and two different artificial fingerprints were created andused. If the quality of either the mold and/or the artificial fingerprints were notsatisfactory, they were remade.

The identification/verification of both the real fingerprints and the artificial fin-gerprints were performed 50 times for each fingerprint scanner. The verifica-tion/identification attempts were performed while counting the number of times


the system accepted the fingerprint, rejected the fingerprint, or falsely logged inanother person.

Experiment type number 1 is important for showing the FRR. The success rate inthis experiment should be as high as possible, ideally 100 %. This experiment typeresembles the normal use of the fingerprint scanner. In experiment type number 2,the artificial fingerprint should ideally be rejected every time, thus achieving a FARof 0 %.

7.3.2 Software and hardware

The same software and hardware as in the experiments described in [3], were usedin the extensive experiments. Since the fingerprint scanners tested, are marketedat different levels of security and areas of use, a single unifying program could notbe used to test the scanners at equal terms. Instead, the provided software for eachscanner was used.

Both the Targus DEFCONTMAuthenticatorTMand the PreciseTMBiometrics 100MC fingerprint scanners use an electric field sensor, while the Identix fingerprintscanner is equipped with an optical sensor using FTIR with a sheet prism. Moredetailed information about the sensors can be found in appendix D on page 119.

Two of the softwares used, had more than one security level to choose from. Sinceno specific use of the systems was simulated, the default security settings wereused.

BioLogonTMSecurity System & Identix

BioLogonTMSecurity System (version 2.03) for Microsoft Windows, is the softwarethat was used together with the Identix fingerprint scanner. BioLogon replaces thestandard Windows log on process and allows users to use their fingerprints or amaster password instead of remembering a number of passwords for each programand site. [30]

To identify a new user, you have to log off the current session and log on as adifferent user. To speed up the log on/log off process, all unnecessary executableswere stripped from the log on process, and a script was created to automaticallylog off the user directly after having logged on. This also required a registry keyto be added.

BioLogon has three different security settings, and the default setting 2 was usedin the experiments. BioLogon was run on Microsoft Windows XP during the ex-periments.


Softex Omnipass & Targus DEFCONTMAuthenticatorTM

Softex Omnipass (version 1.00.4) is the software that was used together with theTargus DEFCONTMAuthenticatorTMfingerprint scanner. Softex Omnipass’ mainfeature is that you can use a fingerprint (or a master password) to access passwordprotected programs or sites, or log on to a computer using an existent MicrosoftWindows account. Softex Omnipass works with Microsoft Windows based oper-ating systems and during the experiments it was run on Microsoft Windows XP.[52]

It was possible to use standard Windows together with Softex Omnipass to log ona user, but during the experiments, identification in Softex Omnipass was made byfirst clicking on an icon in the system tray and then presenting the fingerprint. Tospeed up the process of having to click on an icon and then on a menu to log in,a macro to perform these operations was used. This allowed a single key on thekeyboard to be used to perform these specific commands.

PreciseTMLogon & PreciseTMBiometrics 100 MC

PreciseTMLogon (version 2.1) is the software that was used together with thePreciseTMBiometrics 100 MC fingerprint scanner. Precise Logon is a demonstra-tion software that had to be run on Microsoft Windows 2000, but it has full featureswhen it comes to logging on [3]. The software does only work in verification mode,thus making it impossible to compare the FAR with the other scanners used in theextensive experiments. Precise Logon gives feedback if an incorrect placement ormoisture level is used during enrollment or verification.

Precise Logon is integrated in the Windows log on process. Like the time issuesbetween trials discussed in section 7.3.2 on page 64 concerning the testing of Bi-oLogon, the same problems arose when using Precise Logon. Since the softwarecould only be used in verification mode, only one session had to be stripped ofexecutables started at log on. Using an automatic log off script was not possibleusing Microsoft Windows 2000 [3].

Precise Logon has 7 different security levels, and the default setting 4 was usedduring the experiments.

7.3.3 Experiment procedure

Prior to the real experiments, the subjects tried the different systems under super-vision to learn how to place and press their fingers on the sensors to get acceptableimages of the fingerprint. This way, unfamiliarity with the systems as an erroneoussource, could be excluded.


After having learnt how the scanners worked to get accepting results, the subjectswere however allowed to use their own techniques when presenting the finger to thescanners. This way, a normal working environment was simulated.

During enrollment or identification/verification, the subject (or the tester), pre-sented the real fingerprint (or the artificial fingerprint) so that it suited the centerof the scanning area of the fingerprint scanner.

Enrollment

The subjects’ right index finger, were enrolled into the systems. The enrollmentwas performed with the provided software for each fingerprint scanner, with theirprovided specifications, see section 7.3.2 on page 64. The enrollment was alsosupervised carefully and each user’s enrollment was verified by logging onto thesystem once, making sure the finger was enrolled properly.

Identification/Verification

In experiment type number 1 in table 7.1 on page 63, the subjects presented theirown fingerprint under supervision as they were taught during the initial phase.The supervisor surveyed and counted the number of successful logins, the numberof false rejections, and the number of erroneous identifications.

In experiment type number 2 in table 7.1 on page 63, the tester presented theartificial fingerprints to the fingerprint scanners. This way, the time each subjecthad to spend on the experiments, was minimized. It also ensured that the identifi-cations/verifications of the artificial fingerprints, were performed in the same wayfor all fingerprint scanners and subjects.

In the first round, no special testing order between the scanners was used, butsince the order might have affected the results, it is presented in table 7.2. In thesecond round, the Precise scanner was always tested first because of the results inthe first round which showed that the right humidity of the gelatin print was veryimportant to be able to fool the Precise scanner.

Subject Round one Round twoS1 Precise, Identix, Targus Precise, Identix, TargusS2 Targus, Identix, Precise Precise, Targus, IdentixS3 Targus, Identix, Precise Precise, Identix, Targus

Table 7.2. Testing order for the scanners in round one and two. The scanners are writtenin the order they were tested, with the scanner which was tested first written first. Inthe first round, no special order was chosen, but the order is simply a coincidence. Inthe second round, the Precise scanner was always tested first because of the results in thefirst round.

Chapter 8

Results

The results from the experiments performed will be presented in this chapter. Allthe data in the diagrams, can be found in numbers in appendix F on page 123.

8.1 CeBIT

The results from the experiments at CeBIT are shown in table 8.1 on page 68. Ninedifferent sensors were tested. For each system tested, first subject S2’s fingerprintwas enrolled and identified/verified. Then S2’s gelatin artificial fingerprint wastested for identification/verification. If the system could not be deceived withS2’s artificial fingerprint in a few tries, subject S1’s fingerprint was tested in thesame manner. In other words, S1’s fingerprint was only used when S2’s artificialfingerprint was not able to circumvent the system. All the systems in table 8.1on page 68, were deceived with either S2’s artificial fingerprint or S1’s artificialfingerprint.

One electric field sweeping sensor, one capacitive sweeping sensor, and one thermalsweeping sensor, were tested and all three were circumvented. However, the testedsweeping sensors all required S1’s artificial fingerprint to be used, since S2’s artificialfingerprint was not able to deceive the sweeping sensors in a few tries. In all othercases, S2’s artificial fingerprint was enough to deceive the systems.

67

68 Results

Type of sensor Defeated with subjectOptical FTIR S2Optical FTIR with a sheet prism S2Solid-state Capacitive S2Solid-state Capacitive (sweeping) S1 (not S2)Solid-state Thermal (sweeping) S1 (not S2)Solid-state Electric field S2Solid-state Electric field S2Solid-state Electric field S2Solid-state Electric field (sweeping) S1 (not S2)

Table 8.1. Results from attacks with artificial fingerprints at CeBIT. Nine fingerprintsystems were tested and all systems tested were deceived either with subject S2’s artificialfingerprint or subject S1’s artificial fingerprint.


The results from the the extensive experiments, experiment types 1 and 2 in ta-ble 7.1 on page 63, will be presented in this section, both in numbers and inpercentage. The number of successful logins with the subjects’ real fingerprints,serves as a control when comparing with the number of false acceptances with thesubjects’ artificial fingerprints.

For each subject, 50 identifications/verifications were performed for each fingerprintscanner, both using their real fingerprints, and using two different copies of theirartificial counterparts. The tests with the two different gelatin prints, are referredto as round one and round two.

8.2.1 Results in numbers

In figure 8.1 on page 69, the number of successful logins with real fingerprints,is shown. The number of trials were 50 for each subject and fingerprint scanner.Since no false acceptances occurred during this type of experiment, the remainingnumber of trials were falsely rejected.

The values for the verification/identification trials with real fingerprints, can becompared with the values from the trials with artificial fingerprints. The numberof false acceptances using both rounds of artificial fingerprints, is shown in figure 8.2on page 70. In the experiments with subject S3’s artificial fingerprint during roundone, there was one occurrence of a false acceptance as another user. S3’s artificialfingerprint was falsely accepted as subject S1 one out of 50 times during the trialswith the Targus DEFCONTMAuthenticatorTMfingerprint scanner, during the firstround. Apart from this, there were no other false acceptances as other users, andthus the remaining number of trials were correctly rejected.


Notice that the number of false acceptances using artificial fingerprints, was in-creased for both subject S2 and S3 on all scanners from round one to round two.For S1, the number of false acceptances using artificial fingerprints, was decreasedsomewhat from round one to round two.

Figure 8.1. The number of successful logins with real fingerprints for each of the sub-jects and for each fingerprint scanner tested. The number of trials for each subject andscanner was 50, and since no false acceptances occurred during this type of experiment,the remaining number of trials were falsely rejected.

70 Results

(a) Round one.

(b) Round two.

Figure 8.2. The number of false acceptances with artificial fingerprints for each of thesubjects and for each fingerprint scanner tested during round one and two. The number oftrials for each subject and scanner was 50. One false acceptance as another user occurredduring round one (subject S3’s artificial fingerprint was once logged in as subject S1 on theTargus fingerprint scanner), and the remaining number of trials were correctly rejected.No false acceptances as other users occurred during round two.


8.2.2 Results in percent

The number of successful logins shown in figure 8.1 on page 69, give the successrates shown in figure 8.3. Ideally, the success rate should be 100 %, the FRR 0 %,and the FAR 0 %. In a real situation, this is however impossible. Still, the FRRand FAR should be kept as low as possible. A high FRR is not a security threat,but can be very annoying for the user. A FRR around 10 % or lower is consideredacceptable. A high FAR is a serious security threat.

Figure 8.3. The success rate with real fingerprints for each fingerprint scanner tested.The mean values of all subjects are shown for each scanner. The FARs for all scannerswere 0 %. The number of trials for each subject and scanner was 50.

The FARs for artificial fingerprints during both rounds, are shown in figure 8.4 onpage 72. Ideally, both the FAR with artificial fingerprints and the FAR that occurswhen being logged in as another user, should be 0 %. The rejection rate shouldideally be 100 % when trying to log in with artificial fingerprints. In both rounds,there were cases where the FARs with artificial fingerprints were as high as 100 %.

72 Results

(a) Round one.

(b) Round two.

Figure 8.4. The FAR with artificial fingerprints, for each fingerprint scanner testedduring round one and two. The number of trials for each subject and scanner was 50during both rounds. During round one, the FAR as another user was 0 % for the Identixscanner and the Precise scanner, and about 0.7 % for the Targus scanner.


Round one

In the first round of experiments performed with artificial fingerprints, the FAR asanother user was 0 % for the Identix fingerprint scanner and the Precise fingerprintscanner. There was one occurrence of a false acceptance as another user during thefirst round, making the FAR as another user about 0.7 % for the Targus fingerprintscanner. The FAR with artificial fingerprints during round one, was greater than0 % for all subjects on all fingerprint scanners except for subject S2 and S3 onthe Precise fingerprint scanner. The other FARs with artificial fingerprints variedbetween 66 % and 100 %, depending on the subject and scanner.

Round two

In the second round of experiments with artificial fingerprints, no false acceptancesas other users occurred, making the FAR as another user 0 % for all scannersand subjects. The FARs with artificial fingerprints were greater than 0 % for allsubjects and scanners in the second round. Except for the FAR of 12 % for subjectS2 on the Precise scanner, all FARs were greater than 82 % in the second round.

Mean values

The mean values in percent for all fingerprint scanners and subjects, for real andartificial fingerprints, for both rounds, are shown in figure 8.5 on page 74.

The mean value of the success rate using real fingerprints was 90 %, and the meanvalues of the FAR with artificial fingerprints were 67 % in the first round and 86 %in the second round.

74 Results

Figure 8.5. Mean values, in percent, for real and artificial fingerprints (both rounds).

Chapter 9

Discussion and analysis

This chapter discusses and analyzes the method used and the results acquired inthe experiments. Results acquired in previous studies in the same field, will becompared and put up against the results acquired in these experiments.

9.1 Experiment method

Since the experiment method used, includes so many steps and a lot of material,there are plenty of ways to optimize the method. Some steps and material seemhowever more important or difficult to improve than others. For example, thedusting with soot powder mixture, can be improved. Small black particles gotattached not only to the ridges where they should, but also at some points inthe valleys. Even the world’s best camera equipment can not improve a poorenhancement.

9.1.1 Enhancing the fingerprint

The material used to enhance latent fingerprints can be easily found and boughton the Internet. By searching on the Internet for ”fingerprint kit”, ”soot powder”etc., you find many links to companies selling fingerprint enhancement products.Even though some companies might reject orders from private people, there arecompanies that do accept them.

Powder

A few other powders were tried before finding the soot powder mixture used inthe experiments. Only one of the other powders, a graphite powder, did provide

75

76 Discussion and analysis

a somewhat satisfiable enhancement. Graphite powder makes the fingerprint lookmore gray than using the soot powder mixture. The grayish look from the graphiteis however a smaller problem than the blurriness and indistinctness, which thegraphite powder produces. Using soot powder mixture makes the fingerprint muchmore indistinct. The reason is probably that the soot powder mixture was morefinely ground than the graphite powder used.

In [53], photocopier powder was used and the results (FAR with artificial finger-prints about 2 %) show that it is possible to create an artificial fingerprint fromthis. However, the authors in [53] suggest using another powder for improved re-sults. This still shows that easily obtainable powders can be used to make a forgedfingerprint.

Brush

As with the powders, a few different brushes were tested before finding the squirrelhair brush used in the experiments. The first brush that was tested cost 3.50 SEKand was made from an unknown material. The second brush that was testedcost 17 SEK and was made of imitated marten hair. The second of these didproduce somewhat better enhancements than the first brush, but the difference wassmall. None of the above mentioned brushes did however produce the same goodenhancement as the squirrel hair brush from KTM. A feather duster from KTMwas also tried, but since it tended to carry too little powder, it was discarded. Notethough that there are times when little powder is better [59].

The following two quotes from [1], show the importance of having a good brushand taking care of it:

In powdering fingerprints, a fine quality brush is indispensable. Stiffhairs can damage papillary ridges and a very soft brush should thereforebe used.

Brushes need to be replaced from time to time, since in use, they in-evitably absorb greasy substances and begin to pick up too much pow-der.

In ordinary hobby shops, you can also find softer and better brushes than the cheapones mentioned above. So, even if it was not possible to order forensic fingerprintenhancement products, it would be possible to get hold of a good brush. They arehowever more expensive than the forensic brushes.

Lifting with tape

The biggest problem when lifting the prints, were the bubbles which formed bothwhen applying the tape to the latent print, and when applying the lifted print ontothe paper. Two solutions were found to this problem. The first solution includes

9.1 Experiment method 77

using a good tape. The tape from KTM used in these experiments proved to bebetter than ordinary office tape. The second solution includes using a ruler to geteven pressure, both when applying the tape to the micro slide, and when applyingthe lifted print to the paper. Unfortunately, this introduced another problem,namely scratches made by the ruler on the tape. To solve this problem, a soft pieceof cloth was held between the tape and the ruler.

Another problem with the tape are the folds that formed both when applying thetape to the micro slide and when applying the lifted print onto the paper. Thisproblem was solved by sliding the ruler over the tape at a constant speed and neverstopping before being finished (or stopping in between different fingerprints).

The tape used can be ordered with a tape holder which might help against thebubbles. This was however not tried.

Instead of using tape to lift the fingerprint, you can use MikrosilTM(can be foundat forensic Internet shops) which seems easier to use, but also more expensive. Thiswas not tried either.

Further ideas

In [59], a way to enhance a fingerprint is described, which includes using a qualityfiberglass brush and a gentle grinding of the powder using a rotating motion bytwirling the brush handle slowly between the thumb and index finger. There are anumber of ways to enhance a print with a brush and a powder, and this work oftenrequires a lot of experience to make a good enhancement.

One of the problems with the enhancement of the fingerprint, is the lifting part.To eliminate this problem, you could put a white paper or liquid behind the glassand take photos of it directly without lifting. This would only be possible for somesurfaces however. For example, a colored glass plate introduces problems, and theglass having an irregular shape could make it more difficult to get a good picturewhen taking the photo.

Instead of dusting the print with a powder and then lifting, the enhancement couldbe done chemically. In most forensic laboratories (at least in Sweden) today, theyuse mainly chemical methods to enhance latent prints. Cyanoacrylate fuming, de-scribed in section 3.4.1 on page 20, is one of the methods that could be performedat home with easily available material. Cyanoacrylate fuming was therefore con-sidered for these experiments, especially since it was used in the experiments byMatsumoto and colleagues. After a few initial tries, it was however discarded sinceit is a dangerous method and it seemed to require more time than available.


9.1.2 Photographing the fingerprint

Instead of enhancing the latent fingerprint, which introduces many problems, thelatent print could have been photographed directly. The following method wassuggested by Ulf Soderholm, a Swedish criminal photographer [13]:

In a room with little light, put a black plate about 50 cm behind themicro slide and photograph with a light beam against the print. A flashlight might be used if no flash or halogen lamp is available.

Despite the problem of making the latent print visible, this can be a bit tricky ifthe surface is curved or colored for example.

When taking photos of the fingerprint, it is a good idea to have a millimeter scaleby the print. Tape rulers with a millimeter scale can be bought at forensic internetshops. When measuring the size of the fingerprint, a good idea is to measurebetween two characteristic points [53].

Instead of taking photos of the print, a scanner can be used to scan the fingerprint.With a very good scanner, this could become almost as good as when using acamera. One advantage of this is the 1:1 scale you immediately get with thescanner. However, with the right camera equipment, this is also possible.

If the forgery is worth a lot of money, the forger might be willing to spend a lotof money on the equipment used to make the forgery. A digital camera for latentfingerprints with fingerprint enhancement software and toolboxes, is available atMason Vactron [40].

9.1.3 Image processing

This section discusses the choices made during the image processing phase and howthese choices could have affected the results.

The procedure used

A difference of about 0.5 mm in size of the artificial fingerprint’s height did notseem to matter to the sensors. This means that the measurement of the print’ssize with an ordinary office ruler should make no difference than measuring with amore exact measuring tool.

Some parts of the images were so diffuse that the fingerprint pattern had to beguessed or left diffuse. If it was easy to guess the pattern, or if any other enhancedprints were available with that particular part of the print more distinct, the patternwas guessed. Otherwise, the diffuse part of the print was left untouched. If a correctguessing was made, the FAR for the artificial fingerprints was probably increased.If an incorrect guessing was made, the opposite was probably the case.


The image processing of the enhanced fingerprints could be done in a lot of ways,and the procedure used for these experiments is only one of them. Especially, theoptions ”levels”, ”threshold” and ”brightness/contrast” could be used in differentways to improve the image even more.

When laying your finger on a fingerprint sensor with a quite small area size, onlya part of the fingerprint is scanned. If the enrollment has been performed in the”right” way, the most important part of the fingerprint, the middle, was positionedin the center of the sensor. Therefore, the image processing of the fingerprint shouldbe more important closer to the middle of the print. This could have had the affectthat a less thorough image processing of the edges of the fingerprint image, wasmade.

Pores

To the author’s knowledge, none of the tested fingerprint systems check pores toidentify/verify a user. If a fingerprint system was constructed to also include theposition and size of the pores as an identification/verification tool, it would bemuch harder to construct an artificial fingerprint that would fool that system.

Out of curiosity, an artificial fingerprint was created where the pores were tried tobe kept. Neither the enhancement procedure, the photographing of the enhancedfingerprint, nor the image processing, seemed to be a problem. The problem oc-curred when producing the PCB. Even though the copper thickness of 35 µm wasused, the pores would not be rendered as clearly on the PCB, as in the mask. Apoint should be made here that subject S2’s fingerprint was used for this procedure.Rendering the pores on the mold could be more difficult or easy depending on thespecific fingerprint.

Automatizing

Since each fingerprint image is unique, it is difficult to make an image processingguide to be used on all prints. In fact, it would be more optimal to process eachimage individually depending on the characteristics of that particular image. Inthe image processing performed in these experiments, a combination of individuallydesigned image processing and a standardized image processing, was used.

Another way to look at the image processing could be from the automatizationpoint of view. For example, why not put the image up for automatic binarization,thinning etc., and then widening the papillary lines again depending on either astandard value or by using a measured width of the papillary lines before thin-ning together with how close the papillary lines are situated. This way, the timeconsuming image processing could be used in a mass production.


9.1.4 Printing the image

The resolution of the printer and the color of the toner in the printer are the twomost critical points at this stage. The greater contrast between the fingerprint andthe background, the better. Also, with a higher resolution of the printer, you geta more detailed and better print-out. The resolution of the image could of coursealso be a bottle-neck, but was not in this case.

9.1.5 PCB production

Epoxy laminates, which created copper thicknesses of 35 µm, 70 µm, and 105 µmwere available. The 105 µm thickness was discarded since the very small detailsof the fingerprint were difficult to etch that thick. A few tries were made withthe remaining thicknesses and no clear difference could be found between the two.The quality of the etched fingerprint changed with different etchings. For subjectS1, the 35 µm copper thickness was chosen, since the etching was somewhat betterlooking than the etching with the 70 µm copper thickness. For S2 and S3, noclear difference could be seen between the two, and the 70 µm copper thicknesswas therefore chosen, because the probability of the gelatin papillary lines to smeartogether on the sensor because of heat, should be less.

The etching of the mold introduced some problems in the production of the artificialfingerprints. First of all, the etching time was critical. Under- or overdevelopment,as well as under- or overetching, made the mold look different from the fingerprinton the transparency.

Another problem with the etching occurred when etching many prints at the sametime. With a board of about 10×10 cm, the edges were etched first and thusacquired a shorter etching time than the middle of the board which was etchedlast. The solution to this problem was cutting the board into smaller pieces andetching fewer prints at the same time. Etching only one print on a suitable boardsize is optimal from this point of view.

Papillary lines that are equally wide and with an equal or comparably big distancebetween them, will simplify and make the etching less critical. In other words,some fingerprints are easier to etch than others.

The etched mold can be stored and used over and over again. A few things canhowever lower the quality of the mold. First of all, the mold should be kept awayfrom grease, dust, etc. Secondly, when using the mold to make a number of gelatinfingerprints, small parts of the gelatin can get stuck in between the copper edges.Two solutions were found to this problem. Firstly, the gelatin should be lifted fromthe mold as soon as the gelatin has stiffened, i.e. do not try to lift it too early,and do not let it set for too long time. Secondly, the gelatin solution should notcontain too much water (not stating what amount that is).


If the mold would become damaged, it is still quite easy to make a new one reusingthe same transparency.

9.1.6 Gelatin solution

This section will discuss the problems with making a gelatin solution with the rightwater amount, and then being able to maintain the right humidity of the gelatinartificial fingerprint.

Water amount

The exact amount of water in the gelatin solution was difficult to check. Since thegelatin leaves were soaked in water in another container before pouring them intothe glass jar, some water could have got stuck to the first container. The reasonfor using first one container, and then a glass jar, was that the glass jar did nothave a shape to fit stiff square gelatin leaves. One solution to this problem is tosimply skip the soaking of the gelatin leaves. Another solution could be to use aglass jar with a square shape to be used for both purposes. Square glass jars arehowever not as easily found as round glass jars.

Water also evaporated during the process of heating and cooling the gelatin solu-tion. This was done both when reducing bubbles, and later on when heating thegelatin solution a number of times to be used for different artificial fingerprints.

Humidity

After having worked with the gelatin solution and gelatin artificial fingerprints fora while, you might start to recognize when they are of good or bad quality. Themost critical point here is the humidity of the gelatin print. When working witha thin (thickness of about 0–2 millimeter) gelatin fingerprint, it dries out very fast(both in room temperature and in the refrigerator). Storing the gelatin print in ahumid film jar, as described in section 7.1.6 on page 62, is a very good idea. Whenusing the artificial fingerprint for one or a few times, it will not have time to dryout. However, when using the print for about 45 minutes as in the experiments,this problem occurred and could probably have lowered the FARs for artificialfingerprints. When you need to take the gelatin out of the film jar, and beforeusing it on a fingerprint scanner, one good way to store it is in your hands becauseof the sweat pores creating a humid environment. However, if you have very warmhands, this could destroy the pattern.


9.2 Experiments at CeBIT

After having finished the experiments at CeBIT, a few aspects about the actualexperiment method can be discussed. It would have been interesting to test bothsubject S1’s and subject S2’s artificial fingerprints on all systems tested. This wouldhowever had taken up even more time from the exhibitors, and some exhibitorscould have found this inconvenient. Therefore, only S2’s artificial fingerprint waschosen to test the systems at first, and if not successful, S1’s artificial fingerprintcame into use. The results would probably have looked different if S1’s artificialfingerprint had been tested first.

The artificial fingerprints tested at CeBIT were only tried a few times on eachsensor. This is not enough to draw any statistical conclusion of the security of aspecial sensor. However, it is enough to show that it is possible to defeat the sensorusing an artificial fingerprint.

If a protection against attacks with artificial fingerprints is to be included in asystem, the most obvious place is at the sensor level. It should not be forgottenhowever, that it could be possible to produce a software which gives enough pro-tection. It is therefore not totally fair to only state what sensors that were testedand leave out the softwares.

Not a single system was found at CeBIT that could not be circumvented, eventhough some companies claim that their products are safe against this type ofattack. Using a sweeping sensor, is not safe either, as will be evident in the followingsubsection.

9.2.1 Sweeping sensors

The sweeping sensors produced a somewhat more difficult situation than the or-dinary touch sensors. More friction is produced when sweeping a gelatin artificialfingerprint, than sweeping a live finger on a sweeping sensor. After having tried afew times, the sweeping technique needed for the gelatin was however learned anda good quality image was achieved. The first time a sweeping sensor is used witha live finger, it also requires some training to learn the sweeping technique.

Interesting to note is that the three tested sweeping sensors (one electric field,one capacitive, and one thermal), all required subject S1’s artificial fingerprint tobe used. The reason why subject S2’s artificial fingerprint could not deceive thesweeping sensors tested, could be a few different ones:

• The storing of the prints for about two days. Both S1’s and S2’s artificialfingerprints were however stored and should have been exposed to the samekind of conditions. Still, no identical environment was used for the two prints.

• Since S2’s fingerprint always was tested first, S2’s artificial fingerprint wassubject to more dirt and could have been worn out more than S1’s artificial


fingerprint.

• S2’s fingerprint has very wide ridges as compared to the valleys, and willtherefore produce a print which is more difficult to recognize regardless ofwhether the live finger is used or whether an artificial fingerprint is used. Thisalso made it more difficult to perform the image processing of the print if nota very exact enhancing method was used (and dusting cannot be consideredas one of the most exact enhancing methods).

• When S2’s fingerprint was dusted with soot powder mixture, some parts ofthe fingerprint got blurry. It was thus almost impossible to guess how thelines formed at those points, and especially at one point, it was extra difficult.Those places of the print that were somewhat blurry and especially those thatwere placed close to the middle of the print, could have affected the outcomeof the acceptance/rejection decision by the scanner. It is however somewhatstrange that only the sweeping sensors would have problems with this.

• It is more difficult to get a good picture with a sweeping sensor than usinga touch sensor. Combining that difficulty with using an artificial fingerprintwith somewhat bad quality as S2’s artificial fingerprint was (at least comparedto S1’s artificial fingerprint), this could be the reason of the results.

• The surroundings of S2’s artificial fingerprint were not black on the trans-parency used for etching, but S1’s were. This resulted in a surrounding ofcopper in S1’s print, and thus lower parts on the gelatin (the same height asvalleys in the print).

• A combination of all of the above.


This section discusses and analyzes the method used in and the results acquiredfrom the extensive experiments.

The fooling of the fingerprint systems often occurred in the beginning of the trials.This indicates that the quality of the artificial fingerprints is important.

9.3.1 Experience

Both subjects S1 and S2 got experience from using fingerprint scanners on theCeBIT trade fair. S2 also had experience from using the three tested fingerprintsystems before the actual tests began. Both these things could have affected theresults by increasing the success rate with their real fingerprints.

The tester also got a lot of experience from the fingerprint scanners because whiledeveloping the artificial fingerprints, they were tested on the same scanners to be


used during the extensive experiments. Also, when you try the same gelatin fin-gerprint on a scanner a number of times after each other, like in these experiments,you can get used to the way you should place the fingerprint in order for the systemto accept it. In a real-world case, you might not have access to the scanner andcan therefore not get this experience.

The tester had seen about 150 trials done by each subject before the tester per-formed the experiments with the subjects’ artificial fingerprints. Being able towatch the way each subject presented his/her finger could have influenced the testerand thus affected the results by giving a higher FAR with artificial fingerprints.

9.3.2 Subjects

The subjects were not obligated to lift their hands from the table between thetrials. Lifting only the finger could make the finger placement on the sensor moresimilar between different trials, than it would if the whole hand was lifted. Liftingthe entire hand would probably have imitated a real life situation more and wouldprobably have given a somewhat lower success rate.

The subjects were not obligated to wash their hands before the testing began. Thisway it resembled a real life situation, both when it comes to presenting a finger toa fingerprint scanner, and when it comes to leaving a latent print on a surface.

The subjects’ right index fingers were checked for scars and dirt before the testingbegan. If any scars or dirt would have been found, the right middle finger wouldhave been chosen instead. This was however not the case for any of the subjects.Avoiding scars and dirt on fingers used in the experiments, eliminated one of theuncertainty and erroneous factors.

S3’s print had many minutiae points, especially in the upper part of the print.This could affect how easy/difficult it is to forge a fingerprint. S3’s enhanced printwas however very diffuse in the middle, thus making it very difficult to get a goodmold. Also, S3’s print was a lot bigger than S1’s and S2’s prints, thus making thecenter of the fingerprint even more important on the artificial fingerprint (since thesensing areas were comparably small).

9.3.3 Initial test results

Since the extensive experiments were performed after the CeBIT experiments, bothsubject S1 and subject S2 had got used to a lot of different fingerprint scanners andthe way their fingers should be presented in order for the scanners to successfullyidentify/verify them. This has most certainly affected the results. In fact, S2 alsotried two of the scanners 50 times each, before going to CeBIT. These tests wereonly performed as a check while developing the gelatin artificial fingerprints andwere initially not intended to be used for any real experiments. The results are


however interesting so they cannot be left out at this point. The results are shownin figure 9.1. The same enrollment was used as in the real extensive tests performedlater. For the PreciseTMBiometrics 100 MC scanner, the exact same method, asdescribed in section 7.3.3 on page 65, was used. For the Identix scanner, onlyverification was tried by locking the computer, and then logging in again.

Figure 9.1. Results of unofficial tests with subject S2 prior to the CeBIT trade fair.S2 tried verifying 50 times each for the Identix scanner and the PreciseTMBiometrics 100MC scanner. The same enrollments as in the real tests were used.

The results in figure 9.1, can be compared with the results in figure 8.1 on page 69.The improvement from the initial results to the official results, could be a result ofincreased familiarity with the systems and how to present the finger in the best wayfor the scanners to successfully identify/verify him/her. The improvement couldalso depend on the humidity condition of S2’s finger.

If you can learn how to successfully log in to a system with a live finger, it shouldalso be possible to learn how to log in to a system with an artificial fingerprint.Since the tester got experience with presenting artificial fingerprints to the scanners,this could have affected the results.

9.3.4 The A/R value

When comparing the results from the extensive experiments, it is interesting to lookat the ratio between the FAR for the artificial fingerprints and the success rate forthe real fingerprints. For example, if a low success rate for real fingerprints is


achieved, the FAR with artificial fingerprints will probably also be low. Therefore,the new term Artificial/Real value, or simply A/R value, is introduced and definedin definition 9.1.

Definition 9.1

A/R value =FAR for artificial fingerprint

Success rate for real fingerprint

This assumes that the success rate is greater than 0 %, or the A/R value will beundefined.

In most cases, the success rate for real fingerprints will be greater than the FARfor artificial fingerprints, thus giving an A/R value between 0 and 1. A value closeto (or equal to) 1 means that the artificial fingerprint was falsely accepted almost(or the same) number of times as the real fingerprint was correctly accepted. Avalue close to 0 indicates that the artificial fingerprint was of bad quality. A valuegreater than 1 means that the FAR for the artificial fingerprint was greater thanthe success rate for the real fingerprint. If the success rate for the real fingerprintfor some reason happens to be 0 %, the A/R value is undefined.

The A/R value for the different subjects and scanners are shown in table 9.1 andtable 9.2 for round one and two respectively.

Subject S1 Subject S2 Subject S3Identix 1.02 0.66 0.83Targus 1.00 0.70 0.92Precise 1.00 0.00 0.00

Table 9.1. The A/R value for all subjects and all fingerprint scanners tested in theextensive experiments. Values from round one have been used.

Subject S1 Subject S2 Subject S3Identix 1.00 0.92 1.06Targus 0.98 1.00 0.96Precise 0.94 0.35 0.93

Table 9.2. The A/R value for all subjects and all fingerprint scanners tested in theextensive experiments. Values from round two have been used.

In the first round, two A/R values were zero due to no success with the artificialfingerprints. Except for those cases, all A/R values were above 0.66. In the sec-ond round, all A/R values except for one, were above 0.92. This clearly showsthat results were improved from round one to round two. The reasons for thisimprovement are mainly two:

• The quality of the gelatin solution: After having worked with gelatin artificialfingerprints for a while, you start recognizing when the solution is of good


quality, i.e. has the right concentration of water etc. Different batches ofgelatin solutions were used in the different rounds. In the first round, theend of one batch was used, and in the second round, the beginning of anotherbatch was used. Originally, both batches had the same ratio of gelatin andwater, but as the gelatin solution is heated and cooled a number of times andthen used for making prints, the gelatin-water ratio changes. The qualityof the gelatin solution used during round two, was therefore better than thequality of the gelatin solution used during round one.

• The experience of the tester : The tester got experience to use specific sub-jects’ artificial fingerprints on specific fingerprint scanners. For example,subject S3’s artificial fingerprint had to be presented in a certain way toget accepted. This was however already learned during the first round, butcould still have affected the results. The tester also learnt from the firstround in which order to test the fingerprint scanners to get the best results.The PreciseTMBiometrics 100 MC scanner required a more exact concentra-tion of water in the gelatin solution than the other two scanners seemed todo. Therefore, from having had no specific order between testing the scan-ners in the first round, the second round always started with testing thePreciseTMBiometrics 100 MC scanner.

Except for these two differences, the circumstances were comparable between thetwo rounds.

The A/R value of 1.02 in round one and the A/R value of 1.06 in round two, bothfrom the Identix fingerprint scanner, show that artificial fingerprints can in fact bebetter than using real fingerprints. The probable reason is the experience of thetester from using both artificial fingerprints and using fingerprint scanners, and thelack of experience from the subjects of using fingerprint scanners. Also, it confirmsthe ideas presented earlier about the possibility to learn how to get high acceptancerates, both when it comes to artificial fingerprints and real fingerprints.

None of the tested fingerprint scanners was impossible to fool with the subjectsused, even though one system could not be fooled by two of the subjects in thefirst round. The overall results improved to round two, except for subject S1,which lowered somewhat. Except for the one A/R value of 0.35 in round two, allother A/R values in round two were above 0.92. This is extremely high valuesand clearly shows that artificial fingerprints made from latent prints are a serioussecurity threat to fingerprint recognition systems.

The reason for the comparably low A/R value of 0.35 could be discussed. Sub-ject S2’s fingerprint is quite small and has quite wide ridges. This made the pro-cess of making an artificial copy quite complicated compared to the other subjects.As mentioned in section 7.1.3 on page 58, S2’s valleys (appearing as black linesin the image) had to be widened to be able to make a good etching of the print.Also, it must be noted that S2 was the user who had problems logging in on thePreciseTMBiometrics 100 MC scanner with the real fingerprint (even after having


reenrolled the finger). Therefore, it is not that surprising that it was difficult tolog in with the artificial fingerprints on the same system. Remembering how theinitial test results looked, shown in figure 9.1 on page 85, it would be interesting touse these values to calculate the A/R value instead. The A/R value for subject S2on the Precise scanner, round two, would be 0.75 if the initial test results wouldhave been used to calculate it. Taking this into account, all A/R values would beabove 0.75 in the second round.

Subject S3 had a A/R value of 0 during the first round when testing the PreciseTM

Biometrics 100 MC scanner. Since the A/R value for S3 was as high as 0.93 for thesame system in round two, the low value in round one was probably due to a badquality of the gelatin print. Since the Precise scanner was tested last in round onefor subject S2 and S3, the gelatin print had probably dried out too much, whichwas not the case in round two where the Precise scanner was tested first.

9.3.5 Comparison with results from previous studies

During the first round, the FAR with artificial fingerprints was 0 % for two subjectson the Precise scanner. Except for that, all FARs were above 65 % in the first round.In round two, the FAR for subject S2 on the Precise scanner was 12 %. Except forthat, all FARs were above 81 %. This can be compared to all FARs for artificialfingerprints above 67 % in [42]. In [42], no subjects nor fingerprint scanners wereused that showed the same low success rate as S2 did with real fingerprints on thePrecise scanner in these experiments. Taking that into consideration, and thereforemainly looking at the other FARs in these experiments, the results are similar tothose in [42]. It should however be noted that the highest security settings wereused in [42], while the default security settings were used in the experiments priorto this report.

Interesting to note is the results presented in [53], which also tested one of PreciseTM

Biometrics’ scanners. The FAR with artificial fingerprints acquired in those exper-iments, was 2 %. This value can be compared with the mean values acquired inthese experiments on the PreciseTMBiometrics 100 MC scanner. The mean FARvalue in the first round was 33 % and in the second round 62 %. The low resultsacquired in [53] could be due to lack of good equipment (powder and brush).

In [3], artificial fingerprints were made with the legitimate user’s cooperation, andthey were accepted about 25–50 % of the time. The mean value of FARs in [3]for all artificial fingerprints and tested scanners, was 38 %. This can be comparedwith the mean values of FARs with artificial fingerprints of 67 % and 86 % foreach round respectively. This is quite interesting to notice since the exact samefingerprint scanners have been tested, and the method used in these experimentsis a lot more complicated than the method used in [3]. Using different subjects hasof course affected the results and makes it a bit more difficult to compare them.Still, the conclusion can be drawn that it is easier to affect the result to a greater

9.4 Additional comments about artificial fingerprints 89

extent when using a latent fingerprint than making a mold directly. For example,if a bad picture has been taken of the enhanced print, it is possible to make it alot better using an image processing software.

9.4 Additional comments about artificial finger-prints

This section discusses some of the additional problems connected to creating arti-ficial fingerprints from latent fingerprints.

9.4.1 Finding a quality latent fingerprint

It is not a trivial task to find a good quality latent fingerprint. First of all, theintruder has to know the whereabouts of the legitimate user. Secondly, the legiti-mate user must leave a latent with a suitable pressure, without the finger slipping,and with most of the fingerprint touching the surface. The flatness of the surfaceis also an issue. [41]

The latent prints that were the starting point of the experiments, were clearlyvisible and of good quality. In real life, all latent prints are not of such goodquality. Still, we leave about 25 latent fingerprints every day that are of goodquality, so the assumption is not totally off track.

9.4.2 Alternative acquisition of fingerprint image

There could be other ways to get hold of the image of someone’s fingerprint. Forexample, in a fingerprint system, the fingerprint image information could be inter-cepted on the communication channel, or requested by a Trojan horse server. Thepossibility of synthesizing a two-dimensional fingerprint image from a fingerprintminutiae template could however be questioned. Chris Hill showed in his Bachelorof science thesis that some commercial fingerprint recognition systems can be fooledwith synthesized fingerprint images [28]. It is very likely that the same method asdescribed in [28], also could be applied to create physical artificial fingerprints thatwould fool fingerprint scanners. This method does however require knowledge ofthe legitimate user. [41]

9.4.3 Economies of scale

In [41] it is argued that there is no economies of scale to create artificial fingerprints.This is however not completely true. Buying the required equipment costs quitesome money the first time an artificial fingerprint is to be created. Also, learning


the creation procedure does take some time. After the initial successful artificialfingerprint has been created, it will however cost much less and take less time toredo the procedure.

9.4.4 Forging fingerprints

The work of Albert Wehde (see section 6.1 on page 49), who created similar moldsto the ones used in these experiments, was performed in the 1920’s, about 80 yearsago. Doing the work he did, with the cameras at that time, is quite extraordinary,and gives a hint about what should be possible to do today with advanced digitalcameras, computers and image processing softwares.

It has been questioned whether or not fingerprint examiners and experts can dis-tinguish between a real and a forged fingerprint. Albert Wehde’s co-workers atthe identification bureau were unable to distinguish genuine latent prints from hisforgeries. One reason proposed was that the forgeries could be identified by theabsence of sweat pores. Moreover, the sharp outline, due to copper plate engraving,”would instantly cause suspicion on the part of the expert”. [7]

Today’s fingerprint examiners insist that no fingerprint forgery is ultimately unde-tectable since there will always be traces of the fabrication process to detect, e.g.background noise from the surface upon which the fingerprint was deposited [7].No real tests have however been performed that supports this statement. If it waspossible to render the small details such as sweat pores and background noise onthe PCB, the gelatin print made from this mold, with some fat etc. on it, could beused to place fingerprints on a crime scene. This latent fingerprint could definitelybe identified as belonging to the real person. To get an alibi, the forger could havehis/her finger logged in at another place far from the crime scene. How would thecourt judge in a case like this?

9.4.5 Cooperation using latent print

If the same method as described in this report is used, but with the cooperationof the owner of the fingerprint, the artificial finger can become even better. Thefingerprint to be duplicated can then be studied in detail, finding important sin-gularity points and minutiae points. This way you can make sure that some of themost important information in the fingerprint is also found in the picture of thefingerprint. And if it is not there, you can simply add it with an image processingsoftware.

Even without the cooperation of the owner of the fingerprint, the position of theminutiae and the type of minutiae can be guessed to a great extent to enhance thehardly visible details even more in the picture.

9.4 Additional comments about artificial fingerprints 91

9.4.6 Using the artificial fingerprint

With the experiment method used, a wafer-thin artificial fingerprint can be created.This tiny, almost transparent fingerprint, will easily fool guards if used appropriate.Since gelatin is used, the fingerprint, i.e. the evidence, can be eaten after usage.

A laptop with a (built in) fingerprint scanner, can be stolen, fingerprints will defi-nitely be found on the laptop and can thus be used to create an artificial fingerprint.This way, the thief can steal the laptop and get access to all the files on it.


Chapter 10

Conclusion

This chapter contains a final conclusion and recommendations and speculationsabout the future regarding liveness detection, fingerprint systems, and artificialfingerprints.

10.1 Final conclusion

All tested fingerprint systems were defeated with artificial fingerprints. Some sys-tems were easier to fool than others, and some artificial fingerprints were moresuccessful than others. Interesting to notice is that a capacitive, an electric-field,and a thermal sweeping sensor were all circumvented with artificial fingerprints.Still, fingerprint recognition systems can be very useful if used in the right appli-cations under the right circumstances.

Depending on the specific application, the users of the system might be able toaccept a possibility of intrusion with artificial fingerprints instead of paying a lotextra in terms of money, inconvenience, etc. for a liveness detection/extra means ofsecurity that still will not be 100 % secure. In another application, the users mightdemand a very high level of security with high costs, larger acquisition times, moreuser inconvenience, a higher FRR, etc. It is very important to consider all thesefactors before starting to use a fingerprint recognition system.

Even though it is possible to circumvent a fingerprint scanner with help of anartificial fingerprint, the question can be asked how often this will happen andwhat the consequences will be. It is very difficult to know how often the attackwould take place, but how severe the consequences would be is easier to find out.

Liveness detection is definitely a good way to increase the security if it does notincrease the costs, FRRs, acquisition time, and user inconvenience to a great extent.

93

94 Conclusion

Other means of increasing the security were discussed in section 5.6 on page 45.Much research is currently being performed in the area of multi-modal biometrics,and it is something that could be more widely used in the future. Otherwise,combining two or more identification/verification methods, is a security-increasingmethod that is widely used in commercial applications.

One of the most simple and cheap means of protecting against attacks with artificialfingerprints, is by using a verification system with personal smart cards where eachuser’s fingerprint template is stored. An intruder would have to get hold of both theuser’s smart card and the latent fingerprint. Furthermore, by storing the fingerprintinformation on the smart card instead of storing it in a central database, anotherpossible attack is removed. If an even higher security level is required, this type ofsystem could also be integrated with a password check.

10.2 Future work

A lot of studies have been performed in the area of attacks with artificial finger-prints on fingerprint scanners. Still, as fingerprint scanners develop, more testingand development of artificial fingerprints, is also needed. There have been discus-sions about integrating fingerprints into passports and identification cards, usingfingerprint recognition systems in border controls, and for airport travel. Withregards to how relatively easy it is to fool a fingerprint recognition system withartificial fingerprints, further research is needed before this becomes reality.

The following subsections will describe the future work needed in the fields ofliveness detection, artificial fingerprints, and fingerprint scanners.

10.2.1 Liveness detection

Many liveness detection methods have been suggested, but few have been testedand evaluated, especially not by third parties. Further development and testingof the perspiration method is currently being performed at the Biomedical SignalAnalysis Laboratory at West Virginia University, USA. If this further developmentand testing is successful, evaluation and testing by a third party is also necessarybefore the method is used commercially. A big issue with the perspiration methodis the acquisition time, which has to be less than today’s five seconds.

10.2.2 Artificial fingerprints

Automating parts of the process of creating artificial fingerprints, and simplifyingother parts, could be a step towards a mass production of artificial fingerprints.Will it be possible to buy an artificial fingerprint in the future?

10.2 Future work 95

Coming up with a way to store gelatin artificial fingerprints for a longer time thana week, e.g. by adding a preservative, would increase the use of them.

Further research is needed to investigate if it is possible to create artificial finger-prints with pores and a simulation of the perspiration process in fingertips.

10.2.3 Fingerprint scanners

The extensive experiments in this report showed that electric field sensors couldbe defeated with artificial fingerprints. However, no ultrasound scanners have yetbeen tested by an independent actor regarding attacks with artificial fingerprints.

As more sweeping sensors using different technologies, are being developed, thesealso need to be tested with regards to attacks with artificial fingerprints.

10.2.4 Alternative biometrics

An alternative approach to further investigation in the biometric area is to investi-gate which biometric that is really suited to be used in high security applications,e.g. passports, identification cards, and border controls. While fingerprints mightbe best suited for low security applications, other biometrics might be better touse in other applications.

96 Conclusion

Bibliography

[1] KTM Krim. Teknisk Materiel AB. Available at http://www.bvda.com/ktm/index.html [accessed 12/05/04].

[2] PreciseTMBiometrics. Available at http://www.precisebiometrics.com/ [ac-cessed 12/05/04].

[3] J. Blomme. Evaluation of biometric security systems against artificial fingers.Master’s thesis LITH-ISY-EX-3514-2003, Department of Electrical Engineer-ing, Linkoping University, Linkoping, Sweden, October 2003.

[4] D. Bursky. Biometric sensor leverages e-fields to improve fingerprint capture.Electronic Design, 1999.

[5] E. D. Campbell. Fingerprints & palmar dermatoglyphics, 1998. Available athttp://www.edcampbell.com/PalmD-History.htm [accessed 12/05/04].

[6] Fingerprint Cards. Available at http://www.fingerprints.com [accessed12/05/04].

[7] S. A. Cole. Suspect Identitites – A History of Fingerprinting and CriminalIdentification. Harvard University Press, Cambridge, Massachusetts, London,England, 2001.

[8] Symantec Corporation. What is the difference between viruses, worms, andtrojans? Available at http://service1.symantec.com/SUPPORT/nav.nsf/docid/1999041209131106 [accessed 17/05/04].

[9] R. Derakhshani, S. A. C. Schuckers, L. Hornak, and L. O’Gorman. Deter-mination of vitality from a non-invasive biomedical measurement for use infingerprint scanners. Pattern Recognition, 36(2):383–396, 2003.

[10] The Free Dictionary. Available at http://www.thefreedictionary.com/dermatoglyphics [accessed 12/05/04].

[11] Dr. E. Hill and Dr. M. D. Stoneham. Practical applications of pulse oximetry,2000. Available at http://www.nda.ox.ac.uk/wfsa/html/u11/u1104 01.htm[accessed 12/05/04].

97

98 Bibliography

[12] Personal e-mail from L. Hallberg (Head of the Fingerprint Group at theSwedish National Laboratory of Forensic Science) to M. Sandstrom, May 2004.

[13] Personal e-mail from U. Soderholm (Swedish forensic photographer) toM. Sandstrom, February 2004.

[14] ELFA. Available at http://www.elfa.se [accessed 12/05/04].

[15] ELFA. Factsheet - PCB production, 2004. Available at http://www.elfa.se/en/fakta.pdf [accessed 12/05/04].

[16] S. A. C. Schuckers et al. Liveness phase ii: Solidifying citer’s core competency,May 2003. Available at http://www.citer.wvu.edu/members/conferences/2003spring/Solidifying%20Liveness.ppt [accessed 12/05/04].

[17] National Kidney Federation. Glossary. Available at http://www.kidney.org.uk/Medical-Info/glossary/glossary.html [accessed 18/05/04].

[18] findBIOMETRICS. Available at http://www.findbiometrics.com/Pages/glossary.html [accessed 12/05/04].

[19] Center for Nonproliferation Studies at the Monterey Institute of Interna-tional Studies. Glossary. Available at http://www.nti.org/e research/e6glossary.html [accessed 18/05/04].

[20] E. German. Cyanoacrylate (superglue) fuming tips, 2003. Available at http://onin.com/fp/cyanoho.html [accessed 12/05/04].

[21] Bergdata Biometrics GmbH. Fingerprint – touchless sensors, 2003. Avail-able at http://www.bergdata.com/en/technology/touchless.php [accessed12/05/04].

[22] International Biometric Group. The henry classification system,2003. Available at http://www.biometricgroup.com/Henry%20Fingerprint%20Classification.pdf [accessed 12/05/04].

[23] International Biometric Group. Liveness detection in biometric systems, 2003.White paper. Available at http://www.biometricgroup.com/reports/public/reports/liveness.html [accessed 12/05/04].

[24] International Biometric Group. Optical – silicon – ultrasound, 2004. Whitepaper. Available at http://www.biometricgroup.com/reports/public/reports/finger-scan optsilult.html [accessed 12/05/04].

[25] T. Harris. Howstuffworks: How fingerprint scanners work. Available at http://computer.howstuffworks.com/fingerprint-scanner2.htm [accessed 28/05/04].

[26] Visual Health and Surgical Centers. Glossary of vision terms. Available athttp://www.visualhealth.com/content/glossary.htm [accessed 18/05/04].

Bibliography 99

[27] M. Henriksson. Analys av fingeravtryck. Master’s thesis LITH-ISY-EX-ET-0239-2002, Department of Electrical Engineering, Linkoping University,Linkoping, Sweden, June 2002.

[28] C. J. Hill. Risk of masquerade arising from the storage of biometrics. Bachelorof science thesis, The Department of Computer Science, Australian NationalUniversity, Australia, November 2001.

[29] Biometric ID. Finger-scan (fingerprints). Available at http://www.biometricid.org/finger.html [accessed 12/05/04].

[30] Identix Inc. BioLogonTMProduct Guide, first edition, May 2001.

[31] AuthenTec Inc. Available at http://www.authentec.com/products/entrepad.cfm [accessed 12/05/04].

[32] Identix Inc. Available at http://www.identix.com [accessed 12/05/04].

[33] Kingston Technology Company Inc. The glossary. Available at http://www.kingston.com/tools/umg/umg10.asp [accessed 18/05/04].

[34] Jr. J. D. Woodward, N. M. Orlands, and P. T. Higgins. Biometrics: Identityassurance in the information age. McGraw-Hill/Osborne, Berkeley, California,USA, 2003.

[35] A. K. Jain, S. Prabhakar, and S. Pankanti. Can identical twins be discrimi-nated based on fingerprints? In Pattern Recognition, volume 35, pages 2653–2663, 2002.

[36] P. Kallo, I. Kiss, A. Podmaniczky, and J. Talosi. Detector for recognizingthe living character of a finger in a fingerprint recognizing apparatus. DermoCorporation, Ltd., US Patent #6,175,641, January 2001.

[37] P. D. Lapsley, J. A. Lee, Jr. D. F. Pare, and N. Hoffman. Anti-fraud biometricsensor that accurately detects blood flow. SmartTouch, LLC., US Patent#5,737,439, April 1998.

[38] V. Levesque. Measurement of skin deformation using fingerprint feature track-ing. Master’s thesis, Department of Electrical and Computer Engineering,McGill University, Montreal, France, November 2002.

[39] A. Ligon. An investigation into the vulnerability of the siemens id mouseprofessional version 4, September 2002. Available at http://www.bromba.com/knowhow/idm4vul.htm [accessed 12/05/04].

[40] Mason Vactron Ltd. Dcs-3. Available at http://www.kvant.sk/SK/spectech/PDF/DCS-3.pdf [accessed 12/05/04].

[41] D. Maltoni, D. Maio, A. K. Jain, and S. Prabhakar. Handbook of FingerprintRecognition. Springer Verlag, New York, NY, USA, June 2003.

100 Bibliography

[42] T. Matsumoto, H. Matsumoto, K. Yamada, and S. Hoshino. Impact of artificial“gummy” fingers on fingerprint systems. In Proceedings of SPIE Vol. #4677,Optical Security and Counterfeit Deterrence Techniques IV, Yokohama, Japan,January 2002. Yokohama National University.

[43] P. McFedries. The word spy – biometrics. Available at http://www.wordspy.com/words/biometrics.asp [accessed 12/05/04].

[44] G. Moore. The history of fingerprints, February 2003. Available at http://onin.com/fp/fphistory.html [accessed 12/05/04].

[45] Nationalencyklopedin och Sprakdata (ordboksartiklar), 2004. Available athttp://www.ne.se [accessed 26/05/04].

[46] D. Osten, H. M. Carim, M. R. Arneson, and B. L. Blan. Biometric, personalauthentication system. Minnesota Mining and Manufacturing Company, USPatent #5,719,950, February 1998.

[47] Wi-Fi Planet. Available at http://wi-fiplanet.webopedia.com/TERM/E/equal error rate.html [accessed 18/05/04].

[48] Manukau police. Fingerprints, 2004. Available at http://www.countiesmanukaupolice.govt.nz/Specialists/Forensic Services/fingerprints.htm [accessed 12/05/04].

[49] Ridges and Furrows. Friction skin. Available at http://www.ridgesandfurrows.homestead.com/friction skin.html [accessed 12/05/04].

[50] Schlumberger. Oilfield glossary. Available at http://www.glossary.oilfield.slb.com/Display.cfm?Term=relative%20dielectric%20permittivity [ac-cessed 12/05/04].

[51] S. A. C. Schuckers. Spoofing and anti-spoofing measures. Information SecurityTechnical Report, 7(4):56–62, December 2002.

[52] Softex Inc., Austin, TX, USA. OmniPass User´s Guide, 2002. Version 1.1.

[53] A. Sten, A. Kaseva, and T. Virtanen. Fooling fingerprint scanners - biometricvulnerabilities of the preciseTMbiometrics 100 sc scanner. In 4th Australian In-formation Warfare and IT Security Conference 2003, Helsinki, Finland, 2003.Telecommunication Software and Multimedia Laboratory, Helsinki Universityof Technology.

[54] Targus. Available at http://www.targus.com/uk/product details.asp?sku=PA460E [accessed 12/05/04].

[55] L. Thalheim, J. Krissler, and P-M. Ziegler. Body check – biometric accessprotection devices and their programs put to the test. c’t magazine, 1(11):114,May 2002.

Bibliography 101

[56] T. Trozzi, R. Schwartz, and M. Hollars. Processing Guide for Developing La-tent Prints. Latent Print Unit of the Federal Bureau of Investigation, Wash-ington DC, USA, 2000.

[57] T. van der Putte and J. Keuning. Biometrical fingerprint recognition: don’tget your fingers burned. In Proceedings of IFIP TC8/WG8.8 Fourth WorkingConference on Smart Card Research and Advanced Applications, pages 289–303. Kluwer Academic Publishers, September 2000.

[58] BVDA Bureau voor Dactyloscopische Artikelen. Available at http://www.bvda.com/EN/index.html [accessed 12/05/04].

[59] P. A. Wertheim. Black powder processing. ”Minutiae”, The Lightening PowderCo. Newsletter, 1997.

[60] D. Willis and M. Lee. Six biometric devices point the finger at security. Net-work Computing, June 1998.

102 Bibliography

Appendix A

Dictionary

An alphabetized explanatory list of abbreviations, technical terms, and medicalterms used in this report follows.

AFIS Abbreviation for Automated Fingerprint Identification System. The systemcompares a single fingerprint with a database of fingerprint images. AFISsystems are used both in forensics and in the security field. [18]

Area sensor See Touch sensor.

Artificial fingerprint A fingerprint made to imitate a real fingerprint. In theexperiments performed prior to this report, the artificial fingerprints weremade out of gelatin, but they can also be made out of silicone or othermaterials. The term artificial fingerprint should not be confused with theterm fake fingerprint, which may also include fingerprints which are modifiedfrom live fingers.

Authentication See Verification.

Bifurcation The point on a papillary line where it divides into two.

BVDA Abbreviation for Bureau Voor Dactyloscopische Artikelen. BVDA is amanufacturer and distributor of materials and equipment for crime sceneofficers and forensic laboratories since 1932.

CCD Abbreviation for Charge Coupled Device. An array of light-sensitive diodes,generate an electrical signal in response to light photons. Each light-sensitivediode records a pixel representing the light that hit that spot. Together,the array of diodes, form an image of the scanned object. CCDs are usedin digital cameras and camcorders, as well as in optical fingerprint scanners.Many of today’s optical sensors use a CMOS technology however. [25]

Challenge-response Challenge-response is used to determine the presence of a

103

104 Dictionary

person. Challenge-response can be either voluntary (behavioral) or involun-tary (reflexive) responses. In a voluntary challenge-response system, the userwill hear, see, or feel something and do something in response. In an involun-tary challenge-response system, the user’s body automatically responds to astimulus. Examples include muscles responding to electrical stimulation, thedynamic change in the color of skin when pressure is applied, and the reflexof a knee when struck. [34]

Conductivity The ability of a material to allow electrons to flow, measured bythe current per unit of voltage applied. Electrical conductivity is proportionalto the inverse of resistance.

Core point This point is the ”center” of the print. In a whorl pattern, the corepoint is found in the middle of the spiral/circles. In a loop pattern, the corepoint is found in the top region of the innermost loop.

CMOS Abbreviation for Complementary Metal Oxide Semiconductor. CMOScircuits are widely used in building small low speed and low power electronicsystems. [3]

Cyanoacrylate fuming Cyanoacrylate fuming is a method used to enhance la-tent fingerprints on nonporous specimens. See [56] and [20] for more infor-mation.

Delta point Part of a fingerprint pattern which looks similar to the Greek letterdelta.

Dermatoglyphics The study of whorls, loops, and arches in fingertips and onpalms of the hand and soles of the feet. [10]

Dermis An inner layer of the skin found deeper than the outmost layer (epider-mis).

DNA Abbreviation for deoxyribonucleic acid. DNA molecules contain the geneticinformation used for the organization and functioning of most living cells.[19]

ECG Abbreviation for electrocardiogram. Measurement of the electrical activitywithin the heart.

EKG See ECG.

EER Abbreviation for Equal Error Rate. The value of the FAR and FRR whenthe FAR equals the FRR. This is the value where both the FAR and FRRare kept as low as possible at the same time. [47]

Enrollment The process of storing a profile (template) containing the biometricalproperties of a person.

Epidermis The outermost skin layer.

105

FA Abbreviation for False Acceptance. A false acceptance occurs when a sys-tem falsely accepts a nonregistered (or another registered) fingerprint as aregistered one. [3]

FAR Abbreviation for False Acceptance Rate. The rate at which the system falselyaccepts a nonregistered (or another registered) fingerprint as a registered onecompared to the total number of trials. [3]

FBI Abbreviation for Federal Bureau of Investigation.

FR Abbreviation for False Rejection. A false rejection occurs when a systemfalsely rejects a register user. [3]

FRR Abbreviation for False Rejection Rate. The rate at which the system falselyrejects a registered user compared to the total number of trials. [3]

FTIR Abbreviation for Frustrated Total Internal Reflection. See section 4.2.1 onpage 23 for more information.

Gelatin Gelatin is made by dissolving collagen (a protein found in bone and con-nective tissues) in a hot solution [45]. Since gelatin is made out of collagen, itresembles the surface of human skin in ways of moisture, electric resistance,and texture [3, 42]. Gelatin is used e.g. in candies and cooking as a thickeningagent.

Haemoglobin The part of red blood cells that carry oxygen to tissues. [17]

Identification In an identification system, an individual is recognized by com-paring with an entire database of templates to find a match. The systemconducts one-to-many comparisons to establish the identity of the individ-ual. The individual to be identified does not have to claim an identity (Whoam I? ). [41]

KTM Abbreviation for Krim. Teknisk Material AB. KTM is a Swedish manufac-turer of forensic laboratory equipment.

LED Abbreviation for Light Emitting Diode.

Latent fingerprint A fingerprint consists of a combination of different chemicalsthat originate from natural secretions, blood, and contaminants. When afingerprint touches a surface it leaves traces of these chemicals. These tracesmake up a latent fingerprint (sometimes called residual fingerprint). [56]

Lipid A lipid is an organic substance which is not dissolvable in water, but dis-solves itself in other organic solvents. Fat and waxes are two examples oflipids. [45]

Live finger A human finger which is still living, i.e. has blood pumping through itetc. The terms real finger and live finger are used synonymous in this report.

Liveness detection Liveness detection (sometimes called vitality detection) in abiometric system means the capability for the system to detect, during en-

106 Dictionary

rollment and identification/verification, whether or not the biometric samplepresented is alive or not. Furthermore, if the system is designed to protectagainst attacks with artificial fingerprints, it must also check that the pre-sented biometric sample belongs to the live human being who was originallyenrolled in the system and not just any live human being.

Minutiae details The characteristics by which fingerprints can be identified. Minu-tiae details are sometimes referred to as Galton’s details, ridge characteristics,or ridge details.

Multi-modal biometrics A multi-modal biometric system, combines two or morebiometric techniques.

Papillary lines The lines on a fingerprint that are visible to the human eye. Theparts of the lines that are raised are called ridges and the lines that are lowerare called valleys.

PCB Abbreviation for Printed Circuit Board. A PCB is a board with coppertraces which are normally used to provide electrical connections for chips andother components [33]. Two examples of PCBs are mother-boards and creditcard memory [33]. In this report, PCBs are used to get a three-dimensionalfingerprint as a mold.

Perspiration Human skin contain about 600 sweat glands per square inch. Sweat(a dilute sodium chloride solution) diffuses from the sweat glands on to thesurface of the skin through small pores. In live fingers, perspiration startsfrom the pores. The sweat then diffuses along the ridges during time, makingthe semi-dry regions between the pores moister or darker in the image. Theperspiration process does not occur in cadaver fingers or artificial fingerprints.[9]

PIN Abbreviation for Personal Identification Number.

Pore Sweat pores on the human skin are used for the perspiration process.

Pulse oximetry Pulse oximetry is used in the medical field to measure the oxygensaturation of haemoglobin in a patient’s arterial blood. [11]

Relative Dielectric Permittivity The degree to which a medium resists theflow of electric charge divided by the degree to which free space resists suchcharge. The degree, or dielectric permittivity, is defined as the ratio of theelectric displacement to the electric field strength. The term is also known asthe relative dielectric constant (RDC). However, at high frequencies, the valueis no longer constant, but decreases with frequency. The relative dielectricpermittivity is unitless. [50]

Real finger/fingerprint A real finger is a human finger which is still living, i.e.has blood pumping through it etc. The terms real finger and live fingerare used synonymous in this report. A real fingerprint is a fingerprint on areal/live finger.

107

Residual fingerprint See Latent fingerprint.

Retina The nerve layer that lines the inside wall of the eye. With a similarfunction as the film in a camera, the retina captures images, transforms theimages into electrical signals, and sends the signals to the brain. [26]

Ridge A part of the fingerprint that like a ridge in a landscape raises itself abovethe rest of the area. Ridges show up as dark parts in the image of the scannedfingerprint. [3]

Ridge termination A ridge termination is the end point of a ridge, and is there-fore sometimes referred to as an ending point.

Smart card A plastic card which has a microprocessor chip embedded inside thecard. [6]

Success rate The rate at which the system successfully identifies/verifies a regis-tered user’s fingerprint compared to the total number of trials. [3]

Sweeping sensor A new type of fingerprint sensor, the sweeping sensor, is aswide as a finger, but only a few pixels high. Therefore, the main advantage ofsweeping sensors, especially in silicon sensors, is reduced cost. The sweepingconsists of a vertical movement only. At the end of the swipe or ”on-the-fly”,the fingerprint image is reconstructed from all the images acquired earlier.[41]

Touch sensor Most fingerprint sensors used today are touch sensors (area sen-sors). When using a touch sensor, you simply put your finger on the sensorand hold it for a few seconds without moving it. Very little user training isrequired to use a touch sensor.

Trojan horse Trojan horses are files that claim to be something desirable, but arein fact malicious. Trojans contain malicious code that when triggered causeloss or theft of data. Trojan horse programs do not replicate themselves butspread e.g. by e-mail attachments that are opened or by downloading andrunning a file from the Internet. [8]

Valley The part of the fingerprint that like a valley in a landscape lies lower thanthe rest of the area [3]. Valleys show up as light parts in the image of thescanned fingerprint [3]. In some literature, the term furrow is used instead ofvalley.

Verification In a verification system, the individual to be identified has to claimhis/her identity (Am I whom I claim to be? ) and this template is then com-pared to the individual’s biometric characteristics. The system conducts one-to-one comparisons to establish the identity of the individual. Two synonymsto verification are authentication and identity verification. [41]

Vitality detection See Liveness detection.

108 Dictionary

Appendix B

Material

This appendix contains a detailed description of the material used in the experi-ments.

B.1 Enhancing the fingerprint

The material used to enhance the fingerprints is listed below and is available fromKTM - Krim. Teknisk Material AB, Box 171, S-746 24 BALSTA. Telephone num-ber: +46(0)171 58680. See [1] for more details.

All material listed below is also found internationally from BVDA (Bureau voorDactyloscopische Artikelen) but with different catalog numbers. Mail address:BVDA International b.v., Postbus 2323, 2002 CH HAARLEM - The Netherlands.Telephone number: +31 23 5424708. See [58] for more details.

• Soot powder mixture, 100/500 ml. Catalog number 13400/13410.

• Squirrel hair brush SKA, round brush with black lacquered shaft, length:14 cm. Catalog number 16050.

B.2 Photographing the fingerprint

A Minolta DiMAGE 5 from Minolta Co., Ltd., with the following detailed infor-mation, was used during the experiments:

• Number of effective pixels: 3.17 million (2056 × 1544).

• Camera sensitivity (ISO): Auto and 100, 200, 400, and 800 ISO equivalents.

109

110 Material

• Focal length: 35–250 mm.

• Focusing range: 0.5 m–infinity (from the CCD), 0.25–0.6 m (from the CCD)macro mode.

B.3 Image processing

Adobe r©Photoshop r©CS, version 8.0, from Adobe Systems Inc., was used for thegraphics processing.

B.4 Printing

The printer used was a HP LaserJet 5Si/5Si MX PS. The highest resolution theprinter could manage was 600 dpi.

B.5 PCB production

The material needed for exposing, developing, and etching of the mold can bebought from ELFA AB, S-175 80 Jarfalla. Telephone number: +46(0)20 758000.See [14] for more details. All prices given in this section are exclusive vat.

The following material (see figure B.1 on page 111), all available at ELFA, wasused during the experiments described in this report [14]:

• UV exposure, single-sided. Stock number 49-821-04, price 4451 SEK.

UV light box for exposing on copper-clad board coated with photoresist. Thelid has a snap lock and is fitted with 20 mm thick foam for securing the object.Fitted with timer and supplied with fluorescent lamps.

Loading surface: 250×160 mmNo. of fluor. lamps: 4 pcs.Output, fluor. lamps: 15 W/unitUV wavelength: 365 nm

• Epoxy laminate, 1.55 mm/70 µ Cu. Stock number 49-575-10, price 54 SEK.

With photoresist, type FR-4 Copper-clad board, 1.55 mm thick, coated withpositive photoresist. Copper layer: 70 µm. Single-sided, size: 100×160 mm.

• Epoxy laminate, 1.55 mm/35 µ Cu. Stock number 49-571-22, price 111 SEK.

With photoresist, type FR-4 Copper-clad board, 1.55 mm thick, coated withpositive photoresist. Copper layer: 35 µm. Single-sided, size: 100×160 mm.

B.5 PCB production 111

• Developer for photo resist 20 g. Stock number 49-577-00, price 43 SEK.

Powder developer for positive photo resist. Dissolves in 2 liter 30◦C water.Contains sodium hydroxide (NaOH).

• Etching powder 1000 g. Stock number 49-577-42, price 137 SEK.

Etching powder for copper laminate. The powder (sodium peroxide sulphate)is dissolved in boiling hot water, thus giving the solution a temperature of50◦C which gives the best result. 140 g of powder etches 6 dm2 in fiveminutes at 50◦C while stirring. Premixed solution can be stored in a storagebox without a tight-fitting lid and the box cannot be made out of plastic.Mixture relationship 1:5.

(a) UV light box. (b) Epoxy laminate.

(c) Developer for photoresist.

(d) Etching powder.

Figure B.1. Materials used during production of PCB. [14]

112 Material

B.6 Gelatin solution

Gelatin used for making artificial fingerprints: Favorit Gelatin–extra guld (17 g),see figure B.2. Produced by: AB Torsleff & Co, Box 4017, S-171 04 Solna. Tele-phone number: +46(0)8 629 45 40. Costs around 10 SEK.

Figure B.2. Gelatin used for making artificial fingerprints. [3]

Appendix C

Experiment details

This appendix describes some of the steps in the experiment method in more detail.

C.1 Photographing

A tripod and a Minolta DiMAGE 5 digital camera was used with the followingsettings while taking photos of the lifted fingerprints:

• Macro mode.

• No flash.

• Sharpness: Hard(+).

• Manual focus.

• ISO–100. The lowest possible ISO value was used to get the least noise inthe image.

• Quality–Fine. The image was saved formatted as a JPEG file. Preferably,the super fine quality should have been used and the image would then havebeen saved in raw format. This setting was not used however, because manypictures of the prints were taken and with a higher quality it required a lotof space to save the image.

• Size–1600×1200 pixels (horizontally×vertically). This size was used since itwas equal or greater to the resolution the printer could cope with, and it wasbig enough to make the image processing easy to perform.

• Aperture value–f/8. The quite small aperture (i.e. quite big aperture value)was used to get the picture sharper.

113

114 Experiment details

• White balance–Auto.

• Contrast compensation +3. After the unsharp mask in Photoshop had beenapplied, you could however hardly see the difference between using no contrastcompensation and using +3 contrast compensation.

• Self-timer. Shake warning appeared otherwise.

Taking photos of the tape and powder was not a problem when considering reflectsfrom the tape.

C.2 Image processing

Adobe r©Photoshop r©CS from Adobe Systems Inc., was used for the image pro-cessing performed. To start off with, a picture in jpeg format with the size of1600×1200 pixels, was used.

The steps of the image processing for the fingerprints used in the experiments inthis report will follow. These steps can sometimes be done in a different order,depending on the quality of the photograph, the darkness and sharpness of thepicture, scars on the fingertip from which the fingerprint is taken etc. Sometimesyou might also want to perform things not mentioned here to make the picturelook ”better”.

1. First of all, the picture was cropped with the crop tool to a smaller squarecontaining only the fingerprint (and some parts of the surroundings that cannot be cropped using a square).

2. The picture was zoomed in with the zoom tool, and then sharpened with thefollowing filter and values:

Filter → Sharpen → Unsharp Mask...

Amount: 500 %Radius: 7.0 pixelsThreshold: 0 levels

3. To get it right when performing the etching of the picture later on, the imagewas reversed by the following selection:

Image → Rotate Canvas → Flip Canvas Horizontal

Depending on which way the image is positioned, the canvas should be flippedvertically instead.

4. If necessary, those parts of the print that were more diffuse/had less contrast,were improved by first selecting them with the lasso tool, and then using thelevels option:

C.2 Image processing 115

Image → Adjustments → Levels...

”Input levels” changed to appropriate values.

5. The papillary lines were sharpened even more and pores were removed byusing the pen tool and the brush tool (black color) with the following values:

Master Diameter: 2–9 pixelsHardness: 100 %

6. The colors of the fingerprint image were inverted to make it ”right” whenproducing the PCB. This should only be done though if the print has beenpowdered with a dark powder (not white). The reason being that the darkparts of the fingerprint will appear as copper on the PCB and thus valleyson the artificial fingerprint. The white parts will thus appear as empty spaceon the PCB and thus ridges on the artificial fingerprint. The invert selectionis found here:

Image → Adjustments → Invert

7. Noise in the image was removed by the following filter and settings:

Filer → Noise → Dust & Scratches...

Radius: 1 pixelsThreshold: 0 levels

8. If there were any traces left from the soot powder mixture at this point(showing up as white dots on the black areas), these were erased by eitherusing the Dust & Scratches filter again, or by erasing them by hand with thepen tool and the brush tool.

9. For subject S2’s fingerprint image, the black lines had to be widened a bitfor the image to become easier to etch. This was done by using the followingfilter:

Filter → Brush Strokes → Accented Edges...

Edge Width: 2Edge Brightness: 16Smoothness: 5

For the other subjects’ fingerprint images, this step was discarded.

10. The length of the powdered/fumed fingerprint must be measured to be ableto get the right size of the image. The fingerprint was measured with anordinary office ruler with a millimeter scale. The image size was set to thereal size of the fingerprint by the following selection:

Image → Image Size...

While changing the image size, the ”resample” option was deselected. Af-ter that was done, and before pressing ”ok”, the resolution was changed to


the highest resolution the printer could handle (here 600 dpi). The highestresolution of the fingerprint sensors tested in the extensive experiments, wasabout 500 dpi, so 600 dpi images should not have been a problem.

11. The image should be black and white and not grayscaled in order for theetching to work better. Therefore, the threshold option was chosen (withoutchanging anything) to make the image black and white.

Image → Adjustments → Threshold...

Threshold Level: 128

12. If there were any traces left now from the soot powder mixture (appearingas white dots on the black parts), those were erased.

The image processing of subject S2’s fingerprint followed the above description,except for a few things. First of all, the image did not have a black surrounding ofthe print (instead it was white). This should however not have affected the resultto a great extent, since often this part of the gelatin is not even interpreted by thesensor. It was mainly of laziness reasons why the surrounding was kept black forthe other subjects when it did not seem to have any impact on the outcome. Also,in step number four above, the brush size five was used most of the time for theimage processing of S2’s fingerprint, thus making the somewhat thinner lines a bitthicker.

C.3 Fingerprint images before and after image pro-cessing

Figures C.1, C.2, and C.3 show a part of the images of all subjects’ fingerprintsbefore and after image processing.

(a) S1 before image processing. (b) S1 after image processing.

Figure C.1. A part of subject S1’s fingerprint image before and after image processing.

C.4 PCB production 117





C.4 PCB production

To expose, develop, and etch the mold, the following equipment and material wereused:

• Ultra-violet radiation (UV light) box. An UV lamp can also be used, but isa bit more tricky to use.

• Exposing container.

• Etching bowl of glass. An etching bowl of suitable plastic can also be used.

• Epoxy laminate with positive photo resist.

• Developer for photo resist.

• Etching powder for copper laminate.


• Stirrer.

All the above is available at ELFA (except the etching bowl and the stirrer), seeappendix B.5 on page 110.

The following procedure for the production of the PCB was used:

1. The developer for photo resist was mixed. One bag (20 g) of photo resistpowder (sodium hydroxide, NaOH) was mixed with 1 liter of water.

2. The etching solution was mixed. 2 dl of etching powder (sodium peroxide sul-phate) was mixed with 1 liter of boiling hot water, giving an etching solutionof about +50◦C.

3. The protective film was removed from the epoxy laminate.

4. The transparency film with the fingerprint image, was placed on the UV lightbox’ glass. The blackness side of the transparency should be turned upwards(away from the glass side of the UV light box and towards the emulsion sideof the resist-coated board to be placed on top of it). The epoxy laminate wasthen placed on top of the transparency. To get a more even pressure, a pileof papers were placed on top of the epoxy laminate before closing the lid ofthe UV light box.

5. The exposure time varies with the height of the lamp above the illuminatedboard and any possible glass sheets between the lamp and film laminate. Thebest time to use with the tools available here, was experimentally determinedto 3 minutes.

6. The exposure was followed by developing with the developer mixture pre-pared earlier. The developing time varies between 30 seconds and 4 minutesdepending on the type of resist. The laminate was first developed once, andleft in the developer mixture until the pattern appeared, and then a sec-ond time to get rid of any remaining photo resist. When positive resist isused, those parts that have not been exposed to light (i.e. are covered withblack color on the transparency), will be protected during etching. Beforecontinuing, the board was washed thoroughly with running water.

7. The laminate was put in the etching solution in the etching bowl. To keepa temperature of about +50◦C (for the best result), the etching bowl wasplaced in a hot water bath in the sink. The etching solution was then stirredto make sure the active parts of the solution always was in contact with thecopper surface. The etching took about 10–20 minutes depending on howmany fingerprints that were etched at the same time.

8. The laminate was then washed with water again.

Note that ELFA recommends to use protective gloves and safety glasses whenworking with UV light and chemicals. The etching solution should not be pouredout in the sink.

Appendix D

Scanners used in extensiveexperiments

Identix fingerprint scanner (see figure D.1) from Compaq Computer Cooperation(nowadays Hewlett Packard) uses an DFR-300 optical sensor (FTIR with a sheetprism, CMOS-camera). The resolution is 380 dpi and the sensing area size is17×17 mm. The operating temperature is 0–50◦C. [3, 32]

Figure D.1. Identix fingerprint scanner used in the extensive experiments. [30]

Both Targus DEFCONTMAuthenticatorTM(see figure D.2 on page 120) and PreciseTM

Biometrics 100 MC (see figure D.3 on page 120) use an EntrePad r©AES4000 sil-icon sensor from AuthenTec, Inc. AES4000 is an electric field sensor and has aresolution of 250 dpi. The sensing area size is 9.75×9.75 mm and the operatingtemperature is 0–70◦C. [31]

PreciseTMBiometrics 100 MC fingerprint scanner also has a built in smart cardreader, which makes it possible to store the fingerprint on a smart card and thusget a higher degree of security [2].

119

120 Scanners used in extensive experiments

Figure D.2. Targus DEFCONTMAuthenticatorTMfingerprint scanner used in the exten-sive experiments. [54]

Figure D.3. PreciseTMBiometrics 100 MC fingerprint scanner used in the extensiveexperiments. [2]

Appendix E

Software used in extensiveexperiments

Screenshots of software used in the extensive experiments can be found in fig-ures E.1, E.2 on page 122, and E.3 on page 122.

Figure E.1. Screenshot of BioLogonTMfor Windows. BioLogonTMis the software thatwas used together with the Identix fingerprint scanner. [3]

121

122 Software used in extensive experiments

Figure E.2. Screenshot of Softex Omnipass. Softex Omnipass is the software that wasused together with the Targus DEFCONTMAuthenticatorTMfingerprint scanner. [3]

Figure E.3. Screenshot of Precise BioManagerTMincluded in Precise Logon software.Precise Logon is the software that was used together with the PreciseTMBiometrics 100MC fingerprint scanner. [3]

Appendix F

Test results

The detailed test results for each fingerprint scanner and each subject follow below.

F.1 Results per fingerprint scanner

The detailed results, for each fingerprint scanner, both for real fingerprints andartificial fingerprints, are presented in this section.

F.1.1 Identix

The detailed test results of the Identix fingerprint scanner for real fingerprints canbe found in table F.1. The detailed test results of the Identix fingerprint scanner forartificial fingerprints, round one and two, can be found in table F.2 and table F.3on page 124.

Subject Successful logins False rejections False acceptancesS1 49 1 0S2 50 0 0S3 47 3 0Sum 146 4 0Percent 97.3 % 2.7 % 0.0 %

Table F.1. Results of the Identix fingerprint scanner for real fingerprints.

123

124 Test results

Subject FAs (artificial print) Rejected logins FAs (other user)S1 50 0 0S2 33 17 0S3 39 11 0Sum 122 28 0Percent 81.3 % 18.7 % 0.0 %

Table F.2. Results of the Identix fingerprint scanner for artificial fingerprints, roundone.


Table F.3. Results of the Identix fingerprint scanner for artificial fingerprints, roundtwo.

F.1.2 Targus DEFCONTMAuthenticatorTM

The detailed test results of the Targus DEFCONTMAuthenticatorTMfingerprintscanner for real fingerprints can be found in table F.4. The detailed test resultsof the Targus DEFCONTMAuthenticatorTMfingerprint scanner for artificial finger-prints, round one and two, can be found in table F.5 and table F.6 on page 125.


Table F.4. Results of the Targus DEFCONTMAuthenticatorTMfingerprint scanner forreal fingerprints.

F.1 Results per fingerprint scanner 125


Table F.5. Results of the Targus DEFCONTMAuthenticatorTMfingerprint scanner forartificial fingerprints, round one.


Table F.6. Results of the Targus DEFCONTMAuthenticatorTMfingerprint scanner forartificial fingerprints, round two.

F.1.3 PreciseTMBiometrics 100 MC

The detailed test results of the PreciseTMBiometrics 100 MC fingerprint scannerfor real fingerprints can be found in table F.7. The detailed test results of thePreciseTMBiometrics 100 MC fingerprint scanner for artificial fingerprints can befound in table F.8 and table F.9 on page 126.


Table F.7. Results of the PreciseTMBiometrics 100 MC fingerprint scanner for realfingerprints.

126 Test results


Table F.8. Results of the PreciseTMBiometrics 100 MC fingerprint scanner for artificialfingerprints, round one.


Table F.9. Results of the PreciseTMBiometrics 100 MC fingerprint scanner for artificialfingerprints, round two.

F.2 Results per subject

The detailed results per subject, in numbers and percent, for both real fingerprintsand artificial fingerprints, are presented in this section.

F.2.1 Real fingerprints

The detailed results per subject, in numbers, for real fingerprints are shown intable F.10. The success rate, FRR, and FAR, per subject, for real fingerprints, aswell as the mean values for all subjects, are shown in table F.11 on page 127.

Subject Successful logins False rejections False acceptancesS1 148 2 0S2 117 33 0S3 141 9 0Sum 406 44 0

Table F.10. The sum of successful logins, false rejections, and false acceptances, peruser, for all fingerprint scanners tested, for real fingerprints.

F.2 Results per subject 127

Subject Success rate FRR FARS1 98.7 % 1.3 % 0.0 %S2 78.0 % 22.0 % 0.0 %S3 94.0 % 6.0 % 0.0 %Mean value 90.2 % 9.8 % 0.0 %

Table F.11. The success rate, FRR, and FAR, per subject, for all fingerprint scannerstested, for real fingerprints. The mean values for all subjects are also shown.

F.2.2 Artificial fingerprints

The detailed results per subject, in numbers, for artificial fingerprints, are shownin table F.12 and table F.13 for round one and two respectively. The FAR (withartificial fingerprints), rejection rate, and FAR (other user), per subject, for artifi-cial fingerprints, as well as the mean values for all subjects, are shown in table F.14and table F.15 on page 128.

Subject FAs (artificial print) Rejected logins FAs (other user)S1 149 1 0S2 68 82 0S3 85 64 1Sum 302 147 1

Table F.12. The sum of false acceptances (with artificial fingerprints), rejected logins,and false acceptances (other user), per subject, for all fingerprint scanners tested, forartificial fingerprints during round one.

Subject FAs (artificial print) Rejected logins FAs (other user)S1 144 6 0S2 102 48 0S3 139 11 0Sum 385 65 0

Table F.13. The sum of false acceptances (with artificial fingerprints), rejected logins,and false acceptances (other user), per subject, for all fingerprint scanners tested, forartificial fingerprints during round two.

128 Test results

Subject FAR (artificial print) Rejection rate FAR (other user)S1 99.3 % 0.7 % 0.0 %S2 45.3 % 54.7 % 0.0 %S3 56.7 % 42.7 % 0.7 %Mean value 67.1 % 32.7 % 0.2 %

Table F.14. The FAR (with artificial fingerprint), the rejection rate, and the FAR (otheruser), per subject, for artificial fingerprints during round one. The mean values for allsubjects are also shown.

Subject FAR (artificial print) Rejection rate FAR (other user)S1 96.0 % 4.0 % 0.0 %S2 68.0 % 32.0 % 0.0 %S3 92.7 % 7.3 % 0.0 %Mean value 85.6 % 14.4 % 0.0 %

Table F.15. The FAR (with artificial fingerprint), the rejection rate, and the FAR (otheruser), per subject, for artificial fingerprints during round two. The mean values for allsubjects are also shown.

På svenska Detta dokument hålls tillgängligt på Internet – eller dess framtida ersättare – under en längre tid från publiceringsdatum under förutsättning att inga extra-ordinära omständigheter uppstår.

Tillgång till dokumentet innebär tillstånd för var och en att läsa, ladda ner, skriva ut enstaka kopior för enskilt bruk och att använda det oförändrat för ickekommersiell forskning och för undervisning. Överföring av upphovsrätten vid en senare tidpunkt kan inte upphäva detta tillstånd. All annan användning av dokumentet kräver upphovsmannens medgivande. För att garantera äktheten, säkerheten och tillgängligheten finns det lösningar av teknisk och administrativ art.

Upphovsmannens ideella rätt innefattar rätt att bli nämnd som upphovsman i den omfattning som god sed kräver vid användning av dokumentet på ovan beskrivna sätt samt skydd mot att dokumentet ändras eller presenteras i sådan form eller i sådant sammanhang som är kränkande för upphovsmannens litterära eller konstnärliga anseende eller egenart.

För ytterligare information om Linköping University Electronic Press se förlagets hemsida http://www.ep.liu.se/ In English The publishers will keep this document online on the Internet - or its possible replacement - for a considerable time from the date of publication barring exceptional circumstances.

The online availability of the document implies a permanent permission for anyone to read, to download, to print out single copies for your own use and to use it unchanged for any non-commercial research and educational purpose. Subsequent transfers of copyright cannot revoke this permission. All other uses of the document are conditional on the consent of the copyright owner. The publisher has taken technical and administrative measures to assure authenticity, security and accessibility.

According to intellectual property law the author has the right to be mentioned when his/her work is accessed as described above and to be protected against infringement.

For additional information about the Linköping University Electronic Press and its procedures for publication and for assurance of document integrity, please refer to its WWW home page: http://www.ep.liu.se/

© Marie Sandström

Liveness Detection in Fingerprint Recognition Systems19729/FULLTEXT01.pdf · Liveness Detection in Fingerprint Recognition Systems Författare Author Marie Sandström Sammanfattning

Documents