The finger print project

Still bound by some NDA, I'm unable to go into specific details. The company also stays undisclosed. The first part of the project was helping to implement an offered patent into a product. After a while some doubts rose that the patent didn't work out as expected. It took another few month to actually prove that it didn't work. I then was given some time to come up with a standard solution involving minutiae.

schematic finger print


A less realistic schematic drawing shows the minutiae as line ends, line breaks, line splits. It is their relative position, and orientation that matters.

finger print selectivity

Some decades ago, the US police organization (FBI) came up with some studies on finger prints and claimed a uniquenes of finger prints in the order of 1e9 without actual proof though. This claim was never really challenged, as it appears to be helping the "good" guys. I won't challenge it either, now. But it is the base of claim from various finger print equipment manufacturer around the globe. Now comes an important difference. While the police takes all 10 fingers with the prints rolled with ink onto paper, the electronic finger print equipment is not allowed to use rolled finger prints, just flat contacts. And they also don't take all of them, just one, perhaps one more as spare. And while the police organizations use trained human experts to finally compare finger prints, the automated systems rely on sensor data only. Yes, the police also uses automated systems for the fast searches.
There are claims about the selectivity of finger prints and there is the reality. More about that later.

finger print sensors

There are various types of sensors Some sensors have advantages over others depending on the type of application. Key figures are It is agreed that the total reflection method gives good images, with a good signal to noise. The sensor is bulky, power hungry and expensive, so rather suited for lab work. We decided to do the development of the methods with that sensor and taking care of the actual sensor in parallel.

real finger prints

To get a feel for the variation of the real finger prints, we took series of finger images. From more than 100 people we took them in the early morning before work started or before lunch break, over a several days or weeks. Some findings were A usable system has to cope with all of that. While you can expect the users of a fingerprint system to perhaps try twice, you cannot expect them to wash the hands in a defined way unless the system's applications are severely limited. This brings us to the

application specifications

They were thought to be least restrictive in terms of marketing Before further specifications could be set, some working software was required.

processing involved

The fingerprint processing is twofold. First the sensor data is processed to find the minutiae plus perhaps some quality information. The output of this stage is some data, called template, which contains the relevant minutiae data but does not allow reconstruction of the sensor image. This template is stored on a smart card, sent between computers. It usually is encrypted as feeding known-good template data would be a way to attack such a system. The second step is matching the template with a reference database of finger print templates, eg with the customer records or employee records. This process is not a one to on compare, no, it is far more difficult. A template matching should be independent on some translation provided the fingerprint area overlaps. It should also be independent on some rotation unless rotation is restricted by mechanical measures. Then the template matching should be able to cope with slight finger print alterations, such as wetness, grease, cuts and so on. Some application divide into
  1. Authentication, being a 1:1 compare. The person is known from the smartcard or similar that has to be read by the system before the finger print is read. Thus the system verifies the user.
  2. Identification, being a 1:many compare. Here, the system has no idea who the finger print belongs to and tries to find the owner in its database.

false acceptance ratio and false rejection ratio

When finger print images or rather minutiae data are compared, there never is a true/false result, but rather a probability, based on counting and weighting found minutiae. And depending on the application itself there is a threshold upon which a finger print is accepted or rejected. The False Acceptance Ratio (FAR) is the number of wrongly admitted finger prints to the number of compares. The False Rejection Ratio (FRR) is the number of wrongly rejected fingers to the number of compares. With the threshold as parameter the below graph can be calculated. It shows that FAR and FRR can be traded against each other to suit the application. It also says that just 2 numbers itself are irrelevant, the graph is the key to evaluation of fingerprint technologies. This is valid for other biometric fields, too.

A high security application, eg a nuclear power station, will set the threshold high, knowningly having a high rejection ratio, which will be eased by a manned staff entrance where the rejected employee rings a bell to be let in after a manual identity inspection.
An automated banking machine will have the threshold low, the banks finding it cheaper to cover money lost to false accepts, than requiring an overstaffed call center for the furious false rejects.
The above shown graphs do not really meet, they are in arbitrary units. The threshold may be defined in terms of 1:1e3 False Rejected and 1:1e5 False Accepted. Any numbers above 1e6 can be considered fictional and requires carefull inspection. Especially when both numbers are above 1e6. Did they actually measure these ratios or is it just an estimation?

How are these number defined and calculated?
Some agree on that 1000 fingerprints can be compared with each other and give ( N*N/2 ) 500k compares. Some others dilute these numbers by allowing 3 measures olr so until a rejection or accepting is decided. Then the numbers are not really comparable anymore. As seen, multiple measurements in sequence can change the sensor data such : finger can become warm and soft, moisture and grease content can change, but cuts and abrasions remain. So, don't believe any numbers and do the measurements yourself, especially when you're liable for the numbers.
There was a company working on a system taking additional images from deeper skin layers also to thwart cheating and claimed a selectivity of way beyond 1e11. The 1e9 from the normal (police-) methods plus something more for the additional data. The last time I heard from them, they didn't even have a working prototype.

using external algorithms

At one stage or another of the project I was to check available technology. The owner of the algorithm of course didn't want give the code away. At this point, we mixed the finger images and let the images be compared. Each with all others and got the matching numbers back. This way we were able to get the FAR/FRR numbers with our own images, while not giving the images, or rather their internal relation of multiples, which are a sizeable expense, away. And the code was never given away either. Another measurement was with a device having the algorithms built in. The matching was also done in the device, and therefore this code also was never disclosed.

cheating

As with all security technology, cheating is involved and has to be considered during development and during application. The threats also shown in movies are real and involve There are measures against some of them depending on the applied technology. We'll leave that subject for now.

The project

Considering that the project became exponentially more complicated with each detail we looked at, it was no big surprise that the funds were cut after a year or so.

sponsored links



projects page
home


last updated 1.june.04 or perhaps later

Copyright (99,2004) Ing.Büro R.Tschaggelar