BIOMETRICS

R.SINDHURA REDDY Computer Science and Engineering Sri Venkateswara Institute of Science and Technology, Kadapa Mail: sindhura.cse@gmail.com Abstract: Over the last few years a new area of engineering science has been established whose products are likely to create a large market in the near future. It has been called ''biometrics". The pioneers of this new domain intend to construct devices which would allow identification of a person on the basis of his/her ''biological'' characteristics: voice, dynamics of movements, features of face and other parts of the body, retina or iris pattern. Nature has made human beings with different characteristics which may vary from one person to another. This property is made use of by Biometric technology to distinctly identify each person Biometric system is essentially a pattern recognition system which recognizes a user by determining the authenticity of a specific physiological or behavioral characteristic possessed by the user. Several important issues must be considered in designing a practical biometric system. First, a user must be enrolled in the system so that his biometric template can be captured. This template is securely stored in a central database or a smart card issued to the user. The template is retrieved when an individual needs to be identified. Depending on the context, a biometric system can operate either in a verification (authentication) or an identification mode. P.DIVYA Computer Science and Engineering Sri Venkateswara Institute of Science and Technology, Kadapa Mail: pdivya562@gmail.com

Introduction:
Biometrics refers to the automatic identification of a person based on his/her physiological or behavioral characteristics. This method of identification offers several advantages over traditional methods involving ID cards (tokens) or PIN numbers (passwords) for various reasons: (i) the person to be identified is required to be physically present at the point-ofidentification; (ii) identification based on biometric techniques obviates the need to remember a password or carry a token. With the increased integration of computers and evolved over the past years. The traditional method which is used by law enforcement

Internet into our everyday lives, it is necessary to protect sensitive and personal data. By replacing PINs (or using biometrics in addition to PINs), biometric techniques can potentially prevent unauthorized access to ATMs, cellular phones, laptops, and computer networks. Unlike biometric traits, PINs or passwords may be forgotten, and tokens like passports and driver's licenses may be forged, stolen, or lost.

Fingerprint recognition:

Technologies for scanning fingerprints have agencies for over a hundred years now is making a copy of the print that is found at a

crime scene or any other location and manually examining it to find minutiae. These minutiae are compared with prints from a database or specific ink prints, which could be taken at a later time. This method is of course based on the fact that the person who left the fingerprints is not co-operating by placing his finger on a fingerprint scanner. For systems that are commercially available (and deployed) people are required to co-operate in order to gain access to whatever is protected by the verification system. The first generation fingerprint scanners appeared on the market in the mid eighties, so the technology is about fifteen years old. Over the past few years the technology for scanning fingerprints for commercial purposes has evolved a lot. While the first generation sensors used optical techniques to scan the finger, current generation sensors are based on a variety of techniques. The following techniques are deployed in commercial products that are currently available:

virtually any machine. Currently a sensor is in development that will be built in a plastic card the size of a credit card, not only with respect to length and width but also with respect to thickness! It is clear that this type of sensor will give a boost to the number of applications using fingerprint technology.

Optical Sensors
With optical sensors, the finger is placed or pushed on a plate and illuminated by a LED light source. Through a prism and a system of lenses, the image is projected on a camera. This can be either a CCD camera or, its modern successor, a CMOS camera. Using frame grabber techniques, the image is stored and ready for analysis.

Ultrasonic Sensors
Ultrasonic techniques were discovered when it was noticed that there is a difference n acoustic impedance of the skin (the ridges in a fingerprint) and air (in the valleys of a fingerprint). The sensors that are used in these systems are not new, they were already being deployed for many years in the medical world for making echo's. The frequency range, which these sensors use, is from 20kHz to several GigaHertz. The top frequencies are necessary to be able to make a scan of the fingerprint with a resolution of about 500 dots per inch (dpi). This resolution is required to make recognition of minutiae possible.

Optical sensors with CCD or CMOS cameras Ultrasonic sensors Solid state electric field sensors Solid state capacitive sensors Solid state temperature sensors

The techniques will be described in greater detail in this section. The solid state sensors are so small that they can be built into

Electric Field Sensors

This solid state sensor has the size of a stamp. It creates an electric field with which

an array of pixels can measure variations in the electric field, caused by the ridges and valleys in the fingerprint. According to the manufacturer the variations are detected in the conductive layer of the skin, beneath the skin surface or epidermis.

Capacitive Sensors
Capacitive sensors are, just as the electric field sensors, the size of a stamp. When a finger is placed on the sensor an array of pixels measures the variation in capacity between the valleys and the ridges in the fingerprint. This method is possible since there is a difference between skin-sensor and air-sensor contact in terms of capacitive values.

between a finger and a well-created dummy. Note that this is contrary to what some of the producers of these scanners claim in their documentation. We will prove the statement by accurately describing two methods to create dummies that will be accepted by the scanners as true fingerprints. The two methods vary based on the cooperation of the fingerprint owner. Although there will without doubt be more ways to counterfeit fingerprints, the methods described in this article should suffice to show that all current scanners can be fooled. Results of tests of current scanners can be found in Appendix C.

Duplication With Co-operation

Duplication of a fingerprint with cooperation of its owner is of course the easiest method since it is possible to compare the dummy with the original fingerprint on all aspects and adapt it accordingly. First, a plaster cast of the finger is created. This cast is then filled with silicon rubber to create a wafer-thin silicon dummy (see also Figure 1). This dummy can be glued to anyone's finger without it being noticeable to the eye. For a thorough description of how to create such a dummy, we refer to Appendix A which describes the materials and tools that can be used. From the appendix it follows that creation of this type of dummy is possible with very liniited means within a few hours.

Temperature Sensors
Sensors that measure the temperature of a fingerprint can be smaller than the size of a finger. Although either width or height should exceed the size of the finger, the other dimension can be fairly small since a temperature scan can be obtained by sweeping the finger over the sensor. The sensor contains an array of temperature measurement pixels which make a distinction between the temperature of the skin (the ridges) and the temperature of the air (in the valleys).

Counterfeiting Fingerprints
The biggest problem when using biometrical identification on the basis of fingerprints is the fact that, to the knowledge of the authors, none of the fingerprint scanners that are currently available can distinguish

Additional Tests of Scanners

The main problem that challenges scanner manufacturers is making a distinction between dummy material that is not alive (i.e. silicone rubber) and material that is in fact not alive as well, the epidermis of a finger. Much research is done to make sure that a living finger is behind the epidermis. This research focuses on properties such as temperature, conductivity, heartbeat, blood pressure etc.. Although the methods are able to distinguish between dummies and real fingers, their operation margins have to be adjusted so radically to effectively operate indoors, outdoors, summer and winter, that a wafer-thin silicone rubber that is glued to a real finger easily passes these additional tests of scanners. For each of the possible additional tests for living fingers, a description will be given how dummies can be accepted by these systems.

Duplication Without Co-operation

For duplication of a fingerprint without cooperation of its owner it is necessary to obtain a print of the finger from for example a glass or another surface. One of the best ways to obtain such a print could be the fingerprint scanner itself. If the scanner is cleaned before a person will be using it, an almost perfect print is left on the scanner surface since people tend to press their finger (which is the verification finger!) firmly on the scanner. Some more expertise is required to create a dummy from such a print, but every dental technician has the skills and equipment to create one. An accurate description of how to create a dummy Of the fingerprint can be found in Appendix B. A picture of a stamp that is created using this method can be found in Figure 2.

Temperature
In a normal environment the temperature of the epidermis is about 8-10 degrees Celsius above the room temperature (18-20 degrees Celsius). By using the silicone rubber as described in Appendix A, the temperature transfer to the sensor decreases by at most 2 degrees if compared to a regular finger. It is clear that the difference falls with normal margins that are used on this system (at least 26-30 degrees). Sensors that are also capable of working outdoors are set to accept finger temperatures in an even broader range. Even when these sensors are compensating the fact that they

are used outdoors, wafer-thin silicone rubbers won't be detected.

Conductivity
With most fingerprint scanners it is possible to add sensors which measure the conductivity of the finger. The conductivity of a regular finger is dependent on the type of skin (normal or dry). A normal conductivity value is about 200k Ohm (also dependent on the type of sensor), but the same finger will have a conductivity of several mega-Ohms during dry freezing winter weather and only several kilo-Ohms during summer when it is sweaty. Taking this into account, it is obvious that the margins are so large that putting some saliva on the silicone dummy will fool the scanners into believing it is a real finger.

fingerprint is scanned. Moreover, the heartbeat of the underlying finger will be detected and accepted when a wafer-thin silicone rubber is used.

Relative Dielectric Constant

The dielectric constant of a specific material reflects the extent to which it concentrates the electrostatic lines of flux. Some manufacturers use the fact that the Relative Dielectric Constant (RDC) of human skin is different from the RDC of, for example, silicone rubber. just as with conductivity measurement in fingerprint scanners, the RDC is influenced by the humidity of the finger. To prevent an unacceptably high FRR, the margin of operation should be rather large. Putting some spirit on the silicone rubber with a wad of cotton wool before it is pressed on the fingerprint scanner fools the additional dielectric sensor. Spirit consists of 90% alcohol and 10% water. The RDCs of alcohol and water are 24 and 80 respectively, while the RDC of a normal finger is somewhere between these two values. Since the alcohol in the spirit will evaporate quicker than the water, the rate alcohol/water in the evaporating spirit will go to 0 (i.e. spirit slowly turns into water). During evaporation the RDC of the dummy will go up until it falls within the margins of the scanner and will be accepted as a real finger.

Heartbeat
Several scanner manufacturers claim to detect a living finger by detecting the heartbeat in the tip of the finger. This is very well possible, although some practical problems arise from this. People actively participating in a sport can have heart rhythm of less than forty beats per minute, meaning that they should keep their finger motionless on the sensor for at least four seconds for the rhythm to be detectable. Also, the diversity in heart rhythm of a single person makes it virtually impossible to use it to take a person's heart rhythm into account when scanning the fingerprint. For example, the next day the same sportsman can have a heart rhythm of eighty beats per minute (doubled) if he decides to take the stairs instead of the elevator, just before his

Blood Pressure
There are sensors available with which the blood pressure can be measured by using two different places on the body. They require a measurement of the heartbeat on

two different places to determine the propagation speed of the heart pulse through the veins. Apart from the disadvantages that were already mentioned with the heartbeat sensors, this technique has an additional disadvantage in requiring measurement on two different places, i.e. on two hands. Similar to the heartbeat sensors, this method is not susceptible to a wafer-thin silicone rubber glued to a finger. Single point sensors are available but they must be entered directly in a vein, which obviously makes them unusable as a biometric sensor.

is attached. Making sure that the two line patterns are in exact matching positions is no problem for a dental technician.

Other Claims
Some manufacturers claim to use even more exotic detection methods and technique than the ones described above, making claims to having built a sensor which is not even known or being used in medical science. Additionally, they refuse to reveal the detection method claiming it is a company secret. Claims by these manufacturers should, without a doubt, be considered nonsense! In general, security by obscurity (trust that, by keeping specifications secret, the system will not be broken) should never be used. Although obscurity can make it more difficult for people to break the system in a brief period after introduction, most systems can be reverse engineered or worked around in ways the designers never expected.

Detection Under Epidermis

Some systems focus on detection of the pattern of lines underneath the epidermis. The pattern of lines on this layer is identical to the pattern of lines in the fingerprint. Although this type of sensors look underneath the first layer doesn't mean that they cannot be fooled by dummy fingers, once it is known how they distinguish between the epidermis and the underlying layer. Some methods use the fact that the underlying layer is softer and more flexible than the epidermis (ultrasonic sensors could use this), while others focus on the higher electric conductivity of the underlying layer. Once it's known which property the sensor uses, a second silicone rubber with matching properties can be created. It is more difficult to create a dummy that is wafer-thin as described in Appendix A, but for a dummy as described in Appendix B it is rather easy. First, a conductive, soft or more flexible rubber print is made which can be used as the basis to which the regular silicone rubber

Consequences Possibilities

of

Counterfeit

The possibility to make a dummy, which will be accepted by the fingerprint scanner makes the system weak with respect to some different attacks: 1. A malicious person who wants to gain access, inconspicuously intercepts a fingerprint from someone who is granted access. With this print, a dummy is created. 2. If a righteous person is willing to cooperate, one or several dummies can be

created with which this individual can give access to whomever he wishes. 3. If a righteous person handles a transaction, he can claim to be framed by a malicious person as described in point 1. While the first two attacks on the system are possible with most verification systems, e third claim can usually be disproved since the person making the claim must have revealed something. An example is fraud with a PIN protected credit card. If the fraud is committed using the PIN code, the probability that its owner has not been careful with the PIN is much higher than the probability that the PIN system is broken. But the fingerprint verification system is very susceptible to this attack since we all leave behind fingerprints everyday, everywhere without noticing it. As long as it is still possible to use either the method from this article, or other methods to work around a fingerprint verification system, deplient of such systems is unsuitable for virtually any application.

then be compared to enormous databases of facial images to identify the subject. Good biometric software then produces a number of potential matches, rating each based on a numeric score of how similar the match is. When multiple images are used, the accuracy ofbiometric readings increases greatly, a fact which has provoked the assembly of massive databases, particularly on key figures such as terrorists. Biometric face recognition is currently used in a handful of American airports, and was used at the 2001 Super Bowl to guard against the perceived threat of a terrorist attack. Nineteen individuals were flagged at the Tampa Super Bowl as having criminal records, but upon closer examination all had only minor infractions on their record.

Vascular patterns
Biometrics, such as with vein recognition, refers to methods for recognizing individual people based on unique physical and behavioral traits. Physiological biometrics is one class of biometrics that deals with physical characteristics and attributes that are unique to individuals. Vein recognition is a type of biometrics that can be used to identify individuals based on the vein patterns in the human finger. Vein recognition is a fairly recent technological advance in the field of biometrics. It is used in hospitals, law enforcement, military facilities and other applications that require very high levels of security. Vein recognition biometric devices can also be used for PC login, bank ATM identification verification, and many other applications such as opening car

Facial recognition:
Biometric face recognition works by using a computer to analyze a subject's facial structure. Face recognition software takes a number of points and measurements, including the distances between key characteristics such as eyes, nose and mouth, angles of key features such as the jaw and forehead, and lengths of various portions of the face. Using all of this information, the program creates a unique template incorporating all of the numerical data. This template may

doors.Vein recognition biometrics is a particularly impressive and promising technology because it requires only a single-chip design, meaning that the units are relatively small and cheap. The ID verification process is very fast and contactless. Using a light-transmission technique, the structure of the vein pattern can be detected, captured and subsequently verified. The user's vein pattern structure is image processed by the device and stored in a relevant data repository in the form of digital data. Many feel that vein recognition biometrics can produce higher accuracy rates than finger print recognition and finger vein patterns are virtually impossible to forge. Of the many new biometric technologies such as DNA, Iris recognition, ear and body odor recognition, vein recognition, with its own unique characteristics and advantages is now emerging as one of the fastest growing technologies. Vein recognition is the newest type of biometric technology and is quickly moving from labs to widespread commercial development. One reason that vein recognition has such great potential for explosive growth, and may one day be the leading biometric technology in the world is its potential to be applied in several unique forms. There is a wide selection of great companies that have all developed different kinds of vein recognition biometric technologies. There are a variety of methods for vein recognition biometric technology. Some companies have developed devices that scan the vein structure pattern in the index finger, or more than one finger at a time. Others

have developed vein recognition devices designed for reading the vein patterns located under the palm and at the back of the hand. The variety of devices available gives a wide selection of choices for consumers to meet different needs and demands. Another reason for the fast emergence of vein recognition biometrics is very, very low False Rejection and False Acceptance Rates. Vein patterns are unique to each individual and they do not change over time except in size so it is hardly possible to fool the technology. Vein recognition technology has a False Rejection Rate of 0.01% and a False Acceptance Rate of 0.0001% and so it is arguably the most suitable for highsecurity deployment. The potential for vein recognition biometric technologies is very promising for many reasons. Vein recognition biometric devices are often small, portable and affordable because they often use a single-chip design. It often takes less than two seconds for a vein recognition biometric device to authenticate the user, and contact is not necessary. Other promising facts about vein recognition biometric technologies include their capability to fuse with existing biometric technologies. Vein recognition can be used along with fingerprint and hand geometric technology, provide one-to-many matching and also enhance security and decrease vulnerability for fraud. Today vein recognition biometric technology is most commonly found in the Asia Pacific region. Due to some controversy surrounding fingerprint biometrics, vein recognition has found widespread acceptance in the Asian Pacific.

Adoption of vein recognition technologies has been highest among financial institutions and it is used commonly for ATM identity verification and PC login authentication where high security is a necessity.

Iris recognition
Iris recognition is a method of biometric authentication that uses patternrecognition techniques based on highresolution images of the irides of an individual's eyes. Not to be confused with another, less prevalent, ocular-based technology, retina scanning, iris recognition uses camera technology, with subtle infrared illumination reducing specular reflection from the convex cornea, to create images of the detail-rich, intricate structures of the iris. Converted into digital templates, these images provide mathematical representations of the iris that yield unambiguous positive identification of an individual. Iris recognition efficacy is rarely impeded by glasses or contact lenses. Iris technology has one of the smallest outlier groups (those who cannot use/enroll) of any biometric technology. A key advantage of iris recognition is its stability, or template longevity, as, barring trauma, a single enrollment can last a lifetime. Breakthrough work to create the irisrecognition algorithms required for image acquisition and one-to-many matching was pioneered in the early 2000s by John G. Daugman, Ph.D, OBE (University of Cambridge Computer Laboratory). These were utilized to effectively debut

commercialization of the technology in conjunction with an early version of the Iris Access system designed and manufactured by Korea's LG Electronics. Daugman's algorithms are the basis of almost all currently (as of 2006) commercially deployed iris-recognition systems. (In tests where the matching thresholds arefor better comparabilitychanged from their default settings to allow a false-accept rate in the region of 103 to 104 , the Iris Code false-reject rates are comparable to the most accurate single-finger fingerprint matchers

Operating principle

An IriScan model 2100 iris scanner An iris-recognition algorithm first has to identify the approximately concentric circular outer boundaries of the iris and the pupil in a photo of an eye. The set of pixels covering only the iris is then transformed into a bit pattern that preserves the information that is essential for a statistically

meaningful comparison between two iris images. The mathematical methods used resemble those of modern lossy compression algorithms for photographic images. In the case of Daugman's algorithms, a Gabor wavelettransform is used in order to extract the spatial frequency range that contains a good best signal-to-noise ratio considering the focus quality of available cameras. The result is a set of complex numbers that carry local amplitude and phase information for the iris image. In Daugman's algorithms, all amplitude information is discarded, and the resulting 2048 bits that represent an iris consist only of the complex sign bits of the Gabor-domain representation of the iris image. Discarding the amplitude information ensures that the template remains largely unaffected by changes in illumination and virtually negligibly by iris color, which contributes significantly to the long-term stability of the biometric template. To authenticate via identification (one-tomany template matching) or verification (one-to-one template matching), a template created by imaging the iris is compared to a stored value template in a database. If the Hamming distance is below the decision threshold, a positive identification has effectively been made. A practical problem of iris recognition is that the iris is usually partially covered by eyelids and eyelashes. In order to reduce the false-reject risk in such cases, additional algorithms are needed to identify the locations of eyelids and eyelashes and to exclude the bits in the resulting code from the comparison operation.

Advantages
The iris of the eye has been described as the ideal part of the human body for biometric identification for several reasons:

It is an internal organ that is well protected against damage and wear by a highly transparent and sensitive membrane (the cornea). This distinguishes it from fingerprints, which can be difficult to recognize after years of certain types of manual labor. The iris is mostly flat, and its geometric configuration is only controlled by two complementary muscles (the sphincter pupillae and dilator pupillae) that control the diameter of the pupil. This makes the iris shape far more predictable than, for instance, that of the face. The iris has a fine texture thatlike fingerprintsis determined randomly during embryonic gestation. Like the fingerprint, it is very hard (if not impossible) to prove that the iris is unique. However, there are so many factors that go into the formation of these textures (the iris and fingerprint) that the chance of false matches for either is extremely low. Even genetically identical individuals have completely independent iris textures. An iris scan is similar to taking a photograph and can be performed from about 10 cm to a few meters away. There is no need for the person to be identified to touch any equipment that

has recently been touched by a stranger, thereby eliminating an objection that has been raised in some cultures against fingerprint scanners, where a finger has to touch a surface, or retinal scanning, where the eye can be brought very close to a lens (like looking into a microscope lens).

The originally commercially deployed iris-recognition algorithm, John Daugman's IrisCode, has an unprecedented false match rate (better than 1011). While there are some medical and surgical procedures that can affect the colour and overall shape of the iris, the fine texture remains remarkably stable over many decades. Some iris identifications have succeeded over a period of about 30 years.

It is important to recognize that although biometric authentication has served extensively in high security applications in defense industry, it is still fledgling technology in commercial world, both in terms of its technical sophistication and current extent of deployment. There are no established standards for biometric system architecture, for template formation, or even for biometric reader testing. It is also not clear as which technology or technologies will dominate the customer market. In the absence of standards and direction, the rapid and wide spread deployment of biometric authentication system could easily facilitate the problematic proliferation of authentication and tracking of the people.

References:
Jain, Anil K.; Ross, Arun (2008). "Introduction to Biometrics". In Jain, AK; Flynn, P; Ross, A. Handbook of Biometrics. Springer. pp. 122. ISBN 978-0-387-710402. Jain, A.K.; Bolle, R.; Pankanti, S., eds (1999). Biometrics: Personal Identification in Networked Society. Kluwer Academic Publications. ISBN 978-0792383451. CHARACTERISTICS OF BIOMETRIC SYSTEMS". Cernet. McConnell, Mike (January 2009). "KeyNote Address.". Biometric Consortium Conference. Tampa Convention Center, Tampa, Florida,. Retrieved 20 February 2010 Kent,Jonathan(31March2005). "Malaysia carthievesstealfinger".BBCOnline(KualaLu mpur).Retrieved11December2010.

Conclusion:
The advances in accuracy and usability and decreasing cost have made the biometric technology a secure, affordable and cost effective way of identifying individuals. Biometric parameters such as fingerprint scanning, iris scanning, retinal scanning, hand geometry, signature verification, voice verification and others are all well established with their own particular characteristics. The limiting factors of speed and band width are now a thing of the past and their practical performance might in many instances be better than expected. Today, it is an efficient and effective method of replacing passwords, tokens and smart cards.