Chapter 3
Designing Biometric Systems
Tasks of a Biometric System
1. User enrollment
– generation of the biometric reference template
based on biometric sample(s)
– performing the connection between the template
and other personal data
– storage of the biometric reference template for
future use (i.e. authentication)
2. User authentication
– matching of the biometric reference template
with a temporary template (calculated for
authentication purposes) 2
Templates
• A template is a small file derived from the
distinctive features of a user’s biometric data,
used to perform biometric matches.
• A template is calculated during enrollment or
verification phase.
• The template be understood as a compact
representation of the collected feature data,
where useless or redundant information is
discarded.
• Biometric systems store and compare
biometric templates, NOT biometric data. 3
Biometric Templates versus
Identifiable Biometric Data
• Depending on when they are generated,
templates can be referred to as enrollment
templates or match templates. 4
Templates
• Most template occupy less than 1 kilobyte,
and some of them are as small as 9 bytes
• Size of template differs from vendor to
vendor
• Templates are proprietary to each vendor and
each technology
• There is no common biometric template
format.
• This is beneficial from a privacy perspective,
but the lack of interoperability deterred some
would-be users. 5
Templates
• Biometric data CANNOT be reconstructed
from biometric templates.
• Templates are extractions of distinctive
features and not adequate to reconstruct the
full biometric image or data.
• Unique templates are generated every time a
user presents biometric data.
• For example, two immediately successive
placement of a finger on a biometric device
generate entirely different templates which
are processed by vendor’s algorithm and
recognizable as being from the same person,
but are not identical. 6
Overview of Biometric Systems
7
Overview of Biometric Systems
• Biometric Subsystems have three main
components
– Biometric readers (sensors)
– Feature extractors
– Feature Matchers
8
Enrollment Tasks
1. Supervised by an operator (yet exceptions
happen)
2. Multiple measurement (several biometric
samples)
– restrictive quality control
– selection of the best sample(s), or merging the
information at the sample level
3. Feature extraction and template generation
– cohesion of features vs. variance of features (if we
have feature sets originating from multiple samples)
– optional: estimation of feature variances and storing
9
them within the template
Enrollment Tasks (cont’d)
4. Storage of the biometric template
– central database or personal carriers (e.g. a smart
card) may be used
– building the relation between biometric template
and personal data (required to authenticate the
person)
5. Priority in the enrollment: delivering good
quality reference template, hence it may
take some time (typically a few minutes)
10
Enrollment and Template Creation
• Enrollment is a process to acquire, assess, process, and store
user’s biometric data in the form of a template.
• Enrollment
– Person entered into the database
– Biometric data provided by a user is converted into a template.
– Templates are stored in a biometric systems for the purpose of
subsequent comparisons (verification and identification)
• Quality enrollment is a critical factor in the long-term
accuracy of biometric system.
11
Enrollment and Template Creation
• Presentation is the process by which a user
provides biometric data to an acquisition
device – the hardware used to collect
biometric data.
• For example, looking in the direction of a
camera, placing a finger on a platen, or
reciting a passphrase.
12
Enrollment and Template Creation
• Biometric data are
converted to templates
through feature extraction.
• Feature extraction is the
automated process of
locating and encoding
distinctive characteristics
from biometric data in order
to generate a template.
• Feature extraction removes
noises and unwanted data,
and digitize biometric traits.
13
Enrollment and Template Creation
• A user may need to present biometric data
several times in order to enroll.
• Enrollment score or quality score indicates if
the enrollment attempt is successful or not.
• If the user’s biometric data contains highly
distinctive features or an abundance of
features, there will likely be a high enrollment
score.
• Vendor’s feature extraction processes are
generally patented and are always held
secret.
14
Biometric Enrollment Types
Positive Enrollment:
• To create a database of eligible subjects
• Biometric samples and other credentials are stored in the database.
• An id (or a smart card) is issued to the subject.
Negative Enrollment:
• To create a database of ineligible subjects
• Often without subject cooperation or even knowledge
15
How Matching Works
• Involves comparing Verification/Identification
template with enrollment templates.
• The comparison renders a score, or confident
value.
• The score is compared with threshold.
• If the score exceeds the threshold, the
comparison is a match, non-match otherwise.
16
Biometric Algorithm
• Turns raw data (like physical traits) into a
digital representation in the form of a
template.
• Also allows the matching of an enrolled
template with a new template just created
for verifying an identity, called the live
template.
17
Authentication Tasks
1. Not supervised by an operator (again:
exceptions happen)
2. Reading of the biometric reference template
from a database or other carrier (e.g. smart
card, if matching off card )
3. Single measurement (single biometric
sample)
– optional quality control
– liveness test (due to no human inspection)
4. Feature extraction and template generation 18
Authentication Tasks (cont’d)
5. Matching and decision
– calculation of the matching score among templates
– comparison of the matching score with the acceptance
threshold
– optional use of feature variance and/or individual
acceptance threshold (if present within the template)
6. If something goes wrong multiple attempts
(measurements) are allowed (typically three), and
the process is repeated
7. Priority in the authentication: delivering reliable
and fast decision, hence it must be fast (typically a
fraction of a second for verification, identification
19
may be slower depending on the application)
Biometric Matching
• Matching is the comparison of enrolled
biometric templates with a new template just
created for verification to determine their
degree of similarity or correlation.
• In verification systems, a verification template
is matched against a user’s enrollment
template or templates (multiple).
• In Identification systems, the verification
template is matched against dozens,
thousands, even millions of enrollment
templates.
20
Biometric Matching – Scoring
• Biometric systems utilize proprietary
algorithms to process templates and generate
scores.
• Some of them use a scale of 1 to 100, others
use a scale of -1 to 1.
• Traditional authentication methods such as
password offer on a yes/no response.
• In biometric system, there is no 100 percent
correlation between enrollment and
verification templates.
21
Biometric Matching -Threshold
• A threshold is a predefined number, which
establishes the degree of correlation
necessary for a comparison to be deemed a
match.
• Thresholds can vary from user to user, from
transaction to transaction, and from
verification to verification attempt.
• System can be either highly secure for
valuable transaction or less secure for low-
value transaction, depending on their
threshold settings. 22
Biometric Matching -- Decision
• The result of the comparison between the
score and the threshold is a decision.
• The decisions a biometric system can make
include
– match
– non-match
– inconclusive
23
Biometric Matching - Process Flow
• The user submits a sample (biometric data) via an
acquisition device (for example, a scanner or camera)
• This biometric is then processed to extract
information about distinctive features to create a
template (trial or verification template)
• The trial/match template is the user’s “password.”
• Trial/match template is compared against the
reference template stored in biometric database.
24
Biometric Identification
• Biometric identification is based only on
biometric credentials.
25
Biometric Identification
Biometric identification system can be used in
two different modes
• Positive identification
• Authorization of a group without id
• Negative identification
• Most Wanted List
26
Biometric Verification
• Biometric verification differs from biometric
identification in that the presented biometric
is only compared with a single enrolled
biometric entity which matches the input id
27
Biometric Verification
• There are two possible database configurations
for the verification systems
Centralized Database
• The enrollment information is in a central
database.
• Procedure
1. The token (id/card) is provided,
2. The corresponding biometrics is retrieved
3. The comparison is made with the newly presented
28
biometric sample. E.g. laptop
Biometric Verification
There are two possible database configurations
for the verification systems
Distributed Database
• The enrollment template is usually stored in a
device that the user carries.
• Procedure
– The user provides the device and his/her
biometrics.
– The comparison is performed between the two.
E.g. smart cards
29
Verification versus Identification
• Verification: Am I who I claim to be?
– One to one comparison - Compare a sample against
a single stored template
• Verification can confirm or deny the specific
identification claim of a person.
?
• Typical application: voice lock
30
Identification versus Verification
• Identification: Who am I?
– One to many comparison - Search a sample
against a database of templates.
• Can determine the identity of a person from a
biometric database without that person first
claiming an identity. ?
• Typical application: identifying fingerprints
31
Discussion: Verification and
Identification
• Verification system answers the question: “Am
I who I claim to be?”
– The answer returned by the system is match or no
match.
• Identification systems answers the question:
“Who am I”
– The answer returned by the system is an identity
such as a name or ID number.
32
Discussion: Verification and
Identification
33
When are verification and
identification appropriate?
• Verification systems are generally faster and more
accurate than identification systems.
• However, verification systems cannot determine
whether a given person is present in a database
more than once.
• Identification system requires more computational
power than verification systems, and there are more
opportunities for an identification system to err.
• As a rule, verification systems are deployed when
identification simply does not make sense (to
eliminate duplicate enrollment, for instance. )
34
When are verification and
identification appropriate?
• PC and Network Security -- verification
• Access to buildings and rooms – either
verification (predominant) or identification
• Large-scale public benefit programs –
identification
35
Evaluating Performance of
Biometric Technologies
• Metrics for evaluating performance
– False acceptance rate
– False rejection rate
– Failure-to-enroll rate
• No single metric indicates how well a
biometric system or device performs
• Analysis of all three metrics is necessary to
assess the performance of a specific
technology.
36
False Acceptance Rate (FAR)
• False Acceptance
– If a user enters another person’s username or ID,
presents biometric data, and the system
successfully matches the two
• False Acceptance Rate (FAR)
– The probability of this happening – usually stated
as percentage or fraction
• This is because two people have similar
enough biometric characteristics – a
fingerprint, a voice, or a face – that the system
finds a high degree of correlation between
the users’ template. 37
False Rejection Rate (FRR)
• False Rejection
– If user enters his username or ID, presents his biometric data to
a biometric system, and fails to match.
• False Rejection Rate (FRR) - the probability of this
happening
• This can be attributed to changes in
– user’s biometric data
• Voice-scan system is influenced by sore throats
• Facial-scan system is affected by changes in weight
• Fingerprint changes over time, scars, aging and general wear.
– how a user presents biometric data,
– the environment in which data is presented
• High FRR will result in lost productivity, frustrated users,
and an increased burden on help desk or support
38
personnel.
Acceptance and Rejections
• FAR can be reduced by adjusting the thresholds
– but the false rejection rate will increase.
• A system with a false acceptance rate of 0 percent,
but false rejection rate of 50 percent, is secure but
unusable.
• False acceptance rate is the most critical accuracy
metric
– an imposter break-in will certainly be a more attention-
getting event than other failings of a biometric system.
• The most important false match metric in real-world
deployments is the system false match rate.
39
Acceptance and Rejections
• If someone else is trying to verify as you, the system
would try to match the two templates.
– If the two templates were to match – this is classified as
false acceptance.
– If your authentication template fails to match your
enrolled template, then this is referred to as a false
rejection.
– If you are new and fail to enroll to a biometric system, this
is called – failure to enroll (FTE).
40
Accuracy Rates
• Single False Acceptance Rate vs. System False
Acceptance Rate
– If the FAR is 1/10,000 but you have 10,000
templates on file — odds of a match are very high
• Ability to Verify (ATV) rate:
– % of user population that can be verified
– ATV = (1-FTE)(1-FRR)
41
Biometric Errors and Decision
Making
1. Biometric method errors
– false non-match: a genuine sample did not match a reference
template
– false match: a impostor sample matched a reference template
2. Matching score
– similarity or dissimilarity of features calculated during authentication
and those included in the reference template
3. Possible decisions
– match or non-match, based on a decision threshold
– problem duality:
• a match means that the similarity score exceeded the decision threshold
(the similarity was higher than required)
• dissimilarity score was below the decision threshold (the dissimilarity
was lower than accepted)
42
Other Commonly used Error
Estimators
• Failure To Acquire – FTA: number of falsely rejected
biometric samples (during measurement of the genuine
user)
• Failure To Enroll – FTE: same as FTA, but referring to the
reference templates calculated at the enrollment
• FMR (False Match Rate) / FNMR (False Non-Match Rate)
for a given decision threshold
• Equal Error Rate – EER: FMR or FNMR when FMR=FNMR
• FMR @ zeroFNMR: we check the minimum FMR that still
allows for FNMR=0
• FNMR @ zeroFMR: same as above, but we demand
FMR=0 and search for the minimum FNMR 43
Design Issues
Basic design specifications of biometric systems are
• System accuracy
– How often the system accepts an imposter (FAR)
– How often the system rejects a genuine user (FRR)
• Computational Speed
• Exception Handling
– Failure to use (FTU)
– Failure to enroll (FTE)
– Failure to acquire (FTA)
• System Cost 44
Engineering Questions
• Trusting people/biometrics? • What feature set is amenable
• Which biometrics is best for for automatic matching?
a given application? • Given the input data how to
• How are the error numbers extract the features from it?
that are reported for • How to define a matching
different biometrics to be metric that translates the
interpreted? intuition of “similarity”
• Are new security holes among the patterns?
created because of the use • How to implement the
of the biometrics? matching metric?
• How to achieve a low • Organization of the
exception rate? database?
• How to acquire the • Methods for searching the
biometrics and how to do it database?
in a convenient way? • Security?
45
• Privacy?
