BIOMETRIC TECHNOLOGY: A REVIEW

Transcription

1 International Journal of Computer Science and Communication Vol. 2, No. 2, July-December 2011, pp BIOMETRIC TECHNOLOGY: A REVIEW Mohmad Kashif Qureshi Research Scholar, Department of Computer Science, Singhania University, Rajasthan, India kashoo @yahoo.co.in ABSTRACT Biometrics is a field of science which deals with the positive identification of unique individuals based on their physiological or behavioural characteristics. Biometrics has lately been receiving attention in technologies. In today s world the need for large-scale identity management system, whose functionality relies on the accuracy of identifying individuals influenced the development of biometrics in modern world. This paper discusses about Biometriccharacteristics in detail. The demerits of unimodel biometric and the characteristic of Multimodel Biometrics are also described. And finally, the biometric security issue is touched and the various levels at which a particular biometric system can be attacked is presented. 1. INTRODUCTION TO BIOMETRICS Biometrics are automated methods of recognizing an individual based on their physiological (e.g., fingerprints, retina, face, iris) or behavioral characteristics (e.g., gait, signature)[1]. As the level of security breaches and transaction fraud increases, the need for highly secure identification and personal verification technologies is becoming apparent. A number of biometric identifiers are in use in various applications. Each biometric has its strengths and weaknesses and the choice typically depends on the application[2]. No single biometric is expected to effectively meet the requirements of all the applications. The similarity between a biometric and an application is determined depending upon the characteristics of the application and the properties of the biometric. 2. BIOMETRIC CHARACTERISTICS Any human physiological or behavioural characteristic will be a biometrics if it satisfies the following[3]: a. Universality: The biometric trait must be universal. Means every person should posses that biometric trait. b. Permanence: The biometric trait of an individual should not be variable with time with respect to the matching algorithm. A trait which that changes over time can not be used as biometric. c. Uniqueness: The biometric trait should be unique for individuals. In other words the trait should differ sufficiently in case of every two person so that each person can be identified individually. d. Measurability: It should be possible to acquire and digitize the biometric trait using suitable devices. Furthermore, the acquired raw data should be valid to processing in order to extract representative feature sets. e. Performance: The recognition accuracy and the resources required to achieve that accuracy should meet the constraints imposed by the application. f. Acceptability: Individuals in the target population that will utilize the application should be willing to present their biometric trait to the system. g. Circumvention: This refers to the ease with which the trait of an indi vidual can be imitated using artifacts (e.g., fake fingers), in the case of physical traits, and mimicry, in the case of behavioral traits. 3. BIOMETRIC SYSTEMS A biometric system is essentially a pattern recognition system that operates by acquiring biometric data from an individual, extracting a feature set from the acquired data, and comparing this feature set against the template set in the database. Depending on the application context, a biometric system may operate either in verification mode or identification mode. a. Verification: In the verification mode, the system approve a person, if the biometric data given by the person matches her own biometric template(s) which is stored in the system database. An user who desires to be recognized claims his/her identity, usually via a PIN, a smart card, etc., and the system performs a one-to one matching with the corresponding template to determine whether the claim is true or not. Identity verification is typically used for positive recognition, where the aim is to prevent multiple people from using the same identity[4]. b. Identification: In the identification mode, the user dose not need to provide any PIN or smart card to

2 288 International Journal of Computer Science and Communication (IJCSC) claim his/her identity, the user just provide the biometric data and the system compares the given biometric data with all the biometric templates stored in the system and if there is a match the system approves the person. Therefore, the system conducts a one-to-many comparison to establish an individual s identity. In negative recognition applications where identification is a critical component the system establishes whether the person is who he/ she (implicitly or explicitly) denies to be. The purpose of negative recognition is to prevent a single person from using multiple identities[5]. 3.1 Biometric System Design Modules A biometric system is designed using the following four main modules[6]: a. Sensor module: In this module the biometric data of the individuals is been captured. An example is a fingerprint sensor that captures and images the ridge and valley structure of a user s finger. b. Feature extraction module: this module processed the captured biometric data to extract a set of salient or discriminatory features. c. Matcher module: In this module the extracted features are compared against the stored templates to generate matching scores. The matcher module also encapsulates a decision making module, in which a user s claimed identity is confirmed (verification) or a user s identity is established (identification) based on the matching score. d. System database module: This module is used to store the biometric templates of the enrolled users. During the enrollment phase, the biometric characteristic of an individual is first scanned by a biometric reader to produce a digital representation (feature values) of the characteristic. In order to facilitate matching, the input digital representation is further processed by a feature extractor to generate a compact but expressive representation, called a template. Figure 1: Enrollment, Verification and Identification Using Four Main Modules 4. ERROR RATES AND THEIR USAGE There are two kinds of errors that biometric systems do: 1. False rejection (Type 1 error): It may sometime happen that a valid user is rejected because the system does not find the user s current biometric data similar enough to the master template stored in the database, this is called false rejection or type 1 error. A hundred percent similarity between the given biometric data and the stored template is also suggests a very good fake. 2. False acceptance (Type 2 error): sometimes a biometric data provided by an fraud accepted because of its enough similarity with the master template of a legitimate user, this is called false acceptance or type 2 error.

3 Biometric Technology: A Review 289 In an ideal system, there are no false rejections and no false acceptances. In a real system, however, some false rejection and false acceptance exist depending on the security threshold. The higher the threshold the more false rejections and less false acceptances and the lower the threshold the less false rejections and more false acceptances. The decision which threshold to use depends mainly on the purpose of the entire biometric system. It is chosen as a compromise between the security and the usability of the system. The number of false rejections/false acceptances is usually expressed as a percentage from the total number of authorized/ unauthorized access attempts. These rates are called the False rejection rate (FRR)/false acceptance rate (FAR). The values of the rates are bound to a certain security threshold. If the device supports multiple security levels or returns a score we can create a graph indicating the dependence of the FAR and FRR on the threshold value. The following picture shows an example of such a graph: of authentication can be made possible by the use of multimodal biometric systems. 5.1 Modes of Operation A multimodal biometric system can operate in one of three different modes: serial mode, parallel mode, or hierarchical mode. In the serial mode of operation, the traits are applied one by one; the output of one biometric trait is typically used to narrow down the number of possible identities before the next trait is used. In the parallel mode of operation multiple traits are used simultaneously to perform recognition. In the serial mode we could have come to the decision without acquiring all the traits, in that case it s the decision of the system manager to either not to use the leftover traits or to use all the traits for better decision making. 5.2 Levels of Fusion Multimodal biometric systems integrate information data offered by multiple biometric indicators. The information can be consolidated at various levels. Figure 3 illustrates the three levels of fusion when combining two or more biometric systems. These are: Figure 2: Dependency of the FAR & FRR on the Threshold Value The curves of FAR and FRR cross at the point where FAR and FRR are equal. This value is called the equal error rate (ERR) or the crossover accuracy generally does not have any practical use, but it indicates the accuracy of the device. If we have two devices with the equal error rates of 5% and 10% then we know that the first device crossover is more accurate (i.e., does fewer errors) than the other. 5. MULTIMODAL BIOMETRICS Some of the limitations imposed by unimodal biometric systems can be overcome by using multiple biometric modalities. In a multimodal system more than one biometric trait are used for the identification purpose and expected to be more reliable due to the presence of multiple, independent pieces of evidence. Further, multimodal biometric systems provide anti-spoofing measures by making it difficult for an intruder to simultaneously spoof the multiple biometric traits of a legitimate user. By asking the user to present a random subset of biometric, the system ensures the liveliness of the user in some degree. Thus, a challenge-response type Figure 3: Different Levels of Fusion in a Parallel Fusion Mode: a) Fusion at the Feature Extraction Level; b) Fusion at Matching Score (Confidence or Rank) Level; c) Fusion at Decision (Abstract Label) Level. In all the Three Cases, the Final Class Label is Accept or Reject when the Biometric System is Operating in the Verification Mode or the Identity of the Best Matched User when Operating in the Identification Mode. In c) the Intermediate Abstract Label(s) could be Accept or Reject in a Verification System or a Subset of Database Users in an Identification System.

4 290 International Journal of Computer Science and Communication (IJCSC) a. Fusion at the sensor level: The data acquired by different sensor must be compatible to perform the fusion at the sensor level, but it is very rare in case of biometric sensor. So the fusion at the sensor level is very rare. b. Fusion at the feature extraction level: Unique features are exacted from the data acquired from each biometric trait. If the features extracted from different indicators are independent of each other, then it is reasonable to concatenate the vectors into a single new vector, provided the features from different biometric indicators are in the same type of measurement scale. We can also use feature reduction techniques to extract a small number of salient features from the larger set of features. c. Fusion at the matching score level: Each biometric matcher provides a similarity score indicating the proximity of the input feature vector with the template feature vector. These scores can be combined to assert the accuracy of the claimed identity. Techniques such as weighted averaging may be used to combine the matching scores reported by the multiple matchers. d. Fusion at the decision (abstract label) level: Based on its own feature vector each biometric system makes its own identification decision. We can use a majority vote scheme to make the final recognition decision. 6. BIOMETRIC SECURITY No Biometric System is fully fool proof. Several different levels of attacks that can be launched against a biometric system are (Figure 4): (i) a fake biometric trait such as an artificial finger may be presented at the sensor, (ii) illegally intercepted data may be resubmitted to the system, (iii) the feature extractor may be replaced by a Trojan horse program that produces pre-determined feature sets, (iv) legitimate feature sets may be replaced with synthetic feature sets, (v) the matcher may be replaced by a Trojan horse program that always outputs high scores thereby defying system security, (vi) the templates stored in the database may be modified or removed, or new templates may be introduced in the database, (vii) the data in the communication channel between various modules of the system may be altered, and (viii) the final decision output by the biometric system may be overridden[7]. Many researches have been done to secure the biometric data and template using cryptography, steganography and watermarking. In cryptography, the secret message is scrambled using a encryption key, this scrambled message is transmitted through the insecure public channel. And at the receiver site the original message is reconstructed using the appropriate decryption key. In steganography, the secret message is embedded in another message. Using this technology even the fact that a secret is being transmitted has to be secret. This makes these attacks considerably more difficult to achieve. But steganography is more secure than cryptography because there is no separate key in steganography rather key is inbuilt in the template. Figure 4: Various Attack Levels on a Biometric System 7. SUMMARY Nowadays a reliable personal recognition system is very essential for many business processes. The conventional recognition processes (knowledge-based and tokenbased methods) is not able to provide positive personal recognition because they rely on stand-in representations of the person s identity (e.g., exclusive knowledge or possession). It is thus obvious that any system assuring reliable personal recognition must necessarily involve a biometric component. Biometric-based systems also have some limitations that may have adverse implications for the security of a system. Security is a risk management strategy that identifies controls, eliminates, or minimizes uncertain events that may adversely affect system resources and information assets. The security level of a system depends on the requirements of an application and the cost-benefit analysis[8]. Proper design and implementation of the biometric system can indeed increase the overall security. REFERENCES [1] Anil K. Jain Michigan State University, E. Lansing, Michigan and Ruud Bolle and Sharath Pankanti IBM, T.J. Watson Research Center Yorktown Heights, New York Kluwer Academic, Biometrics Personal Identification in Networked Society, 2002 Kluwer Academic Publishers New York, Boston, Dordrecht, London, Moscow. [2] Anil K. Jain, Michigan State University, USA, Patrick Flynn University of Notre Dame, USA, Arun A. Ross West Virginia University, USA, Handbook of Biometrics, [3] R. Clarke, Human Identification in Information Systems: Management Challenges and Public Policy Issues, Information Technology & People, 7, No. 4, pp. 6-37, 1994.

5 Biometric Technology: A Review 291 [4] Anil K. Jain, Arun Ross and Salil Prabhakar, An Introduction to Biometric Recognition, IEEE Transactions on Circuits and Systems for Video Technology, Special Issue on Image- and Video-Based Biometrics, 14, No. 1, January [5] Zdenek Riha Vaclav Matyas, Faculty of Informatics Masaryk University, Biometric Authentication Systems, Report Series, [6] An Introduction to Biometrics, White Paper by Motorola, [7] Biometrics, Chapter 1, Implementing Biometric Security. [8] Andrzej Drygajlo (2007), Speech Processing and Biometrics Group, Signal Processing Institute Ecole Polytechnique Federale de Lausanne (EPFL), Biometrics Lectures.