Finger Print Based Biometric Security System

Abstract

The matching of fingerprints has had huge success for law enforcers for the last several years. Personal authentication systems based on biometrics have numerous advantages over the token or knowledge-based traditional security systems. Despite this, they are susceptible to attacks, which can lead to dire consequences in terms of their security. The study investigates the materialized attacks in the expanse of a biometric system of fingerprints. Project proffer a hill climbing procedure system of attack to incorporate the minutia templates, thus making an evaluation of its expediency having prevalent experimental findings organized in a huge fingerprint database. Additional presentations of several measures utilized in decreasing the attacks’ probability will be included.

Individual authentication systems based on biometrics that use behavioral speech or physiological traits are becoming increasingly popular in comparison to token or knowledge-based traditional systems. The traditional considerable system makes no distinction between a certified user and an imposter. This imposter conceitedly gains the factual user’s access benefits. Moreover, a convenience of biometric authentication systems is more applicable for individuals since passwords are not required. The access to several accounts is achieved via the use of a fingerprint biometric trait without shouldering the burden of passwords remembrance.

Biometric systems face extreme exposure to system attacks despite their abundant benefits, which can lessen their security. Ratha et al. (10) made an analysis of the crowded attacks and restricted them into eight class groups. The below figure portrays these attacks beside constitutes of an arbitrated typical biometric system. The first group of attacks entails a fake biometric presentation (a face or a synthetic fingerprint) to the sensor. On the other hand, the second type of attack constitutes submission of biometric system’s data previously intercepted. The module of conciliated features extracts or develops an attacker’s feature values tabbed.

The fourth attack type involves authenticated feature values, which are reacquired with the attacker’s selected ones (Alder, 8). The fifth attack style comprises of the matcher modification to create a synthetically high matching score output involved. A different attack on the database template, for example, a modification of an existing template or addition of a new template encompasses the sixth type of attack. The seventh attack relates to a barrage on the transmittal medium between the matcher and the template database. These attacks result in diversification of the transmitted templates. Lastly, the attacker can supersede the result of the matcher, acceptance or rejection.

Aim

The study’s main agenda is the analysis of the vulnerable attacks on a fingerprint biometric system in details.

Objectives

The project seeks to accomplish several objectives relating to fingerprint-based biometric security systems. These are:

· To identify the types of attacks that are highly susceptible to fingerprint biometric systems.

· To ascertain what effects the attacks will have on the fingerprint biometric systems and the persons using it.

· To find out the measures used for lessening these attacks’ probability.

Background

Soutar (25) makes a comparison between the biometric security and traditional systems. Irreplaceability and lack of secrecy are clear identifications of biometric systems’ problems. The lack of secrecy is evident from the existence of the fingerprints impressions left on the surfaces that individuals touch. On the other hand, irreplaceability example is the scenario created by the compromised biometric system, which, unlike password replacement, has no way of returning to a secure situation. Jain et al. (78) described the typical threats that accompany generic authentication application that may result in different effects or biometric-based and traditional systems. Attackers fool the authentication system to limit the legitimate users in the (DoS) Denial of Service.

Additionally, the hacker can assail an online authentication server used to process access request with other bogus access requests, up to the point where there is no handling of valid requests anymore. The attacker has access to the protected system by the authentication application in circumvention. This type of threat has two classifications: first in the form a secrecy attack or a subversive attack. In a privacy attack, there is a clear assessment of the unauthorized data by the attacker. He/she manipulates the entire system in a subsurface attack. In repudiation, the attacker refutes having accessed the system. For instance, a fraud clerk who makes an illegal modification of some financial records may assert that there was interference, and his biometric data was perhaps stolen. On the contrary, she or he may argue that the course of the problem might be the notion associated with different biometric data of (FAR) False Accept Rate.

A raider can stealthily acquire legitimate users’ biometric data, for instance, three-dimensional mold construction and latent fingerprint lifting. In turn, he can use it to make an entry to the system that in a method called the covert acquisition. Furthermore, there are instances where specific application-biometric data performs a task for another different application: Like in medical records fingerprint used to gain access rather than the access to the office door. Considerably, this is useful for biometric systems due to the adverse limited biometric traits that are helpful in comparisons to the unlimited identities of traditional types of access. The biometric data use of the cross-application becomes more rational with the increased growth of applications using biometrics: getting bank accounts access, locking computer screens, accessing medical records and gaining travel authorization. In collusion, the attacker that makes illegal system modifications is the legitimate user, having a wide access immunity. Nonetheless, the hackers subdue the legitimate users to gain system access in coercion: like accessing ATM accounts by use of their fingerprints at a gunpoint.

As of the biometric systems, the predicaments that may arise from the various mentioned attacks have raised concerns, as there is an increased deployment of biometric systems that are both found in government applications and commercially deployments. Alongside the increased population size, using these systems and the application areas expanding (border control, welfare distribution, e-commerce, and health care) may result in possible finance and security-related breaches, as well as privacy.

This project conducts an analysis of these attacks in the principality of a biometric system based on fingerprints. Due to their size, accuracy, performance, cost, and proven record of accomplishment, the fingerprint-based systems are thought to be amongst the most perpetually deployed biometric systems. This leads to the choice of fingerprint-based system usage for this study. In the second section, there are summaries of previous related studies. The third section constitutes a proposal of a system used in attaching a minutia-based fingerprint marcher. An experimental result that entails such attacks feasibility constitutes the fourth section. Several measures in countering such raids constitute the fifth section. Finally, section number six describes the future research directions and conclusions.

Summaries of several studies that portray the susceptibility of the biometric system are in this section. In addition, solutions are given to some of the section one attacks presented. Several researchers have claimed that type one attack (tractability of fake biometric to the sensor) can be quite successful. Essentially, it is worth noting that the intrusion requires only a fake biometric. Moreover, its relative feasibility with regards to different attacks’ one can be quite high. An illustration is where neither the template specifications or knowledge nor the benefits of template database access are required (Soutar, 23). Since it’s analog domain-operated, the biometric system digital limits on the outer and the mechanisms of digital protection such as hashing, digital signature, and encryption are inapplicable.

Researchers tested several sensor fingerprints to find out if, instead of a real finger, the fingerprint sensors allow an artificially created one (dummy). They described the creation of dummy fingers methods with and without the biometric real owner’s cooperation (Nadia). The cooperation of the owner (Nadia providing help to the attackers) obviously results in the high success rate of the application the dummy fingers in contrast with the ones made without her cooperation (Nadia being an attacker’s victim). In relation to the former case, filling the liquid silicon inside the cast after the finger is created with a plaster cast. With notice held, the water-thin dummy created can be placed on a finger. The operation takes only a few hours.

In the latter case, adequate time (eight hours approximately) and additional skills are vital. Firstly, for heightening the left latent fingerprints on the scanner surface or glass, a fine powder is exercised. Lastly, a taken photo of the print is capitalized in the convection of the Printed Circuit Board (PCB) to the print. The acid and the exposure of UV light assent on the board of the print’s profile that is afterward made for silicon cement of the dummy production. On the first attempt, the sensors were tested by the researchers, and it turned out that five out of six of them created the dummy finger using a procedure formulated by the above methods. During the second try, the lingering sensor allowed accessing the dummy finger. The researchers made an argument case regarding the properties (conductivity, dielectric constant, and temperature) performed by the scanner manufactures to extricate a real finger from a dummy finger, might not properly work. This is because, in different operation environs, the system’s detection margin necessitates adjustment. Changes of the finger dummies with wafer-thin silicon may occur within the system’s detection margins.

Jin et al. (7) posed a challenge on the synthetically made gelatine (gummy) of the 11 verification systems containing fingers. A cooperative owner, as an illustration, the plastic mold is held against his finger and results to gummy finger created by the gelatine. One hour is the specified time used. According to the findings, 11 systems containing a large 68-100% attack probability could involve gummy fingers. Due to the lack of owner’s cooperation, the glass plate’s residual fingerprint is intensified and a cyan acrylate adhesive made. After a print image capture, the gummy fingers are created by the PCB-based processing like the one mentioned above. The gummy was enrolled by all of the 11 systems and they allowed gummy fingers having a success probability of more than 67%.

With the view of repelling the fake biometrics attacks, Jin et al. (7) proffered for software-based methods, two of them, for fingerprint livens detection. The choice of the researchers was the use of the lively detection module amidst a sole input and a capacitive sensor, available commercially to the fingerprints in a five-second video. Consequently, the sweat pores periodicity beside the ridges is made for detection livens in the static method. Regarding the dynamic method, the sweat diffusion measurement hanging on the ridges is used. The fingers from cadavers are performed in the experiments, dummy fingers, including the live fingers that are plow made. In distinguishing cadaver fingers from live fingers, a classifier based BPNN (Back Propagation Neural Network) is dictated. A roughly 10% ERR can be induced in the static method. Additionally, ranging from 11-39% ERR is achieved through the dynamic method.

Nevertheless, a dummy finger restricted as life is seen in a false accept event and a live finger is perceived as a dummy/cadaver. There’s a created perception of how the fake biometrics attacks have succeeded in making a mockery of the existing systems with no perfectly available solution. The attack schemes in the biometric systems closer to the end user (physical replica used) and this creates a hindrance of some protection mechanisms being utilized. In addition, there is a limited detection of the attacks. The availability of some access privileges and the biometric authentication system knowledge to the attacker ensure the feasibility and success of the remaining raids. In comparison to type one attack, their applicability though may be reduced. Additionally, the usefulness of the attack may be increased since there is no necessity for physical production: plastic molding. The attacks also can be purged in a shorter time period in the digital domain.

In the type two attacks destruction, replayed by intercepted biometric data a while ago, Alder (9) opted for a response/challenge-based system. The presentation of a pseudo-random challenge that has a secure transaction server to the sensor is a requisite. The sensor receives a biometric signal currently at the time and enumerates the challenge regarding the response. The corresponding response thus along with the acquired signal is placed on the transaction server. At this stage, against the signal received the response is scrutinized for consistency purpose. The Possibility of the attack resubmission is demonstrated by the continuous inconsistency.

Soutar (10) requested for a ‘hill-climbing’ attack having system filter-based correlation for a simple image recognition system. In the biometric authentication system, there is a gradual input of synthetic templates. Additionally, Soutar identified how concession of the current structure by the effect of the returned matching scores system to the point of a positive identification incorrectly. The request entails the quantized matching scores that are then outputted instead of absolute ones. This increases the required time for a positive identification incorrectly, which in turn limits the practicality of the attacks. This raid can be defined as a type four or a type two attack. Alder (11) made advice of a face recognition attack. Here, the specific enrolled user’s account is attacked through face images that are generated synthetically. Conveniently, the selection of an initial face image is conducted. The modification of the initial image is made through the use of the returned matching scores from the matcher initiated for the face images.

A candidate image is developed by the high matching score created by the adjusted image. Repetitions are performed until there is no observed matching score improvement. 4000 iterations can be viewed through the use of experimental results on the face recognition systems, resulting in obtaining a large matching score. This leaves the matching scores confidence correspondent to be relatively high (99.9%). The confidence calculation reveals that the matching scores have a sigmoidal function. The template format information required for type four attacks is not essential when hill climbing is performed in type two attacks just before the extractor feature. In the matching algorithm, there is an input of synthetic images which handles the images conversion before matching the suitable representation. Such an approach develops challenges absent in a face-based system (i.e. between the nose, mouth, and eyes) for a fingerprints biometric system. There is no evident tie of constant geometrical relationships together with discriminating fingerprints information. This is because of its face-based systems and the additional methods of correct image: image analysis pixels’ registration, which is inherently linked, looks unsuitable.

A related study of type six attacks in terms of the security of the template database is awarded in Alder (12). The minutiae data template is manipulated reversely by the researcher and the artificial fingerprint images are derived. However, this makes an implication of securing the raw biometric templates differently with encryption techniques. This can be supported by the unrealistically composed images and provision of a few experimental results. An additional templates protection used a method from fraudulent usage constitutes a feature vector or biometric signal distorted version usage. An audit situation of a specific template representation leads to another distortion and transformed database replacing the previous one. The difference in the transposition of every application is quite necessary for that the related privacy subject concerns can be looked into with the database shared lying in between institutions.

Water making techniques and data hiding are regarded as ways of aggrandizing the fingerprint images security. This is possible thanks to the modifications detecting, concealed biometric on another and saving messages in the domain. Ultimately, Linnartz &Tuyls (15) propagated epsilon-revealing and delta-contracting functions as pre-processors to develop a data helper used in a means of concealing the user templates information from being revealed to several unauthorized parties. The next section claims a hill climbing biometric system to be as a type 4 attack. This attack uses artificially induced feature sets in a marcher of a minutiae-based fingerprint. It’s worth noting that the feature template format in the system of an attack as such, there should be prior usage information gained.

System Architecture

A corroboration system, which is minutiae-based, is delineated for the attack. Although cases of existence of other fingerprint representation methods are seen, the researcher’s concluded on a minutiae-based system to be their required test bed due to their various fingerprint authentication systems commercially used Linnartz and Tuyls (16). Ridge bifurcations and ridge endings in minutiae points are clearly visible in a corroboration system of a minutiae-based fingerprint. In general, the minutiae based systems entangle the (c, r) minutiae location and minutia orientation as the attributes. In contrast, additional information collection like the minutiae surrounded by ridge flow is performed by some systems. For simplicity purposes, the study keeps track of each minutiae characteristics as. The requested exchange format of the minutiae template is consistent with the research design. The proposed minutiae make a mockery of proprietary features exclusion and necessitate each minutia’s orientation, location, and type.

The synthetic minutiae set a purpose that is included in the attack system to the matcher for acquiring system access in a genuine user’s place. The information gained from the user’s template has information relatively anonymous to the system attack. The demand minutia sets constitute an attack system target that reappears in a bigger matching biometric score, performed indefinite identification compliance through the returned marcher scores development comparatively with the minutiae sets characteristics. A block diagram of the advised system is portrayed by the figure number two. The study’s remaining notation will look as follows:

Di: Here the analogous template database to the user involves i, i=1, 2, 3….N, where N dictates the registered users total in the system. Regarding the attack system, a presumption is held off the patent template format to it. However, no template access is achieved by itself.

Ni: the total minutiae in Di. The notice should be observed that the value is not known to the attacking system.

Tij: The jth artificially generated template for the user i by the attacking system. There is a similarity between the formats of the template and the database templates.

The column index, orientation in association with minutia, and the row index are represented by each individual row. The minutiae index is denoted by the subscript on the upper left hand. Basically, the minutiae number in total in Tijis nij

S (Di, Tij): denotes the matching score between Tij and Di.

Sthreshold: the decision threshold performed by the matcher. N/B the value is unknown to the attack system.

Attacking System Target System

Five steps of the attacking system are used in attacking an account of a specific user (Alder 13):

· Initial guessing (Step 1): a fixed artificial templates number is corroborated. A hundred random minutia templates located in the implementation are then created.

· Initial guesses (Step two): looking into step 1 generated template, user I account faces an attack. The synonymous matching scores later are compiled.

· Initial guess that is best (Step three): having the (Tibest) best guess is essential for it to be the template that in turn aids in successfully gaining a larger matching score. Consequently, a declaration of the matching score with a high value is a must-have. The best score is labeled as SbestDi.

· Modification set (Step four): modification of Tibest by (i) is performed through the existing minutia petulance, addition of new minutia, existing minutia replaced, and the existing minutia deleted. The results of having a larger matching score through these attempts lead to the modified template declared as Tibest, and accordingly, Sbest (Di) updated. Changing the parameters of Tibest is prohibited.

· Obtaining the result (Step five): the attack should be stopped in a case where the matcher accepts the current best score Sbest (Di). Alternatively, step four repeat is considered.

A presumption is created for the knowledge of the attacking system of the pixels’ size and dpi resolution of the current images the prime templates has generated. Validity is gained in that the sensor manufacturers make announcements regarding these values. The current implementation required a fingerprint image database known as -MSU-VERIDICOM, 300*300 images and 500 dpi. The artificial minutiae location is realizable through the use of the image size. The (500dpi for 9 pixels) inter-ridge distance in fingerprint association is determined by the resolution. First, a rectangular grid is created for the elimination of closely generated minutiae where there is similarity in the inter-ridge distance and each set cell’s size. Secondly, another creation of the minutia’s 2D location, (c, r), centrally in the cells, where there is a random selection of the occupied cells. Therefore, there are no created minutiae by the attacking program closer than the distance of the inter-ridges. This assists in dispersed minutiae set creation.

The angle value in association with the minutia is randomly generated as a quantized value ranging (0, 360). The interval was divided into equally spaced intervals, 16 in number regarding the current implementation. In Steps 1-3, it seeks to make an initial guess comparatively and engross its modification. In a scenario that the initial guess is faulty, more iterations may be needed for breaking of the algorithm. Similar minutiae number are in the initial templates (nij=25, j= 1, 2…100). The selection of value 25 as the typical number is used although the minutia actual number is anonymous in the (ni) certified template. Furthermore, the algorithm makes modification on the template to either decrease or increase the minutiae number on the basis of the returned matching scores.

Four iterations of each lopping process comprise step four. There is a random selection of existing minutia, and a slight modification of the desired angle or a location, both containing a 0.5 probability visible at the first iteration. The aim here is to demonstrate a difference either in the angle or location of minutia and the matching score effect view. Each direction’s location has equidistance to the inter-ridge distance petulance. The angle is disturbed for purposely either it’s decreased or increased to the next quantum angle. A new random minutia developed in the second iteration is inserted to the current template. In the third alliteration, a randomly selected existing minutia and a randomly developed minutia are prolonged. The fourth iteration denotes the random collection of the existing minutia a the one being substituted from a current template having a (+/-22.5 degrees) current changing implementation.

Nonetheless, the current template is replaced with a new one when the matching score makes an improvement after the second iteration: otherwise, it’s never changed. Hence, the hill climbing algorithm increases the matching score. In the third iteration, a randomly created minutia replaces the selected existing ones. Lastly, the fourth iteration involves the selected existing minutia’s destruction from the current template. Improvement of matching scores after each iteration leads to new template replacing the current template. Thus, the matching score increased by the ‘hill climbs’ algorithm.

Experimental Results

The matcher’s minutia-based fingerprint is performed in the study on the system-basis of Jain et al. (17) use each minutia triplets together with the ridge information. Conditionally, the study eliminates the matcher’s ridge information. In addition, segments of the fingerprint image database MSU-VERIDICOM are used as the right-index fingers in the experiments. The matcher runs the feature sets of the minutia, once there is an extraction of each of the minutia’s 640 images. A grand total of 203, 520 imposters’ scores and 1,600 that are genuine are obtained. Receiver Operating Characteristics (ROC) association curve is seen in figure three. On the other hand, the False Accept Rate (FAR) plots the decision threshold versus the False Reject Rate (FRR), which is perceived in figure four.

The researchers considered FAR =0.1% in that GAR=87.6% and a 12.22 finding of decision threshold as an operating point example. The choice of FAR value of 0.1% was because it’s the system administrators’ favorite value choice. It should be noted that the attacking program is not aware of the specific decision threshold. Its purpose is the matcher having the decision threshold synthetic feature sets and acquires the corresponding scores. Obliviously, the information acquired once the attacking program breaches the specific account is stopped by this program, otherwise it continues functioning. Other cases where the decision threshold uses the underlying verification systems for every account with no overtime change of the threshold. This leads to the decision threshold already having a partial knowledge, immediately after the first account breakage due to the attacking program. The purpose of the researchers was to establish a general system in the experiments.

On the average, the (FAR=0.1%) specific threshold selection makes an implication of imposter attempts of 1 in 1000 genuinely accepted as a match. The attack algorithms can dissipate into the accounts as viewed below by a trial consisting of several attempts. The 160 user accounts were invaded in the system that uses the section three attack methodology after setting a 12.22 S threshold. For every such account, they were broken into 1000 lesser attempts. The invasion’ mean, maximum number, and minimum required for all accounts breakage are 271, 871 and 123 respectively. Concisely, the above-detailed hill climbing procedure performs very efficiently.

To add with, three accounts broken at 871st, 271st, and 132nd attempts were selected as a means of conducting the analysis of matching scores progression for specific accounts. The final synthetic templates matching scores that breached these accounts were 13.3, 16.4, and 12.5 respectively.

These accounts matching scores progression are shown in figure six above. Clearly, there is a difference in the number of attempts in the paragraph at which there were accounts breaching.

Safeguards against Attacks

The contemplated system and other different cited studies above, as the besiege drive, use the score that matches with the current system. The matcher’s leaked information made a revelation in the form of the increased matching score in comparison to the trial of expedient input combinations that are used in faster positive identification. Other biometric systems may not enjoy suitability in accordance with the reject/accept output decision and the revealing matching score trivial solution. Ratha et al. (10) support this by asserting that the matcher outside is fundamental for the matching score. For instance, there are different matters needed by the matching scores of the multi-biometric systems that arrive at a favorable decision. Further, the revealed matching scores quantized keeps the needed time increased to ensure positive identification. Therefore the attack’s feasibility results in a decrease.

An alternative solution is after the matching scores to pass a procedure of masking. This is being done under constraint of the matching result (rejects or accepts), not altered. Essentially, the randomly generated scores are outputted outside the matcher inhibits the scores and attack data correlation. In turn, it results in the attack algorithm wandering around, looking for space and not yielding into the portion granting the positive identification. Contrastingly, the masked matching utilization scores may be eliminated in a multi-biometric system-based matching score.

In addition, blocking matching attempts in a case where a time period of an increased number of false matches can be a simple but very effective solution. A legitimate user is highly unlikely to provide roughly 20 false matches per day. An indication can be achieved from a computer program through a number of successive attacks for a specified template. This measure may also not be very effective if there is ample time for the attacker. For multiple days, the results can be accumulated by the raider. In such a scenario, the account breaching requires 1000 iterations; the attacker can stage a 50-day attack (20 iterations per day), yet still manage the account breaching.

Conclusions

In a nutshell, the requested attacking system is surely applicable in protected accounts breaching with angle information and minutiae location composed in the templates. This can be possible after the analysis of attacks’ feasibility against the biometric systems-based fingerprints. The system had the ability to synthesize templates, guaranteeing relatively attempts number (average of 271) in positive identification. Though the researchers proposed several measures in countering such attacks to be implemented, there are limitations for each of them, especially for biometric systems with the multimodal structure. Finally, modified attack systems are currently being worked on by the researchers with the purpose of decreasing the number of successful attempts even more.