The vulnerabilities of biometric sensors have been
discussed extensively in the literature and popularized in films and
television shows. This research examines the image quality of an
artificial print as compared to a genuine finger, and examines the
characteristics of the two, including minutiae counts and image
quality, as repeated samples are taken.
2. and decision) [4], another component is added to represent the the features of the two fingerprints remain consistent
transfer of the authentication decision to the application that Repeatability of the extracted features is important for the
relies on the decision from the, biometric system. Such matching process in any type of biometric technology [7]. The
applications could be identity management systems (IDMS) or features to be examined include: minutiae points and image
access control systems for logical and or physical access to quality. One of the challenges associated with this research is
resources. These systems can vary in complexity and size, to ensure the image is of sufficient quality. A wide variety of
ranging from a local computer log-in all the way to a wide- factors can influence the quality of fingerprint samples. Non-
scale distributed architecture seen in the cases of the U.S. uniform contact, inconsistent contact, or irreproducible contact
Department of Transportation's Transportation Worker with the fingerprint sensor can result in images with a low
Identification Credential (TWIC) [5] or the Personal Identity signal-to-noise ratio, which is not desirable for feature
Verification (PIV) of Federal Employees and Contractors [6]. extraction and matching purposes [9]. Wear and tear of the
The remaining points of vulnerability are communication skin and aging effects can semi-permanently alter ridge
channels between these six modules. It is worth noting that not characteristics. These factors also affect acquisition of
all 11 vulnerability points are unique to the biometric system. fingerprints by the fingerprint sensor. The importance of
Many of the same points (e.g., storage and communication quality is widely acknowledged, but there is no standard
channels) are vulnerable in other authentication systems and means of assessing quality. The current standardization effort
similar methods can be used to limit those particular for assessing quality for biometric samples refers to three
vulnerabilities. different connotations of quality:
The most publicized vulnerability in biometric systems * Character
resides at the data collection module in the form of spoofmg or * Fidelity
presenting artificial representations of biometric samples (see * Utility
module #1, Fig. 1). If an artificial or fake biometric sample is These three connotations of biometric sample quality can be
accepted by the biometric system at this initial stage, the entire directly applied to fingerprint sample quality. Character is a
biometric system is corrupted and the system is compromised. description of quality based on inherent features from the
Attacks on biometric systems are not new, popular culture source of the fingerprint. Individuals who have scarred
seeks to circumvent security systems and biometric systems fingerprints or dry or cracked skin on the fingertips will
are not immune. Several online resources are available that provide samples with poor character. Fidelity is a description
describe such attacks on the data collection module, and many of quality based on degree of similarity between the actual
movies and television shows have highlighted attacks on such fingerprint and the fingerprint image acquired by the sensor.
systems. One such attack at this data collection module was Inconsistent contact with the fmgerprint sensor can lead to
outlined in the work of Matsumoto, Yamada, and Hoshino fingerprint samples with poor fidelity. Utility is a description
(2002) using "Gummy Fingers" [1]. of quality based on observed or predicted contribution of the
The biometric research community, as well as industry, has fingerprint sample to the overall performance of the
focused its research on preventing such attacks by using the fingerprint recognition system. Utility of a fmgerprint sample
concept of "liveness" detection techniques. Today, the newer is directly affected by the character and fidelity of the
sensors are improving their resilience against a spoofing attack fingerprint sample, and should be the closely related to
at this module. In the past, acetate spoofing attacks - where performance of the recognition system.
an image of a fingerprint placed on acetate was accepted as a A substantial amount ofresearch has been conducted in area
genuine live finger - was easy to reproduce. Now, such of quality assessment, all of which give varying levels of
attacks are proving increasingly difficult to succeed, hence the importance to character, fidelity, and utility. Previous research
more complicated approaches to attacks being waged on the in the field of fingerprint image quality assessment can be
vulnerable sensor. Techniques for liveness detection within generalized into three categories: local features analysis,
the fingerprint modality focus on moisture content, global features analysis, and quality analysis as a classification
temperature, electrical conductivity, and challenge response. problem [10]. Features of the fingerprint image such as
minutiae count, fidelity of minutiae, contrast ratio between
III. FINGERPRnT IMAGE QUALITY ANALYSIS ridges and valleys, capture area of the figerprint, and
The purpose of this research paper was not to prove the detennination of dominant direction are used by quality
vulnerability of the biometric system, but to examine the algorithms in varying capacities to make quality
repeatability of the features of the gelatin finger print as determinations. For the purpose of this research, fingerprints
compared to the live genuine sample once the image has been from live fngers and gelatin fingers were examined by two
acquired. The research question is whether an artificial print different image quality algorithms, one provided by Aware,
captured on an optical sensor exhibits any of the same Inc. and the other provided as a part of NIST Fingerprint
characteristics as a genuine fingerprint from the same Imaging Software (NFIS).
individual captured on the same sensor, and whether any
distinguishers might enable the artificial print to be excluded IV. METHODOLOGY
later on in the process, if the initial data collection module This research involved two separate experiments. The first
accepts it. The research also investigates whether, over time,
31
Authorized licensed use limited to: Purdue University. Downloaded on February 18,2010 at 15:00:20 EST from IEEE Xplore. Restrictions apply.
3. experiment was conducted in two stages. Stage 1 of the first verified by the software, then the mold would have been
experiment involved creation of a set of images from an destroyed and the process started again.
artificial gelatin fimger that was crafted from the same subject The artificial finger was returned to the refrigerator in a
who provided the genuine fingerprint. The procedures to simple (airtight, but not vacuum-sealed) plastic storage
accomplish this feat required adaptation of several different container for 48 hours at a temperature of 2TC. This procedure
methodologies outlined in the literature for creating an allowed the gelatin finger to completely solidify to its
artificial fingerprints, including the work done by Matsumoto, permanent state.
Yamada, and Hoshino [1]. Prior to creating the mold, the After removing the gelatin finger from the refrigerator, tests
following necessary ingredients and utensils were gathered: were conducted on it to estimate the optimal load required for
plastic clay, hot water, and a pair of plastic tongs. To create acquiring images. In general terms, it is best to use the least
the mold, a quantity of plastic clay sufficient to cover the weight possible to produce a scan in order to minimize the
genuine finger was required. In order to make the plastic clay spreading and dissolution of the gelatin finger's valleys and
malleable, it was placed briefly in boiling water. In order to be ridges. Testing of loads ranging from 20Og to 1,000g, as
utilized, the plastic clay had to have a consistency such that it measured by a Tanita digital scale, was performed.
enabled a mold to be created by placing the finger with only Approximately 200g was determined to be the lower limit to
light pressure. When the plastic clay has attained a sufficient produce an image, with 550g being the upper limit before
level of pliability, the clay was cooled. Once the clay had distortion and inability to match occurred. The next stage of
cooled enough to be touched, the finger was placed into the the experiment involved acquisition of a series of images from
the gelatin finger. All of the images were acquired from the
clay to a depth sufficient to create the mold to be used to craft optical sensor using the gelatin fimger over a 15-minute time
the gelatin finger. The genuine finger was kept in the plastic period. After 15 minutes of acquiring images, the gelatin
clay until the clay had cooled enough to retain its shape and finger had degraded to the point at which it was no longer able
the details of the genuine finger. After the finger was to be accepted by the optical sensor. In all, 163 images were
removed, the mold was allowed to cure for an additional 10 produced over the 15-minute time period. A detailed
minutes. The resulting mold for this study is shown in Fig. 2. description of the 160 images utilized in the study is provided
in the results section.
Stage 2 of the first experiment called for the collection of a
series of live samples. One hundred sixty live samples were
acquired from the same finger that was used to create the
artificial gelatin finger. The live samples were collected over
an 8-minute time period on a commercially available optical
sensor. The authors chose to collect 160 live samples, as this
was the same number of fingerprints collected from the gelatin
finger. These 160 live images were all stored according to the
time collected; they are used to provide a baseline quality
assessment that will be compared against the samples
Fig. 2 Plastic mold formed to create gelatin finger generated by the gelatin finger.
After data collection, both sets of images (from the live
The next step was to create a gelatin mixture capable of finger and the gelatin fimger) were processed through the NIST
producing artificial fingerprints from the mold that would be Fingerprint Image Software (NFIS) package. The MINDTCT
recognizable to the sensor. Two sheets of gelatin weighing function was used to count the number of minutiae present in
3.5g were soaked in cold water for five minutes. In order to each individual image. The NFIQ function was used to
remove the excess water, the gelatin sheets were dried until evaluate image quality, which is determined on a rating scale
the gelatin weighed 14-16g. Next, a bowl was immersed into of 1 to 5, with 1 being the best and 5 being the worst. The
extremely hot water, and the gelatin was placed into the bowl results of M1NDTCT and NFIQ from both groups (the live
to soften and melt the gelatin. Once the gelatin had melted, it fingerprints and the gelatin fingerprints) were then compared
was poured into the clay mold. Immediately after placing the by the means of statistical t-tests (using an a level of 0.05) to
gelatin in the mold, the mold was placed in a refrigerator to determine if any statistical difference existed across the
cool for 10 minutes at a temperature of 1°C. Cooling groups. Aware, Inc. offers a commercially available image
transforms the gelatin to a state that is resistant to changes in quality and minutiae count software; this software was used to
shape when touched. Ambient room temperate, when this extract image quality scores and minutiae counts for
experiment was conducted, was 220C. fingerprints from the live finger and gelatin finger groups. By
After the gelatin finger had cured in the refrigerator for a utilizing two different software packages to analyze the
period of approximately one hour, it was removed from the fingerprints, we sought to eliminate bias that might have been
clay mold and placed on the sensor to determine whether it generated by utilizing only a single application.
was actually able to produce images. Ten attempts to acquire The second experiment involved collecting fingerprint
an image were made; in all 10 instances, an image was images from left index finger and the right thumb from 30
produced. The software verified the mold. If the mold was not different subjects. Each subject was asked to provide 20
32
Authorized licensed use limited to: Purdue University. Downloaded on February 18,2010 at 15:00:20 EST from IEEE Xplore. Restrictions apply.
4. images of each fimger on three different optical sensors. A of live and gelatin fingerprint minutiae count for last 16 prints.
silicon mold was created the left index and right thumb of An interesting observation is that the minutiae count increases
each subject, and the molds were used to provide 20 for the gelatin fingerprint group, but stabilizes for live
fingerprint images on each of the three optical sensors. The fingerprints.
procedures used in [1] were also employed in creating the
silicon molds in the second part of the experiment. At the end Boxplot of AWAREJLive-comt, AWARE_Gelatincount
of the data collection there were 3600 fingerprint images from 70.
live fingers, and the 3600 fingerprint images from silicon
fingers.
60*
A. Experiment I
V. RESULTS
a
50I
Creation and acquisition of images from gelatin fingers can be
problematic, as previous research has shown that gelatin 40 _
fingers do not afford consistent repeatability. However, this
study provides anecdotal evidence suggesting that better 3J
preparation and storage of the artificial finger can aid in the
repeatability of the images produced. The first 39 samples AWARE Live ca,t AWARELGelItkSem_t
provided consistently successful spoofing results; on the 40th Fig. 4 Box plot, live and gelatin finger minutiae count using Aware
presentation of the gelatin finger, a failure-to-acquire (FTA) QualityCheck
resulted. Overall, 163 images were acquired, but only 160
images were used for the final study. Degradation on the final
3 images rendered the images unusable. The acquisition rate Boxplot of t.S_Live_Coumt, NFI&Gelatin cout
for this particular gelatin fingerprint was 90.7%, producing a 110
FTA rate of 9.3%. Fig. 3 shows the gelatin print (left) a live
print (right). The FTA rate for the live finger was 0.0%.
90-
900
a
0-
60-
o
60
50
40
NRSLve_Cort NFS.Geeatincount
Fig. 5 Box plot, live and gelatin finger minutiae count using NFIS
M1NDTCT
Fig. 3 Gelatin finger (left) and live fmger (right) The stabilization of minutiae count for the live fingerprints
can probably be attributed to habituation or acclimation to the
The minutiae count analysis on both the fingerprint groups device. The subject has been acclimated to placing the sample
was performed. Fig. 4 and Fig. 6 show box plots of the finger on the optical sensor, which reduces the inconsistent
minutiae count from the live finger and gelatin finger, contact of finger surface with the platen of the sensor. Another
respectively, generated from Aware, Inc.'s image quality tool. interesting observation is the increase in minutiae count
Fig. 5 and Fig. 7 show box plots of the minutiae count from between the gelatin fingerprints over time. This suggests
the live finger and gelatin fmger, respectively, generated from degradation of the gelatin finger and mold because of
NFIS's MINDTCT. repetitive use and introduction of cracks in the mold used to
The results from the box plot graphs generated by both the create the gelatin finger. Evidence suggests that, over time, the
Aware and NFIS software programs show that the live number of minutiae for the gelatin fingerprint increases, while
fingerprints have a lower minutiae count than the gelatin the number of minutiae for the live fmgerprint stabilizes.
fingerprints, which is most likely a result of indirect and
inconsistent contact with the optical sensor. In order to study
the deterioration of the gelatin fingerprints, the first 16 and last
16 samples from the live and gelatin fmgerprint groups were
used. Fig 6 shows a box plot of the live and gelatin fingerprint
minutiae count for first 16 prints, and Fig. 7 shows a box plot
33
Authorized licensed use limited to: Purdue University. Downloaded on February 18,2010 at 15:00:20 EST from IEEE Xplore. Restrictions apply.
5. 9
55
501
45
40
35
303
65-
So
60-
55-
45-
40-
35-
30
Boxplot of Lisfe_First-16;, Gelatin-First-16
I
ve-FirsL6
Boxplot of Live_Last_6, GelatinjLastL16
Live_Last_16
'I'--
Fig. 8 and Fig. 9 shows the scatter plots for minutiae count
versus sample numbers of live and gelatin fingerprint groups.
Both of these graphs give credence to the observations made
from the box plots.
Scatterplot of NFISJJve-Count, WISjGelatin_count vs rnageCount
>
110
100
80
70
6.0
40
0 2
0
I
1
S%mN&
40
me_pmft
U
.
Jj,#MO
6
U
*-
0
"
100 12
1
14
U
1
Fig. 8 Scatter plot, minutiae count vs. sample number using NFIS
MIINDTCT
Gebtin_Fst16
Fig. 6 Box plot, live and gelatin finger minutiae count using Aware,
first 16 prints
Gelati_Last_16
Fig. 7 Box plot, live and gelatin finger minutiae count using Aware
QualityCheck, last 16 prints
-
VariabLa
-+- EIS Lwe.Co.wA
-'-
W- NFIS_GeaUn_cwnt
(U
'U
9
Groups
70
60-
50-
40-
30-
70
so 80
40
Aware_LiveLIQ
0
Aware_Gelatin_IQ 160
NFIS_Live-IQ 160
NFIS Gelatin IQ 160
*
20
tE a
...
Scatterplot of AWAREJive_ount, AWARE_Gelatincmnt vs bnaJeCoLnt
,V,able
,
40
5
U0
0406
a
60
*
ILI
*rn
*
N
i
60
'
ImageSotunt
160
w
*u
mA
.*
80 100 320 140 160 180
Image.Eoumt
Fig. 9 Scatter plot, minutiae count vs. sample number using Aware
Image quality is another metric that was considered
important for this research. Fig. 10 shows the scatter plot of
image quality scores obtained using Aware, Inc.'s quality
algorithm on the live and gelatin fingerprints. The graph of
image quality scores clearly indicates a degradation of the
gelatin fingerprint. T-tests of image quality scores between the
live and gelatin fingerprints showed a statistically significant
difference. The severe decrease in image quality noticed in the
repeated use of the gelatin finger indicates that it would be of
practical use only for the first 10 or so attempts. Table 1 shows
the results from the t-tests.
Scatterplot of AWAREjLiveJIQ, AWARE-Gelatn IQ vshnage-Count
U. *
|
* * **
*
U
T-TEST RESULTS
Interestingly, image quality scores might not provide a clear
indication of a spoofing attempt, because in the initial nine
samples, there was no statistically significant difference
between the image quality score means ofthe two groups.
_
a
X-
a
100 120 140 160 180
Fig. 10 Scatter plot, image quality scores using Aware QualityCheck
TABLE I
a 5
s
UI
*i
t-&-
Mean
79.22
61.0'
1.88
2.21
U
l AWARE Live count
-_U- AWAREfidati count
-4-
-U
AWARE_i.veJq
AWAREJ.I*anJ
p-value
<.05
<.05
34
Authorized licensed use limited to: Purdue University. Downloaded on February 18,2010 at 15:00:20 EST from IEEE Xplore. Restrictions apply.
6. B. Experiment 2 A paired t-test test for statistically significant difference was
Using the Aware software, the minutiae count and quality conducted on image quality scores. The test showed a p-value
scores were computed for all the live, and silicon fingerprints of < .05, which indicated that the difference in iimage quality
collected in the second experiment. Table II shows the scores was statistically significant. The minutiae count for the
summary statistics for image quality and minutiae count for dataset of silicon fingerprints and dataset of live fingerprints is
the dataset of live and silicon fingerprints. very similar, but the quality scores for the two groups were
significantly different. The results from this experiment
TABLE II indicate that image quality scores from the silicon fingerprints
SUMMARY STATISTICS are of medium quality, but they still are significantly different
Groups N Median Median Minutiae from image quality of live fingers. This provides an
Image Count interesting observation - the extraction of minutiae points is
Quality Score very similar between silicon mold fngerprints and live
Live Fingers 3600 80.0 39.0 fingerprint images, but the difference in quality scores points
Silicon Fingers 3600 69.0 39.0 to noise in the ridge flow, and contrast levels between ridges
Groups N Mean Image Mean Minutiae and valleys and other factors. This could also be possible due
Quality Score Count to distortion and elastic deformation of the silicon fingerprint
Live Fingers 3600 76.46 39.44 being different than the corresponding live fingerprint. This
Silicon Fingers 3600 61.35 38.98 observation merits ftuther research into this phenomenon since
the ridge flow and contrast analysis could be used as a
Fig. 11 and 12 show the box plot of quality scores and differentiating factor. The spread of the image quality scores
minutiae count respectively. The spread of the image quality of the silicon mold is also more variable than the images
scores is a lot larger for silicone finger compared to live quality scores of the live fmgerprint images, which indicates
fingers. degradation of the silicon fingerprints between successive
attempts.
Boxplot of Live Finger & Silicone Finger Image Quality Scores VI. CONCLUSION
inn-I
iw
The danger with providing a recipe for spoofing is that an
80
attack methodology to a biometric sensor is revealed.
However, in this case, the attack is analogous to an individual
revealing a PIN number to a fraudster and accompanying the
fraudster to the ATM to watch the fraudster withdraw the
ii 240
individual's money. The test was not designed as a spoofing
enquiry to evaluate the security of the system, but rather to
understand the characteristics of the gelatin finger and silicon
20Q
fmger compared to its live counterpart.
Some interesting results were obtained as result of the
0
analysis in both the experiments. In the first experiment, the
Live Finger Silio Finger
gelatin finger was able to provide 163 samples with an
Fig. 11 Box plot, image quality scores using Aware image quality
acquisition rate of 90.7%. Further analysis of fingerprints from
software the live and gelatin fingers showed a considerable difference
in the basic characteristics between the two groups. Repeated
use of the gelatin finger resulted in a rapid degradation of the
Boxplot of Live Finger, Silicone Finger quality of prints provided, which was reinforced by an
100- * increase in minutiae count with repeated use. Expecting a
gelatin finger to survive over a 100 attempts would be
80S unreasonable, but our analysis showed that even after 10 uses,
the gelatin finger showed a severe degradation in quality, even
60- though the system matched the spoof. Stabilization of the
0
minutiae count for the live fingerprint was an unexpected
A 40- result of the experiment, but it reaffins the notion of
habituation and how it can be used to acquire fingerprint
20- samples representative of its owner. Comparing the minutiae
count results of the first and second experiment, the minutiae
O- count of silicon mold fingerprints was more similar to the live
Live Mintae Count Silicone Minutae Count fingerprints compared to the gelatin mold fingerprints. A
future work of this study is to perform matching operations
Fig. 12 Box plot, Minutiae count between the live fingerprints and silicon fingerprints to
examine an effect of quality and minutiae count on the
35
Authorized licensed use limited to: Purdue University. Downloaded on February 18,2010 at 15:00:20 EST from IEEE Xplore. Restrictions apply.
7. matching error rates. Results from both the experiments
showed a statistically significant difference in image quality
scores between the fake fingerprints and live fingerprints
which could be used as an anti-spoofing mechanism.
Understanding the characteristics of fake fingerprints is
important in devising countermeasures, and extremely
important in increasing security of fingerprint biometric
systems.
REFERENCES
[11 T. Matsumoto, H. Matsumoto, K. Yamada, and S. Hoshino, "Impact of
artificial 'gummy' fingers on fingerprint systems, i Proc. SPIE, vol.
4677, Optical Security and Counterfeit Deterrence Techniques IV, San
Jose, CA, 2002, pp. 275-289.
2] R. K. Rowe. "A multispectral sensor for fingerprint spoof detection.
Sensors, " January 2005, p. 4.
[3] N. K. Ratha, J. H. Connell, and R. M. Bolle, "Enhancing security and
privacy in biometrics-based authentication systems," IBM Syst J 40(3),
2001, pp. 614-634.
[4] A. Mansfield and J. Wayman, "Best practices in testing and reporting
perfonnances of biometric devices," UK Biometric Working Group,
City, ST, 2002, pp. 1-32.
[5] U.S. Department of Homeland Security, Transportation worker
identification credential (TWIC) program, Available online:
https://www.twicprogram.com.
[6] National Institute of Standards and Technology, Personal identity
verification of federal employees and eontractors, Availabke online:
http: /csrc.nist.gov/piv-program.
[7] S. J. Elliott, N. Sickler, and E. Kukula. Automatic identification and data
capture. 3rd ed., West Lafayette, IN: Copymat. 2005, p. 314.
[8] A. Jam and N. Duta. "Deformable matching of hand shapes for user
verification," in 1999 Int Conf Image Processing, 1999, Kobe, Japan:
IEEE.
[9] N. Haas, S. Pankanti, and M. Yao, "Fingerprint quality assessment"
Automatic fingerprint recognition systems, NY: Springer-Verlag, 2004,
pp. 55-66.
[10] F. Fernandez, J. Aguilar, and J. Garcia, "A review of schemes for
fingerprint image quality computation," in 3rd COST 275 Workshop,
Biometrics on the Internet, Hatfield, UK, 2005.
36
Authorized licensed use limited to: Purdue University. Downloaded on February 18,2010 at 15:00:20 EST from IEEE Xplore. Restrictions apply.