biometrics
Everyone is to some degree familiar with fingerprint sensors — you probably use them daily on your smartphone, and if not, you might’ve encountered them while applying for a visa to a foreign country, or entering one. Or somewhere else — fingerprints are widely used as a means of identity confirmation.
We’ve already discussed the pros and cons of using fingerprints for identification purposes, the convenience, the security risks, and so forth. In this post, we are going to talk about two new fingerprint-scanning methods that two companies showcased at Mobile World Congress 2018.
How fingerprint identification works
There are many ways to collect a person’s fingerprint, typically involving placing a finger on a sensor. That sensor can, for example, detect differences in the electric field of different parts of the finger, thus drawing a unique picture of the ridges on it. Or it can just use a camera to take a photo. Or it can emit ultrasonic waves and detect how the surface of the finger reflects them, which allows associated software to make a 3D map of the finger. As we said, there are many different ways to collect a fingerprint.
When you are asked to place a finger on a sensor to confirm your identity, the fingerprint is collected once again and compared with the images in the database. If a number of specific lines and patterns on the image in the database tagged with your name matches (or almost matches) the lines and patterns on the picture that the scanner has just produced, then your identity is confirmed. That means you can unlock a smartphone, or enter the country, or do whatever else you were going to do that required scanning your fingerprint.
Touch-free fingerprint capture
All of the aforementioned methods require touching the sensor for a second or two — and sometimes cleaning your finger and touching the sensor again, because scanners are prone to failing. A capacitive scanner won’t detect wet fingers, and the camera might fail if the finger was moved too fast, which is also true for the ultrasonic sensor. But even though all this touching is absolutely fine when using your smartphone, it might seem somewhat unhygienic to do so in a place where thousands of people’s fingerprints are scanned every day. Not to mention, for cases involving huge crowds of people, these methods might simply be too slow.
At MWC 2018, a French company called Idemia revealed a new method of fingerprint scanning that doesn’t involve any touching at all. You move your hand over a scanner, holding it about an inch away from its surface (no touching means no bacteria collected), and several cameras below the scanner’s surface shoot videos of your moving hand from various angles. A machine-learning algorithm then creates a 3D model of your fingers.
Cameras work well only in specific lighting conditions, so the Idemia system uses green lights to illuminate your hand. You’ve probably encountered similar scanners that use cameras and green lights already, but the difference here is that Idemia’s implementation builds a 3D model, not just a 2D image.
The multi-camera setup and 3D modelling give Idemia’s scanner two significant advantages over scanners with just one camera that produces a flat image. First is the combination of speed and precision — the cameras take more than a dozen photos each (consider that any video is a sequence of photos), and the algorithm is fast enough to process them all in a fraction of a second. That results in a high-definition image being created very fast — typically taking less than a second to scan, process, and compare the fingerprints of four fingers at once.
The second advantage is, of course, that you don’t need to touch anything. To capture a good still photo, you need to hold your fingers steady, and that means pushing them against the surface of the scanner. But shooting a video allows you to forget about the quality of each particular frame — yet analyzing and combining data from them all will result in a better image. That’s why you can simply swipe your hand through the scanner rather fast.
Idemia believes that scanners of this kind can be very useful when scans need to be done as quickly as possible, for example, in airports. Or they can serve as an authentication method to allow entrance to an office space, so that employees don’t waste time queueing at the doors.
Distinguishing a zombie with a fingerprint scanner
Despite the quality of the image, Idemia’s representatives acknowledged that this method is not absolutely secure. For example, a very good and detailed 3D copy of a hand could be used to fool Idemia’s scanner. To strengthen security, Idemia’s representatives suggested using several authentication factors at once, combining face or iris identification with fingerprint scanning, for example. And, after all, you probably won’t be wielding a 3D printed hand in the airport, so a pair of human eyes and a scanner should be enough.
But there’s another method to distinguish an inanimate object such as a 3D printed hand (or a dead hand — don’t pretend you didn’t think of it) from a living person’s hand using a fingerprint scanner. A Chinese company called Real iDentity presented it at MWC 2018.
The method involves a combination of a traditional capacitive sensor and the detection of “micro sweat.” Every living human being sweats all the time — sometimes more and sometimes less, but some sweat is always present. If the scanner recognises the right pattern of ridges on the finger and at the same time detects micro drops of sweat on the finger, it will be able to authenticate a person and not fall for tricks like using a 3D printed hand or a cut-off finger, which, you know, do not sweat.
Real iDentity does not disclose the method it uses to detect micro sweat. However, previous research from other companies suggested using an X-ray emitter and a photo sensor in addition to the capacitive sensor for that purpose. Human sweat includes not only water and salt, but also other chemical elements including, for example, potassium, which absorbs X-ray and emits light, making it possible to distinguish sweat from water or other chemical substances. Theoretically speaking, micro-sweat detection can be implemented in a contactless method; however, in Real iDentity’s demonstration scanning a fingerprint required touching the sensor.
Nobody has tested this method on zombies yet, but we believe that zombies don’t sweat, so using this sensor, it should be no problem to distinguish a clever zombie from a stupid human being.
Omnipresent fingerprinting
These two technologies represent a step forward in fingerprint recognition. They won’t make it into all fingerprint sensors; however, they might expand the use of fingerprint authentication to some areas where it has not yet been used. On the one hand, that might be good because it might either speed up some processes or strengthen their security.
On the other hand, the drawbacks of fingerprint identification remain the same as they ever were: fingerprints are easy to collect, and it is possible to forge fingerprints, even though new technologies make it harder to get away with forgeries. Once leaked, your fingerprints cannot be changed, but a password can. With that said, the best scenario is to use biometrics as a secondary protection method, complementing other security measures, but not replacing them completely.
