Biometrics & Security

This is not because you are using a biometric system that it is secure : biometrics are only a small brick in a secure system, and you must be cautious when speaking of security.

The security of a fingerprint system may be divided into two main areas:

• Liveness security : is this finger alive, fake, or dead ?
• Electronic security : is it an authorized fingerprint system we have at the other end of the wire ?

First of all, it's important to remember that absolute security does not exist : given funding, will, and the proper technology, nearly any security system can be compromised. So, protective techniques must be adapted to the cost of the object (or location) being protected.

When you are asked to prove your identity, it is not the fact that you are living that is required, but something more. What is desired is "I'm Mr. Mainguet and I agree to the transaction." In other words, "I'm a living person not under threat, and I agree to make such and such an action." This system is impossible to make today (how do we read your brain ?!), but this would be the ultimate system.

• Agree to the transaction => voluntary movement. For instance, sweeping your finger over a fingerprint sensor is a voluntary movement, but facial recognition is not.
• Living finger ?
  • add another sensor such as blood pressure
  • use several biometrics ("layered" biometrics)
• Alone or not ? (e.g. with somebody that is checking what you are doing).

For an unattended system (ATM for instance), it is important to have a fake/dead finger detection.

For payment in a store, using a fake will be much more difficult and risky, it's easy to check for that. Showing your finger to the other person may become a normal gesture just to say, "I'm honest, you can check for yourself."

For more information about aliveness detection, and what is now called presentation attack detection PAD.

Checking if you have a real sensor is exactly the same problem as the smart card: the card has to prove that it is a real smart card. The same solutions will apply.

The reference template must be processed exactly like the actual password used in smart card: the reference template must not be corrupted.

The next page is about biometrics & cryptography.