How It Works

Various methods exist to capture fingerprints:

• Optical Capture: Uses visible light to scan the fingerprint.

• Capacitive Sensors: Use electrical current conducted through the finger.

• Ultrasound: Uses high-frequency sound waves to create an image.

• Contact Sensors: Capture the ridge pattern in contact with the sensor.

• Contactless Sensors: Take an image (2D or 3D) of the ridge pattern while the finger is held at a distance from the sensor.

Attacks

Attacks on fingerprint systems can occur with or without the collusion of enrolled users. The simplest attack involves placing a different finger on the sensor, hoping to be recognized as an enrolled user. The success of such attacks depends on the system's false match rate, which should ideally be very low.

Artefacts

More determined attackers may create an artefact – a false fingerprint matching an enrolled user's finger. High-quality artefacts increase the probability of defeating the system. Instructions for making reasonable quality artefacts are readily available online, posing a unique vulnerability to fingerprint biometrics.

The artefact must match the type of fingerprint sensor used. For example, capacitive systems require artefacts with similar conductivity properties to human skin. Latent fingerprints left on surfaces can also be covertly collected and used to create artefacts.

Implementation Notes

For low-threat situations with a small number of users, using a single fingerprint may suffice. However, given the ease of damaging fingerprint ridges, more fingerprints should be enrolled for greater accuracy.

In high-security situations, multiple fingerprints may be necessary. For example, automated border control systems at airports often use all eight fingers and both thumbs to match travelers to a large database.

If artefact attacks are a concern, the system's security should also be measured by its liveness detection or spoof detection capabilities. These measures can be difficult to assess due to the diversity of potential attack methods.

Enrolment Problems

All biometric systems face the challenge that some individuals may not be able to provide an adequate sample. With fingerprint systems, older adults and those in certain industries often produce lower-quality readings. In severe cases, some people may be unable to use the biometric system at all.

Protections

Biometric sensors and software can perform checks to detect presentation attacks through methods such as:

• Sub-dermal image analysis

• Deformation effects analysis

• Optical spectrum analysis for skin texture

• Conductivity/capacitance of the skin

• Oxygen levels in the blood

• Pulse or ECG measurements

Summary

Fingerprint recognition provides a useful degree of discrimination between enrolled users. However, measuring the absolute level of security is challenging, especially against sophisticated spoofing attacks. Error rates depend on various factors, including the deployment environment and user population, complicating performance specification.

User acceptance issues should also be considered, as fingerprints are sometimes associated with law enforcement and criminality, potentially hindering acceptance in certain contexts.