Forgery and presentation attacks are a threat to any biometric modality, but there are common approaches to developing algorithms to detect them that can be applied in industry, said Andrew Wise of Integrated Biometrics at the last Virtual Lunch. of the European Biometric Association. (EAB).
Wise, the company’s chief quality officer, presented IB’s technology, including its light-emitting sensor, and how it works. The electric field that forms when a finger is placed on the scanner, between the scanner and a lower electrode layer. It turns out that this property is useful for detecting biometric presentation attacks, he says.
He then discussed two categories of fingerprint presentation attacks; those with non-conductive materials, which tend to be easier to find and counterfeit with, but not as effective, and those with conductive materials, which are opposed on the above points. IB encountered 10 common species of biometric fingerprint spoofing material, half in each category.
Systems that detect presentation attacks must also be able to detect corpses, Wise points out.
PAD systems tend to be based on either the artifact principle, the color inversion principle, or the conductivity principle, Wise says, although there are many different approaches within them. The Artifact Principle states that copies always inherently contain a characteristic that may betray them, such as the fidelity characteristics that separate a VHS recording of a TV show from its original broadcast. The principle of color inversion refers to the use of a highly reflective color from the original source, and the principle of conductivity is the specialty of Integrated Biometrics.
AI image processing is often used in the fingerprint industry to look for artifacts, according to Wise, but other options include multispectral imaging, subcutaneous ridge detection, and heart rhythm detection. . Some of them can be spoofed themselves, and the methods vary in terms of practicality.
IB Presentation Attack Detection
A featured video demonstrates the effectiveness of IB’s Five-O FAP50 scanner in handling various impersonation materials.
“We had to learn the hard way, just about any way not to build one of these systems,” Wise admits.
Observations from this process include that AI models are only as good as the datasets they are trained on. Wise recommends a first-hand human inspection of over one hundred thousand images to ensure the quality of the dataset.
He showed some of the mistakes IB made in developing its current biometric PAD technology.
Another recommendation is to keep historical samples, especially with chip shortages causing hardware component changes.
Develop relationships with biometric collection services, advises Wise, including dedicated companies, universities and competitions. IB has a large collection of cadaver fingerprints among its benchmarks.
Perfect Notes, Wise can be ‘the enemy of the good enough’, with diminishing returns for near-perfect results. On that same theme, he says that proprietary fingerprint designs, while attractive from a security perspective, have practical performance tradeoffs in the field that outweigh the benefits. On a related note, customers don’t test PAD systems the same way academics do, and companies would do well to embrace the types of tests their products will be evaluated on for purchase.
Any improvement to the PAD system prompts attackers to target a different area of the system, observes Wise, showing a packet analysis of a man-in-the-middle attack on one of Integrated Biometrics’ Kojak scanners. It emphasizes the need for encryption and secure delivery of all software, i.e. not through regular email.
“When you start to do the PAD well, expect attacks elsewhere,” he warns in another of his dozen tips.
Safety, he says, is about wear and tear rather than perfection.
The way to rule out enough attackers to stay ahead of the cost-benefit curve is with creative thinking and a willingness to experiment.
“Get to know your customers, get to know their concerns, and then you put all the spoofs that interest them into some sort of standard battery that you then use in your tests,” advises Wise.
It also benefited IB’s business processes, as PAD testing methods helped make product validation more efficient.
biometric alertness detection | biometrics | biometric research | VAE | European Biometrics Association | Integrated biometrics | presentation attack detection | spoof detection