The finger print project
Still bound by some NDA, I'm unable to go into specific details.
The company also stays undisclosed.
The first part of the project was helping to implement an
offered patent into a product. After a while some doubts
rose that the patent didn't work out as expected. It took another few
month to actually prove that it didn't work. I then was given some time
to come up with a standard solution involving minutiae.
schematic finger print
A less realistic schematic drawing shows the minutiae as line ends, line
breaks, line splits. It is their relative position, and orientation that
finger print selectivity
Some decades ago, the US police organization (FBI) came up with some
studies on finger prints and claimed a uniquenes of finger prints in
the order of 1e9 without actual proof though. This claim was never
really challenged, as it appears to be helping the "good" guys. I won't
challenge it either, now. But it is the base of claim from various
finger print equipment manufacturer around the globe. Now comes an
important difference. While the police takes all 10 fingers with the
prints rolled with ink onto paper, the electronic finger print
equipment is not allowed to use rolled finger prints, just flat
contacts. And they also don't take all of them, just one, perhaps
one more as spare. And while the police organizations use trained human
experts to finally compare finger prints, the automated systems rely on
sensor data only. Yes, the police also uses automated systems for the fast
There are claims about the selectivity of finger prints and there is
the reality. More about that later.
finger print sensors
There are various types of sensors
Some sensors have advantages over others depending on the type of application.
Key figures are
- optical sensors using prisms taking data based on total reflection
- optical sensors just taking an image
- capacitive sensors measuring the surface capacity of a semiconductor pixel
- thermal capacity sensors, measuring the cooling of a thermal sensitive pixel
- and so on ...
It is agreed that the total reflection method gives good images, with a
good signal to noise. The sensor is bulky, power hungry and expensive,
so rather suited for lab work. We decided to do the development of the
methods with that sensor and taking care of the actual sensor in parallel.
- power requirement
real finger prints
To get a feel for the variation of the real finger prints, we took series
of finger images. From more than 100 people we took them in the early
morning before work started or before lunch break, over a several days
or weeks. Some findings were
A usable system has to cope with all of that.
While you can expect the users of a
fingerprint system to perhaps try twice, you cannot expect them to wash
the hands in a defined way unless the system's applications are severely
limited. This brings us to the
- The fingers can be cold and therefore giving low contrast images, due
to the wheather itself, bicycling, smoking, bad circulation.
- The fingers can be wet, usually due to rain, but also when operating
- Quite common amongst women is greasing the fingers with all sort of
creams. This gives high contrast images up too having features
covered with grease.
- Depending on the type of work or sports activities, finger prints
temporarily change due to cuts, abrasions, the like ...
They were thought to be least restrictive in terms of marketing
Before further specifications could be set, some working software was
- indoors and outdoors
- all wheather and all season
The fingerprint processing is twofold. First the sensor data is
processed to find the minutiae plus perhaps some quality information.
The output of this stage is some data, called template, which contains
the relevant minutiae data but does not allow reconstruction of the
sensor image. This template is stored on a smart card, sent between
computers. It usually is encrypted as feeding known-good template data
would be a way to attack such a system.
The second step is matching the template with a reference database of
finger print templates, eg with the customer records or employee records.
This process is not a one to on compare, no, it is far more difficult.
A template matching should be independent on some translation provided
the fingerprint area overlaps. It should also be independent on some
rotation unless rotation is restricted by mechanical measures. Then
the template matching should be able to cope with slight finger print
alterations, such as wetness, grease, cuts and so on.
Some application divide into
- Authentication, being a 1:1 compare. The person is known
from the smartcard or similar that has to be read by the system
before the finger print is read. Thus the system verifies the user.
- Identification, being a 1:many compare. Here, the system
has no idea who the finger print belongs to and tries to find the
owner in its database.
false acceptance ratio and false rejection ratio
When finger print images or rather minutiae data are compared, there
never is a true/false result, but rather a probability, based on counting
and weighting found minutiae. And depending on the application itself
there is a threshold upon which a finger print is accepted or rejected.
The False Acceptance Ratio (FAR) is the number
of wrongly admitted finger prints to the number of compares. The
False Rejection Ratio (FRR) is the number of
wrongly rejected fingers to the number of compares. With the threshold as
parameter the below graph can be calculated. It shows that FAR and FRR
can be traded against each other to suit the application. It also says
that just 2 numbers itself are irrelevant, the graph is the key to evaluation
of fingerprint technologies. This is valid for other biometric fields, too.
A high security application, eg a nuclear power station, will set the
threshold high, knowningly having a high rejection ratio, which will
be eased by a manned staff entrance where the rejected employee rings
a bell to be let in after a manual identity inspection.
An automated banking machine will have the threshold low, the banks
finding it cheaper to cover money lost to false accepts, than requiring
an overstaffed call center for the furious false rejects.
shown graphs do not really meet, they are in arbitrary units.
The threshold may be defined in terms of 1:1e3 False Rejected and
1:1e5 False Accepted. Any numbers above 1e6 can be considered fictional
and requires carefull inspection. Especially when both numbers are above
1e6. Did they actually measure these ratios or is it just an estimation?
How are these number defined and calculated?
Some agree on that 1000 fingerprints can be compared with each other
and give ( N*N/2 ) 500k compares. Some others dilute these numbers by allowing
3 measures olr so until a rejection or accepting is decided. Then the numbers
are not really comparable anymore. As seen, multiple measurements
in sequence can change the sensor data such : finger can become warm and
soft, moisture and grease content can change, but cuts and abrasions
remain. So, don't believe any numbers and do the measurements yourself,
especially when you're liable for the numbers.
There was a company working on a system taking additional images from
deeper skin layers also to thwart cheating and claimed a selectivity of
way beyond 1e11. The 1e9 from the normal (police-) methods plus something
more for the additional data. The last time I heard from them, they didn't
even have a working prototype.
using external algorithms
At one stage or another of the project I was to check available technology.
The owner of the algorithm of course didn't want give the code away.
At this point, we mixed the finger images and let the images be compared.
Each with all others and got the matching numbers back. This way we
were able to get the FAR/FRR numbers with our own images, while not
giving the images, or rather their internal relation of multiples, which
are a sizeable expense, away. And the code
was never given away either. Another measurement was with a device
having the algorithms built in. The matching was also done in the device,
and therefore this code also was never disclosed.
As with all security technology, cheating is involved and has to be
considered during development and during application. The threats
also shown in movies are real and involve
There are measures against some of them depending on the applied
technology. We'll leave that subject for now.
- regeneration of a fingerprint image on a sensor by freezing
the remaining grease.
- using a silicone copy of a valid finger
Considering that the project became exponentially more complicated
with each detail we looked at, it was no big surprise that the funds
were cut after a year or so.
last updated 1.june.04 or perhaps later
Copyright (99,2004) Ing.Büro R.Tschaggelar