Derawi Biometrics

Biometric System

The automated identification, or verification of human identity through repeatable measurements of biological and behavioral characteristics

These are the words defining what biometric is all about. The use of biometric was first known in the 14th century in China where “Chinese merchants were stamping children’s palm- and foot prints on paper with ink in order to distinguish young children from one another.” Approximately after 500 years has passed, the first fingerprinting was used for identification of persons. In 1892, the Argentineans developed an identification system when a woman was found guilty of a murder after the investigation police proved that the blood of the woman’s finger on the crime scene was hers.

Unlike passwords, pin-codes, tokens etc. biometrics cannot be stolen or forgotten. The main advantage of biometric authentication is that it establishes explicit link to the identity because biometrics use human biological (or physiological) and behavioral characteristics. It can be grouped into the following two classes:

• Biological – are the biometrics derived directly from the part of a human body. The most used and prominent examples are the fingerprint, face, iris and hand recognition
• Behavioral – are the biometrics by persons behavioral characteristics, such as gait-recognition, keystroke recognition, speech/voice recognition and etc

Nowadays one can find various types of biometric applications in real life. For example, The United Arab Emirates uses iris scans to identify foreign nationals, though the practice causes some to grumble. The government states that it uses the system to prevent criminals or people with expired visas from entering the country. Another example, at Ben-Gurion Airport in Tel Aviv, uses a dual-biometric recognition system that combines hand geometry and face recognition technology to create a redundant, convenient and highly accurate system for identifying and verifying the identity of tens of thousands passengers pass through each month.

Despite of the advantages biometric system is not perfect. Variability of human biometric traits due to various factors such as wet finger in fingerprint recognition, lighting condition in face recognition, noisy background in voice recognition etc. makes biometric system error prone.

Basic System Errors

Biometric authentication systems typically embrace requirements similar to maximum acceptable or allowable error rates. There are several types of biometric errors, expressed as error rates or error percentages, that need to be understood before a answer is designed and a particular biometric is chosen. It is necessary to know that biometric systems can make mistakes, and that the true value of the different error rates for a comparator cannot be computed or theoretically recognized; it is only possible to achieve statistically estimates of the errors using test databases of biometric samples.

Later on an intuitive and theoretical meaning of dierent error types (found in biometric literature) will be present. It will mainly focus on the errors made in a verification engine, which is a simple type of biometric comparator that makes a 1:1 (pronounced one to one comparison) based on a score s. There is also the comparator that makes a 1:n (pronounced one to many). In this section the problem of comparing biometric samples and checking the credentials of a subject for biometric authentication in terms of hypothesis testing are defined.

Comparison

A comparator is a system that as input takes two samples of biometric data and returns a score that indicates their similarity. This score is used for determining whether the two biometric samples are from the same original biometric. A defiiition of such a comparator can be described in form of a notation. Let’s first denote two original biometrics (e.g. two fingers or two faces etc) by B and B’ and associated machine representation of these  biometrics by f(B) and f(B’). Here f, represent the process of sampling the data with a sensor, and perhaps applying some processing to extract features B and B’. Next is to represent the biometric comparator engine that make a decision by computing a measure of the likelihood of the two samples from two persons (person 1 and person 2) are the same and hence that the persons are the same real-work identity. Typically this similarity is measured by use of different kinds of comparison algorithms and dependent on the precision of the acquisition equipment and highly dependent on the precision of the machine representation of the biometric sample.

Most of the biometric error rates calculations are determined by the accuracy with which the internal biometric comparator engine can determine which one of the following two hypotheses is true: Assuming given two fingerprint samples, we can construct the following two hypotheses:

• The null hypothesis : H0 → the two samples match;
• The alternate hypothesis : H1 → the two samples do not match;

Biometric applications’ denition of the hypothesis H0 and Ha can dier; as well as the decision that biometric application can make, which therefore give us different denitions of errors. There is much terminology around that expresses the accuracy of an application, such as the False Match Rate (FMR), False Accept Rate(FAR), False Positive Rate etc. But in this section we will dene the error rates used for creating the necessary output curves.

Authentication Process Result

Every person who is trying to be authenticated into a system will either be accepted or rejected. It is like approaching a knowledge-based method: either you have the required password or either you don’t have it. With something you have this is also quite trivial: that you have the key that ts in the system or not. But with biometric authentication it is not that trivial. Because it can be that with biometric feature might never give a match 100%. An example is to get authenticated by fingerprint.  We will find features that match some templates, and others do not. And the more matches a person’s get, the more convinced we are that it is the right person we are dealing with. And therefore we will gain the similarity. And such scores are calculated from the so-called use of distance metrics. The distance metrics are divided into two classes, namely the inter-class distance and the intra-class distance. The intra-class is being used when the distance metric has a low score from the same person and intra gives a high score from dierent persons vice versa because one will decide whether a high score value should be close similarity and opposite. Accepting or denying a person to any access control systems depends on a threshold set for this particular system and here lies important property of any biometric system. When working with biometric verification processes, then we are working with two types of important errors. Every person who is trying to be authenticated into a system will either be accepted or rejected. It is like approaching a knowledge-based method: either you have the required password or either you don’t have it. With something you have this is also quite trivial: that you have the key that ts in the system or not. But with biometric authentication it is not that trivial. Because it can be that with biometric feature might never give a match100%. An example is to get authenticated by ngerprint. As shown in the earlier chapters,we will nd features that match some templates, and others do not. And the more matches a person’s get, the more convinced we are that it is the right person we are dealing with.And therefore we will gain the similarity. And such scores are calculated from the so-called use of distance metrics. The distance metrics are divided into two classes, namely the inter-class distance and the intra-class distance. The intra-class is being used whenthe distance metric has a low score from the same person and intra gives a high score fromdierent persons vice versa because one will decide whether a high score value should beclose similarity and opposite. Accepting or denying a person to any access control systemsdepends on a threshold set for this particular system and here lies important property ofany biometric system. When working with biometric verication processes, then we areworking with two types of important errors.

• False Acceptance Rate (FAR) calculated from the False Match Rate (FMR). This happens when a biometric system measures two dierent persons to be the same person. A consequence would be that impostors wrongly are granted access.
• False Rejection Rate (FRR) calculated from the False Non Match Rate (FNMR). This happens when a biometric system measures two dierent measurements from the same source to be from dierent persons. A consequence would be that a genuine user wrongly is rejected access.

Other errors we also need to take into consideration while calculating the nal results are the Failure to Enroll Rate (FTE) and Failure to Capture Rate. The denitions of these two rates According to the ISO/IEC JTC 1/SC 37 biometrics are:

• Failure to Enroll (FE) failure to create and store an enrollment data record for an eligible biometric capture subject, in accordance with an enrolment policy.
• Failure To Enroll Rate (FTE) proportion of biometric enrolment transactions (that did not fail for non-biometric reasons), that resulted in a FE.
• Failure To Capture Rate (FTC) failure of the biometric capture process to produce a captured biometric sample that is acceptable for use.

The FTE increases when the biometric features on the person are not good enough to be extracted and create a biometric feature. The FTC is related to the probability that the device capturing biometric data is not able to capture the required information. The tradeoff between FMR and FNMR can be shown by using the Decision Error Tradeoff (DET) or Receiver Operating Characteristic (ROC) curves. This is illustrated in the Figure below.

Both of the curves shows the system performance at dierent threshold and tradeo between FMR (or FAR) against FRR (or FNMR) and the equations for calculating these values are listed respectively in Equations below:

• FMR = (Number of accepted impostor attempts) / (Total number of impostor attempts)
• FMNR = (Number of accepted genuine attempts) / (Total number of genuine attempts)

There is a minor difference between DET-curves and ROC-curves. If assuming that the False Accept Rate (FAR) = False Match Rate (FMR) and False Reject Rate (FRR) = False None Match Rate (FNMR), then the only dierence is a change in the y-axis that applies (1 – FNMR) instead of FNMR (for DET-curve). The next is to decide which threshold one should use. This depends heavily on the application. For Example, if one wants a high security application, then one should use as low FMR (or FAR) value as possible in order to reject impostors accessing the system. As well there are forensic application, which works with negative recognition (FAR = FNMR and FRR = FMR), where it is acceptable to have a higher FMR in order to catch the criminal. But most civilian applications are in somewhere in between the two mentioned. A further denition we want to look at is the so called Error Equal rate (EER). This rate is a very common used rate which is being used to compare dierent systems against each other, and briefly it gives an idea of how good a system it is. In Figure 3.11 (DET-curve) one can observe how it is possible to read the EER. Simply draw an angle of 45 degree line from the (x,y) = (0,0).