SETIT 2005 3 rd Internatonal Conference: Scences of Electronc, Technologes of Informaton and Telecommuncatons March 27-31, 2005 TUNISIA Secure and Fast Fngerprnt Authentcaton on Smart Card Y. S. Moon*, K.F. Fong* and K. C. Chan * * Department of Computer Scence and Engneerng The Chnese Unversty of Hong Kong ysmoon@cse.cuhk.edu.hk kffong@cse.cuhk.edu.hk kcchan@cse.cuhk.edu.hk Abstract: In a tradtonal fngerprnt verfcaton system equpped wth smart card, the smart card plays a data storage role for storng the cardholder's fngerprnt data whch s often nsecurely released to a computer for fngerprnt matchng. In vew of such defcency, we propose a fast n-card matchng technque to allow the matchng process be conducted nsde a smart card. Our work accomplshes ts performance through the locaton of a reference pont n each fngerprnt and the careful control of the number of features to be matched. Expermental results show that accurate fngerprnt matchng can be acheved n fe w seconds. Key words: Mnutae matchng, reference pont, smart card. 1 Introducton In most tradtonal mplementatons, users bometrcs data are stored n a centralzed database on a server, as shown n Fgure 1 [1]. At the pont of verfcaton, the personal nformaton s downloaded from the server and s compared wth the one scanned lvely. There are several dsadvantages n such an mplementaton: the server may not be avalable all the tme; personal data may be stolen durng the transfer over the network or at the server. Fgure 1. A tradtonal onlne verfcaton system The overall fngerprnt authentcaton could be dvded nto mage pre -processng, mnutae extracton and mnutae matchng stages. Wth the adopton of smart card technology, we propose a secure authentcaton system, n whch the mnutae matchng, referrng to the comparson of mnutae (fngerprnt features) obtaned lvely and the ones saved n the smart card, s performed safely on smart card wthout any personal nformaton leakng out. In our prevous study [7], a doman -specfc fxedpont arthmetc for usng a 32-bt RISC smart card processor was employed to perform the n-card matchng of the fngerprnt templates. The smart card processor could only perform the nteger arthmetc and our fxed-pont representaton utlzed the redundant upper part of the 32-bt word length to emulate a 2-decmal places floatng pont computaton. We analyzed the runnng speed of dfferent arthmetc operatons and concluded that a 32-bt RISC smart card processor was capable to accomplsh the entre mnutae matchng calculaton wthn 10 seconds. Latter, the average poston and orentaton of the mnutae set were used as the reference nformaton for a fngerprnt template [8]. The fngerprnt templates could be pre -algned n the host computer before they were compared nsde the smart card. Hence, we could acheve a real-tme matchng performance (~ 1s) usng a 5 MHz Java card [9]. Snce the average poston and orentaton were dependent
on the number of mnutae extracted, such reference pont mght not be accurate and the result could deterorate and bas n some cases [8]. In addton, t consumed 3 seconds to download a fngerprnt template to the smart card. The total tme for a complete process was about 4 seconds. In ths paper, we propose a new matchng paradgm to enable the fngerprnt matchng nsde the smart card by: (1) usng an accurate reference pont [5] for pre-algnment of the mnutae template. (2) Reducng the total matchng mnutae n order to shorten the data transfer tme and matchng tme. An overvew of our fast fngerprnt authentcaton on smart card s descrbed n Secton II. The detals of mplementaton and methodology are presented n Secton III and IV. Expermental results supportng our approach are shown n Secton V. In the last secton, we conclude our work. 2 New Desgn Overvew Fgure 2 shows our proposed fngerprnt authentcaton system, n whch a desktop computer hosts a smart card reader. The fngerprnt sensor s used to capture fngerprnts. The fngerprnt template, havng the mnutae nformaton, s transferred to the smart card through the smart card reader. The data transfer s protected by the encrypton functon, lke 3DES [10]. Our fngerprnt authentcaton algorthm nvolves two man modules: 1). Mnutae extracton conducted on the host computer, extracts features of the fngerprnt mage called mnutae. Mnutae generally refer to the rdge ends and branches that consttute a fngerprnt pattern. 2). Mnutae matchng conducted on the smart card, compares the mnutae n the lvely scanned fngerprnt template and those n the master fngerprnt template saved n the smart card. If the score obtaned from the mnutae matchng process s greater than a pre-defned threshold, a user wll be recognzed as the vald cardholder. Fgure 2. A new fngerprnt authentcaton system 3 Fast Fngerprnt Matchng To have a fast fngerprnt authentcaton system, we propose an asymmetrc fngerprnt verfcaton process, whch requres the desktop computer to fnsh the computatonal ntensve jobs: mnutae extracton, mnutae template selecton and the mnutae template algnment. As a consequence, the smart card can utlze ts lmted processng power to complete the lght-weghted mnutae matchng. 3.1 Reference Pont Detecton To facltate algnment of two fngerprnt mages, we requre a reference pont and the orentaton of each mage. A reference pont s defned as the locaton where a maxmum drecton change s detected n a drecton mage of the fngerprnt or t s a pont where the drectonal feld s dscontnuous [3]. To obtan an accurate and unque reference pont, we apply the sn component flter descrbed n [5]. After obtanng the reference pont locaton (corex, corey), we proceed to calculate ts approxmate orentaton by analyzng the upper parts of ts orentaton feld and compute the relatve average poston (AvgX, AvgY) of the mnmum orentatons found. The orentaton of the reference pont s computed by : core _ Orent = arctan( AvgY / AvgX ) 3.2 Normalzaton of the mnutae coordnate After the reference pont s located, we wll extract the mnutae nformaton of each fngerprnt usng the drect grayscale approach [4]. The extracted mnutae nformaton s stored as ts x,y-coordnates, orentaton and mnutae type. Here, the reference pont and mnutae ponts are represented n Cartesan Co-ordnate system. We wll then convert the mnutae
ponts n polar Co-ordnate system snce the rotated mnutae wll be translatonal and rotatonal nvarant wth respect to the reference pont n polar coordnate representaton. The converson adopts the followng equatons usng the reference pont as the pole: r = ( r, θ ) s 2 2 ( x core ) + ( y core ) where (x, y the polar coordnates of rotated mnuta ) s the Cartesan coordnates of ( core, core ) s the Cartesan x s the mnutaorentato n coordnates of θ s the mnuta orentaton after rotaton y 1 core y α = tan x core x θ = α core α x orent y y mnuta the core pont As a consequence, algnment s not necessary to be conducted on smart card, whch s dfferent from the mplementaton n [6] [7]. We smply compare the rad (the dstance between the mnuta and the reference pont) and orentatons of mnutae of master and lve fngerprnt mages. 3.3 Mnutae Extracton on a Small Crcular Area After transformaton, the mnutae wll be sorted accordng to the dstances from the reference pont n ascendng order. We wll select a certan number of mnutae from the mnutae lst and form the master template. At the pont of authentcaton, we frstly locate the reference pont of the lvely captured fngerprnt mage. Afterwards, we wll extract the mnutae ponts located nsde a small boundng area centered at the reference pont. Hence, ths reduces the processng tme n mnutae extracton. The accuracy of usng dfferent mnutae n our algorthm, as well as the speed of usng dfferent numbers of mnutae n matchng on smart card wll be evaluated va experments. The detals wll be covered n the latter part. 3.4 Convert the Mnutae Vector n Bnary Format We wll convert the fngerprnt data nto bnary format so that the fngerprnt template s small enough to be downloaded to the smart card at once. Each mnutae vector s 7 bytes, n Fgure 3, contanng four data: theta, radus, orentaton and class type. Theta (2 bytes) Radus (1 byte) Fgure 3. A Mnutae Vector 3.5 Mnutae Matchng Orentaton (2 bytes) Class Type (1 byte) We only need to perform a smple pont-to-pont matchng nsde the smart card snce the mnutae coordnate s normalzed, mentoned n the prevous secton. It s not necessary to scan the whole lve mnutae lst. We only need to compare the master and lve mnutae whose radus dfference s fallen wthn the threshold boundares (-radus_threshold to +radus_threshold). Hence, the runtme of the matchng routne should be only O(MN) whch s less than O(N2) as proposed n [7][8]. For each feature vector n the template, t contans the dstance of mnuta to the reference pont (r), mnutae orentaton (α), rotated orentaton (θ). For two mnutae, f ther dstance and orentaton dfferences are wthn some threshold values,.e. r1- r2 <r_threshold and α1-α2 <α_threshold n our mplementaton, they are regarded as matched. We wll then assgn marks to a matched lve mnuta accordng to ts Eucldean dstance. Moreover, marks wll be adjusted accordng to the dfference between ther rotated orentatons. If the dfference s smaller than a defned threshold value (they are very close),.e. θ1-θ2 < threshold, the mark wll be multpled. We use the followng Matchng routne to match two fngerprnts: Sub Comparson If (rad between mnuta and j <=radus_threshold) M = M + 1 If (orentaton between mnuta and j <=orent_threshold Regard j as Matched Mark = a fxed value orentaton x dstance dfference If (rotated orentaton between mnuta and j <= threshold) Mark s multpled End Sub Routne Matchng Matchj = 1 M = 0 For = 1 to Mnutae_Number N For j= 1 to Matchj + M call Comparson For j=1 to Matchj - M call Comparson If (> 1 j s are marked) Resolve conflct by choosng the j wth the hghest mark MatchedJ = j
Delete the correspondng j n the set of mnutae n lve template End Routne The matchng score wll be between 1 and 100. If the score s hgher than a predefned value, the user s authentcated as the vald cardholder. Otherwse, the user may repeat the authentcaton process to verfy hs dentty agan. 4. Implementaton The matchng score wll be between 1 and 100. If the score s hgher than a predefned value, the user s authentcated as the vald cardholder. Otherwse, the user may repeat the authentcaton process to verfy hs dentty agan. 4.1 Apparatus We use a desktop computer, wth a Pentum processor, as our development platform. The computer s nstalled wth Redhat Lnux 9. The PC hosts an ATMEL [11] fngerprnt sensor and a Gemplus [9] smart card reader va GPIO and seral ports respectvely. The ATMEL fngerprnt chp s the world s smallest fngerprnt sensor. Moreover, ts patent method for magng the fnger by sweepng across the chp enables the sensor to be self-cleanng snce no hdden prnt s left on the sensor surface. It well suts for frequent publc access snce fngerprnt data cannot be stolen. The smart card s equpped wth an 8-bt Java processor, 512 bytes of RAM and 32 K of EEPROM, whch has only nteger arthmetc support. Although the smart card s relatvely old, t s capable of runnng our fast matchng algorthm. 4.2 Codng The whole authentcaton algorthm s dvded nto two parts, mnutae extracton as well as mnutae matchng. mnutae as well as the speed of the complete process. 5.1 Accuracy of the Matchng Algorthm The accuracy of our proposed system was evaluated through the smulaton on a PC, whch was nstalled wth Redhat Lnux 9 and JDK1.4.1. The process was executed on a PC because of convenence and reducton n the expermental tme. We only used byte and short Java prmtve types of varables n the matchng program so the Java mnutae matchng code run n ths experment was exactly the same as the one run on the smart card. The experment was run wth a fngerprnt database contanng 383 dfferent fngerprnts. Each person scanned hs/her fnger 3 tmes wth an optcal fngerprnt sensor, whch has a 450 dp resoluton, resultng n 1149 fngerprnt mages n total. The 1149 fngerprnt mages were regstered and ther mnutae data were wrtten nto templates n bnary format correspondngly. Later, we ran a verfcaton test to nvestgate mpact on the accuracy of the fngerprnt matchng wth dfferent mnutae used. If lesser than 6 mnutae were chosen n matchng, the correspondng Equal Error Rate (EER) would dramatcally ncrease. If more than 20 mnutae were used, the correspondng EER were smlar but the matchng tme used ncreased proportonally. Hence, we chose 6, 10 and 18 mnutae as representatves and studed ther correspondng False Accept Rates (FAR) and False Reject Rates (FRR). The FAR and FRR curves were plotted n Fgure 4. The results of the experment were summarzed n Table 1.and t showed that EER were about 9.6%, 7.9% and 7.2% f 6, 10 and 18 mnutae were used for matchng. It was convncng that the use of 6 matchng mnutae, whch yelded an EER about 7%, was suffcent. The mnutae extracton program s wrtten n ANSI C usng the approach descrbed n the above secton. The code s compled wth a gcc compler for the Lnux platform and the executable s about 190K. The mnutae matchng program s developed n Java wth the GemXpresso RAD211 package, whch supports full Java Card 2.1 standard and OP & VOP 2.0 standard. The applet s about 5K, whch consumes fnte smart card memory. 5. Expermental Results In order to prove our system s practcal and relable, we carry out two experments to test the accuracy of the matchng algorthm of usng dfferent Fgure 4. FAR and FRR curves of 6, 10 and 18 matchng mnutae used
Number of Mnutae used EER (%) 6 9.6 10 7.9 18 7.2 Table 1. EERs of the authentcaton algorthm aganst dfferent matchng mnutae 5.2 Speed of the complete process In another experment, we tested the speed of the proposed authentcaton system. We used dfferent number of mnutae n matchng: 10, 18 and 25 mnutae. Snce each feather vector s 12 bytes and the header of each template (number of mnutae) s 2 bytes, the szes of 10, 18 and 25-mnuta templates are 72, 128 and 177 bytes respectvely. The data was downloaded to the smart card n 128 bytes/transfer. Hence, the tme of transferrng a 25-mnuta template fle was twce as much as transferrng a 10-mnuta or 18-mnuta template fle. Table 2 summarzed the average transfer tme of dfferent template szes. The runtme of the algorthm s O(MN), where N s the number of mnutae used n matchng and M s the number of mnutae wthn radus threshold boundares. The runtme was mproved compared to the prevous ones [7][8]. The average tme of the matchng algorthm usng dfferent mnutae were lsted n Table 3. Dfferent Template Average Transfer Tme (s) Szes 10 mnutae template 0.70 (72 bytes) 18 mnutae template 0.70 (128 bytes) 25 mnutae template 1.28 (177 bytes) Table 2. Average tmes of downloadng dfferent szes of templates to smart card *Each test runs 100 tmes. Dfferent Mnutae Average Tme used n used matchng(s) 10 mnutae 1.10 18 mnutae 3.28 25 mnutae 6.49 Table 3. Average Matchng Tmes of dfferent mnutae used *Each test runs 100 tmes. The tme of mnutae extracton s ~10 mllseconds, whch s dependent on the number of mnutae used. It s neglgble when compared to the tme used n data transfer and matchng on the smart card. It s clear that the number of mnutae used greatly affects the tmes of template transfer and mnutae matchng on the smart card. 6. Conclusons The above analyss, wth expermental result support, shows that t s feasble to conduct the fngerprnt matchng usng a 5Hz smart card processor. The accuracy of the matchng algorthm s proven through database wth an acceptable EER of ~7.5% whle the whole fngerprnt authentcaton can be done wthn 2-4 seconds dependng on the number of mnutae used (10-18). However, the bottleneck les on the template transfer to the smart card. It occupes 40% of the total tme f 10 mnutae are used. Nevertheless, our results ndcate that fngerprnt authentcaton on the smart card s fast wth an acceptable level of accuracy. References [1] A. K. Jan; Hong Ln; R. Bolle, On-lne fngerprnt verfcaton, Pattern Analyss and Machne Intellgence, IEEE Transactons on, Vol: 19 Issue: 4, pp.: 302 314, Aprl 1997 [2] A. K. Jan, S. Prabhakar, L. Hong, and S. Pankant, "Flterbank-based fngerprnt matchng," IEEE Transactons on Image Processng, vol. 9, pp. 846--859, May 2000. [3] A. M. Bazen and S.H. Gerez, An Intrnsc Coordnate System for Fngerprnt Matchng, Proceedngs of the 3rd Internatonal Conference on Audo- and Vdeo- Based Bometrc Person Authentcaton, pp. 198-204, June 2001 [4] D. Mao, D. Malton, Drect gray-scale mnutae detecton n fngerprnts, Pattern Analyss and Machne Intellgence, IEEE Transactons on, Volume: 19 Issue: 1, pp.27 40, Jan. 1997. [5] K.C. Chan, Y. S. Moon, P. S. Cheng, "Fast fngerprnt verfcaton usng sub-regons of fngerprnt mages", IEEE Transactons on Crcuts and Systems for Vdeo Technology,Vol. 14, Issue1, pp.95-101, Jan. 2004 [6] R. Sanchez-Rello; C. Sanchez-Avla, Fngerprnt verfcaton usng smart cards for access control systems, Aerospace and Electronc Systems Magazne, IEEE on, Volume: 17 Issue: 9, Sept. 2002, Page(s): 12-15 [7] Y.S. Moon, H.C. Ho, K.L. Ng, A Secure Smart Card System wth Bometrcs Capablty, Proceedngs of the 1999 IEEE Canadan Conference on Electrcal and Computer Engneerng, 1999, pp. 261-266 Vol. 1, May 1999 [8] Y.S. Moon, H.C. Ho, K.L. Ng, S.F. Wan, S.T. Wong, Collaboratve fngerprnt authentcaton by smart card and a trusted host, Proceedngs of the 2000 IEEE Canadan Conference on Electrcal and Computer Engneerng. Pp. 108-112, Vol. 1, 7-10 March 2000 [9] http://www.gemplus.com [10] http://www.cryptx.org [11] http://www.atmel.com