Fingerprint Authentication Dr. Lynne Coventry What is Biometrics? • Biometrics can be defined as the use of anatomical, physiological or behavioural characteristics to recognise an individual or verify the claimed identity of an individual. • Techniques use characteristics of – Fingerprint Eyes – Face Hands – Voice Signature – Walk Typing 2 Why use Biometrics? • Biometrics techniques are used to confirm that a person is actually present, rather than just their token or identifier. • A name, password, key, card, PIN, number, specific knowledge (e.g. mother’s maiden name) does not confirm the presence of the legitimate owner – they can only confirm that the correct token or knowledge is being used and assume that the user is genuine. 3 Considerations for ATM use • What needs to be considered before deploying a customer-facing biometrics solution at an ATM? – Users – Environment – System 4 User Considerations • User Base (Number of users) • Outliers (People who cannot use system (FTE) • Enrolment + Training requirements • Accessibility issues • Usability (speed, errors, attitude) • Public Acceptance • • • • Perceived Security Privacy Speed Hygiene 5 Why Fingerprint? • Fingerprint is considered one of the most effective techniques but there can be problems with dirt, dry or worn prints and also with very fine prints. • Fingerprint sensors are small and low cost (typ. $10 for sensor) and easy to integrate/replace. • They can be deliberately damaged. • Template sizes tend to be small (<1k) so easy to move and store. • Can match 1-to-1 in few (typically 2) seconds. • Public awareness and exposure. • Requires positive user participation. Contact is necessary. Finger placement is important. 6 Why Radio Frequency? • The system tested has a unique, patented image capture device based on active RF signal detection • It has security, dirt resistance, spoof resistance built in to the chip • Comparing the main variable criteria below to the other main fingerprint image capture techniques it is clearly the best system Technique Size Cost Ease of Use Dirt Affected Wear Affected Easily Duped Optical Small Low Easy Yes Yes Easy Capacitance Small V. Low Easy Yes Yes Easy RF Small V. Low Easy No No Difficult Ultrasound V. Large V. High Easy No Yes Medium Thermal V.Small Low Difficult Yes Yes Medium Pressure Small V. Low Easy Yes Yes Medium 7 Dynamic Optimization: Dry Finger • This example took 4 frames • Executed in about ½ second on a PC 4 Adjust A/D references 3 Increase amplifier gain 2 Increase drive signal 1 In Slow Motion ... 8 Testing Biometrics • Method affects performance achieved • Lab conditions with small homogenous set of good trained young cooperative users • Real world has great variabilty, uninformed and even hostile users • Performance Measures – FAR – FRR – FTE – FTA 9 Fingerprint Proof of Principle • Maximise usability and acceptance of fingerprint at the ATM • Running usability trials and iteratively designing interaction – inhouse intuitive behaviour, sensor size – inhouse iterative design and evaluation of leadthrough – full consumer trial • Rewriting application for self service environment • Investigating integration issues with ATM software 10 Study 1: Size and intuition • 76 users (enrol + 10 V) • Enrolment results. • Only 2 people failed to enrol • 14 people were asked by the system to repeat the enrolment • 10% validation errors (FR) – High individual variability. – Quality and core placement issues – Small sensor is acceptable but requires software refinement. • Use core information to help the user – Good enrolment is paramount to successful validation. – Need for education about fingerprint core • What was required as well as how to do it 11 Study 2: Improving training and leadthrough • Iterative development – moving red line – Taught to locate core – Teaching standardised – software leadthrough to use the core to tell the user how to move • Results – removed all failure to enrol – more consistent performance – Only 2.5% false rejects 12 Study 3: Consumer Trial • Use representative general public group across age, gender and occupation • 168 Participants – Random convenience sample, recruited in Edinburgh – 60% under 50 and 40% over 50 – 52% male 48% female • Identify attitude/acceptance • Identify remaining usability issues: – Improved enrolment – Improved leadthrough (target versus image) 13 Selected findings • Still no real usage of biometrics – 97% never used biometrics before • Insecure behaviour – 24% have their PIN written down – 26% share their PIN and card • Now percieved need – Security and Convenience both an advantage and a disadvantage for fingerprint and PIN • New technology concerns remain (50%) • Privacy concerns remain for minority (20%) • General willingness to accept (60 -> 70%) 14 Comparison between Averages of PIN and Fingerprint Agreement Statements 2 Average Agreement (+2)/Disagreement (-2) 1.5 1 0.5 0 Secure * Easy * Acceptable * Fast Reliable Hygienic * Stressful * Trust Bank PIN Fingerprint * Significant at 5% -0.5 -1 -1.5 -2 Statements 15 Performance • 13% failure to enrol rate – Problems getting good enrolment images – image quality – all from over 60’s mainly female • 10% false reject rate – poor templates – inconsistent placement of finger – placing more restriction on placement or image quality will increase failure to acquire • Still to complete more detailed analysis of performance 16 Usability issues remain • People do not understand the concept of the fingerprint core • A central core image is essential • People tend to place their finger too low on the sensor • Pre-training is crucial to successful enrolment • Good enrolments form the basis of consistent validation • Still need human intervention in the enrolment process 17 Future Trials • Explanation of technology for participants • Explain difference between verification and identification • Trial new RF device • same size, higher DPI • Trial concerning problem group – Elderly above 60 • Improvement in leadthrough – combine target and image leadthrough 18 Biometrics evaluations conclusions Actual uptake Use Pluralistic approach Pilot Lab tests Functional Prototype tests Focus Groups Real acceptance with customers Fingerprint, iris, PIN Potential acceptance with representative user population Speech, facial, fingerprint, iris, PIN Speech, facial, fingerprint, finger swipe, iris, PIN usability Worries, problems, fears Speech, hand geometry, finger geometry, facial, fingerprint, iris, PIN 19 Conclusions • Biometrics can increase security and improve risk management • For niche applications, biometrics makes good business sense, are popular and appear to be successful • Successful biometrics systems are dependent on successful enrolment • For the general ATM user population usability issues will impact security. 20