Biometric Recognition

Biometric Recognition
Anil K. Jain
Michigan State University
jain@cse.msu.edu
http://biometrics.cse.msu.edu
Jain, 2004
Person Identification
Person Identification
- Identifying fellow human beings has been crucial
to the fabric of human society
- In the early days of civilization, people lived in
small communities and everyone knew each other
- With the population growth and increase in
mobility, we started relying on documents and
secrets to establish identity
- Person identification is now an integral part of the
infrastructure needed for diverse business sectors
such as banking, border control, law enforcement.
Jain, 2004
Person Identification
Person Identification
Associating an identity with a person is
called personal identification
Jain, 2004
Questions related to the
identity of an individual
Questions related to the
identity of an individual
- Is this the person he or she claims to be?
- Has this applicant been here before?
- Should this individual be given access to our
system?
- Are the rendered services being accessed only by
a legitimate user?
Jain, 2004
Identification Problems
Identification Problems
Security Threats:
We now live in a global society of increasingly desperate
and dangerous people whom we can no longer trust
based on identification documents which may have been
compromised
Senator? Terrorist? A Watch List Stops Kennedy at
Airport: Senator Edward M. Kennedy, Democrat of Mass.,
discussed the problems faced by ordinary citizens mistakenly
placed on terrorist watch lists. Between March 1 and April 6,
airline agents tried to block Mr. Kennedy from boarding airplanes
on five occasions because his name resembled an alias used by a
suspected terrorist who had been barred from flying on airlines in
the United States. RACHEL L. SWARNS,NY Times,Aug 20, 2004
Jain, 2004
Identification Problems
Identification Problems
Identity Theft: Identity
thieves steal PIN (e.g., date of
birth) to open credit card
accounts, withdraw money from
accounts and take out loans
3.3 million identity thefts in U.S.
in 2002; 6.7 million victims of
credit card fraud
Surrogate representations of identity such
as passwords and ID cards no longer suffice
Jain, 2004
Too Many Passwords to Remember!
Too Many Passwords to Remember!
- Heavy web users have an average of 21 passwords; 81% of users
select a common password and 30% write their passwords down or store
them in a file. (2002 NTA Monitor Password Survey)
Jain, 2004
The Secret PIN!
The Secret PIN!
Jain, 2004
What is Biometrics?
What is Biometrics?
Jain, 2004
Automatic recognition of people based on their distinctive
anatomical (e.g., face, fingerprint, iris, retina, hand geometry)
and behavioral (e.g., signature, gait) characteristics
Recognition of a person by his body, then linking that body to
an externally established "identity, forms a very powerful tool
Biometrics
Biometrics
Iris-based ATM access
Jain, 2004
Why Biometrics?
Why Biometrics?
3.14159
S
e
c
u
r
i
t
y

L
e
v
e
l
Something you have
Something you know
Something you are
Method
Jain, 2004
Biometric Functionalities
Biometric Functionalities
- Positive Identification
Is this person truly known
to the system?
Provide log-in access to a valid user
- Large Scale Identification
Is this person in the
database?
Prevent issuing multiple driver
licenses to the same person
- Screening
Is this a wanted person?
Airport watch-list
Query image
(Vincent)
Template image
(Vincent)
Vincent XG Dennis
Ross Silviu Kim
Query image
Only biometrics can provide negative
identification (i.e., I am not he) capability
Jain, 2004
Biometric Recognition
Biometric Recognition
- Advantages
- Discourages fraud
- Enhances security
- Cannot be easily transferred, forgotten, lost or copied
- Eliminates repudiation claims
- Imparts convenience
- Disadvantages
- Output is a matching score instead of a Yes/No decision
- Cannot be "reset if compromised (unlike passwords)
- Biometric system itself could be attacked
- Privacy concerns
Jain, 2004
Biometrics is Not New!
Biometrics is Not New!
- Bertillon system (1882) took a subject's photograph, and
recorded height, the length of one foot, an arm and index finger
- Galton/Henry system of fingerprint classification adopted by
Scotland Yard in 1900
- FBI set up a fingerprint identification division in 1924
- AFIS installed in 1965 with a database of 810,000 fingerprints
- First face recognition paper published in 1971 (Goldstein et al.)
- FBI installed IAFIS in ~2000 with a database of 47 million 10
prints; average of 50,000 searches per day; ~15% of searches
are in lights out mode; 2 hour response time for criminal search
Emphasis now is to automatically perform reliable person
identification in unattended mode, often remotely (or at a distance)
Jain, 2004
Bertillon System
Bertillon System
The Bertillon system (1882) entailed
photographing the subject looking
directly at the camera, then in profile,
with the camera centred upon the right
ear. Besides the two photographs, the
subject's height was recorded, together
with the length of one foot, an arm and
index finger.
http://www.tld.jcu.edu.au/hist/stats/bert/
Jain, 2004
Biometric Applications
Biometric Applications
Jain, 2004
Biometric Applications
Biometric Applications
E-commerce
Internet Banking
Smart Card
Border Crossing*
US-VISIT program
Missing
Children
Cellular Phone Welfare
Disbursement
Parenthood
Determination
Access Control
Computer Login
Drivers License
Voter Registration
Criminal
Investigation
ATM National ID Card Corpse
Identification
Commercial Government Forensic
* There are ~500 million border crossings/year in the U.S.
Jain, 2004
*As part of the enhanced procedures, most
visitors traveling on visas will have two
fingerprints scanned by an inkless device and
a digital photograph taken. All of the data
and information is then used to assist the
border inspector in determining whether or
not to admit the traveler. These enhanced
procedures will add only seconds to the
visitors overall processing time.
The electronic fingerprint scanner
allows inspectors to check
identities of visitors against those
on terrorist watch lists.
By Stephen J. Boitano, AP
*From the DHS US-VISIT
web-site
Jain, 2004
U.K. to consider national biometric ID cards,
database
By Laura Rohde, COMPUTERWORLD (Nov 29, 2003)-
The U.K. government is set to consider legislation next year
for the establishment of compulsory biometric identity cards
and a central database of all U.K. subjects, it was announced
by the government this week.
The information that the government is considering for
inclusion on the card includes personal details such as a
person's home address and telephone number, his National
Insurance number (the equivalent of the U.S. Social Security
number), medical information and criminal convictions, as
well as the biometric information, most likely in the form of
an iris, fingerprint or palm print scan.
National Biometric ID Cards
National Biometric ID Cards
Jain, 2004
Fingerprint at check-
out counter
Smart gun
Biometric Applications
Biometric Applications
Disney World
Hajj pilgrims in Saudi Arabia
Ben Gurion Airport
Cell Phone with
Fingerprint Sensor
Jain, 2004
Access Control
Access Control
http://www.livegrip.com
http://www.livegrip.com
Jain, 2004
Did You Vote?
Did You Vote?
Feb 2 2001, Enquirer
Jain, 2004
- Video Surveillance (On-line or off-line)
Applications
Applications
Face Scan at Airports
www.facesnap.de
Jain, 2004
Fingerprint System at Gas Stations
Galp Energia SGPS SA of Lisbon
won the technology innovation
award for developing a payment
system in which gasoline-station
customers can settle their bills
simply by pressing a thumb against
a glass pad. Scanning technology
identifies the thumbprint and sends
the customer's identification
information into Galp's back-office
system for payment authorization.
THE WALL STREET JOURNAL, November 15, 2004
Jain, 2004
USA TODAY 7/22/2004
Using Iris Scans to Unlock Hotel Rooms
The Nine Zero hotel in Boston just installed a new
system which uses digital photos of the irises of
employees, vendors and VIP guests to admit them to
certain areas, the same system used in high-security
areas at airports such as New York's JFK.
Jain, 2004
Fingerprint System at Border Crossings
Foreigners entering the United
State in three cities, including
Port Huron, were fingerprinted,
photographed and subjected to
background checks on Monday
in a test of a program that will
eventually be extended to
every land border crossing
nationwide.
Lansing State Journal, Nov. 16, 2004
Jain, 2004
New Passports
New Passports
http://www.icao.int
The new passports have an embedded
contactless (ISO 14443) "smart-card chip that
stores personal information and a biometric
template. Two problems: reliability and privacy
Jain, 2004
Want to Charge It? You'll Have to
Talk to Your Credit Card
Beepcard, a company in California, has designed a credit card that
works only when it recognizes the voice of its rightful owner.
Enclosed in the card is a tiny microphone, a loudspeaker and a
speech recognition chip that compares the spoken password with
a recorded sample. If the voices match, the card emits a set of
beeps that authorize a transaction over the telephone or the
Internet. If the voices do not match, the card will not beep.
The system tolerates some variations in voice to accommodate
cold or background noise. But it might not work if there is a
blaring music in the background.
Jain, 2004
- Pirates can easily distribute multimedia data without being
tracked
- Copyright owners are reluctant to release their content, without
appropriate protection mechanisms
- Watermarking: Not very robust to attacks
- Encryption: Illegal key exchange
- Use biometric characteristics as the key: Alice now needs Bobs
biometric data in order to decrypt the file. This requires an
invariant representation of the biometric.
Secure Multimedia
Secure Multimedia
Jain, 2004
Biometrics for Personalization
Biometrics for Personalization
- Automatic personalization
of vehicle settings:
- Seat position
- Steering wheel position
- Mirror positions
- Lighting
- Radio station preferences
- Climate control settings
http://www.visteon.com
- URLs at your fingertips
Jain, 2004
Frequent flyers can sign
up for the so-called
Privium club, which not
only allows members to
bypass the lengthy line
at passport control, but
also lets them park
closer to the departure
hall and use fast check-
in counters.
Amsterdam Schiphol Airport
Amsterdam Schiphol Airport
Jain, 2004
Application Characteristics
Application Characteristics
- Overt vs Covert
- Attended vs Unattended
- Cooperative vs Non-cooperative
- Scalable vs Non-scalable
- Habituated vs Non-habituated
- Private vs Public
- Closed vs Open
- Low-level vs High-level security
Jain, 2004
Application Characteristics
Application Characteristics
- Overt vs Covert
- Attended vs Unattended
- Cooperative vs Non-cooperative
- Scalable vs Non-scalable
- Habituated vs Non-habituated
- Private vs Public
- Closed vs Open
- Reduce vs Eliminate fraud
Jain, 2004
Domains of Application
Domains of Application
Jain, 2004
Biometric Traits
Biometric Traits
Jain, 2004
Behavioral vs Physical Traits
Behavioral vs Physical Traits
- Physical Characteristics
- Iris
- Retina
- Vein Pattern
- Hand Geometry
- Face
- Fingerprint
- Behavioral Characteristics
- Keystroke dynamics
- Signature dynamics
- Voice
Jain, 2004
Biometric Characteristics
Biometric Characteristics
Jain, 2004
DNA (Deoxyribo Nucleic Acid)
- One-dimensional unique code for ones
individuality, but identical twins have identical
DNA patterns
- Three issues limit the utility of DNA
- Contamination
- Automatic real-time recognition issues
- Privacy issues: information about
susceptibilities of a person to certain diseases
could be gained from the DNA pattern
Jain, 2004
Cost vs. Accuracy
Cost vs. Accuracy
Cost
Accuracy
Hand
Signature
Face
Voice
Retina
Finger
Iris
IEEE Computer
Jain, 2004
Market Share
Market Share
Jain, 2004
Biometric Market Growth
Biometric Market Growth
International Biometric Group
Jain, 2004
- Universality (all users possess this biometric)
- Uniqueness (varies across users)
- Permanence (does not change over time)
- Collectability (can be measured quantitatively)
- Performance (low error rates and processing time)
- Acceptability (is it acceptable to the users?)
- Circumvention (can it be easily spoofed?)
Which Biometric is the Best?
Which Biometric is the Best?
No biometric is optimal! Need to find the best match
between a specific biometric and the application
Jain, 2004
Comparing Biometric Technologies
Comparing Biometric Technologies
High High Medium High Low High High
Fac|a|
Thermogram
Low High Low Medium Low Low Medium
Vo|ce
Low High Low High Low Low Low
8|gnature
High Low High Low Medium High High
Ret|na| 8can
High Low High Medium High High High
|r|s
Medium Medium Medium High Medium Medium Medium
hand
Ceometry
Low Medium High Medium High High Medium
F|ngerpr|nt
Low High Low High Medium Low High
Face
CIrcumventIon AcceptabIIIty Performance CoIIectabIIIty Permanence UnIqueness UnIversaIIty IometrIcs
There is no "optimal biometric!
Jain, 2004
Design and Performance
Evaluation
Design and Performance
Evaluation
Jain, 2004
Biometrics: A Pattern Recognition System
Biometrics: A Pattern Recognition System
- False accept rate (FAR): Proportion of imposters accepted
- False reject rate (FRR): Proportion of genuine users rejected
-Failure to enroll rate (FTE): portion of population that cannot be enrolled
-Failure to acquire rate (FTA): portion of population that cannot be verified
Feature Feature
Extractor Extractor
Template Template
Database Database
Authentication Enrollment
Matcher Matcher
(Threshold) (Threshold)
Yes/No
Jain, 2004
Main System Modules
- Sensor
- Feature extraction
- Matcher
- System Database
Jain, 2004
The grand challenge is to design a biometric system that
would operate on the extremes of all these three axes
simultaneously
A fundamental problem in science and engineering with
broad economic and scientific Impact
Accuracy
Scale
Usability
Unusable
Hard to Use
Easy to Use
Transparent to User
10
1
10
3
10
5
10
7
90%
99%
99.99%
99.999%
Biometrics: A Grand Challenge
Biometrics: A Grand Challenge
Jain, 2004
Requirements of a Practical
Biometric System
- Should meet specified recognition accuracy,
speed, and resource requirements
- Be harmless to the users
- Be accepted by the intended population
- Must be sufficiently robust to various
fraudulent attacks on the system
Jain, 2004
What is a Template?
What is a Template?
- A set of features extracted from the raw
biometric data of an individual
- Represents typical value of a biometric
- Multiple templates per individual are often
stored to account for intra-class variations
- Template aging requires that templates should
be updated over time
- Where should the template be stored: central
database or a smart card/magnetic card?
- How to protect the template? Encryption
Jain, 2004
Examples of Templates
Examples of Templates
[65 53 59 52 62
4747 45 255 333
253 287 243 149]
[-315.91,
-441.10,
212.35,
-90.78,
-840.12,
434.74]
Hand feature set:
Lengths and widths
of fingers, width of
palm
Face feature set:
Eigen-coefficients
[(35, 150, 10),
(40,170,3),
(45,142,34),
(50,145,6),
(51,166,18),
..]
Fingerprint feature set:
Minutiae coordinates and
local ridge orientation
Fixed-length vector Fixed-length vector Variable-length 3-tuple
Jain, 2004
Performance Evaluation
Performance Evaluation
- The overall performance of a biometric system is
assessed in terms of its universality, accuracy,
speed, and storage
- Factors like cost and ease of use also affect
performance
- Biometric systems are not perfect, and can
mistakenly accept an impostor as a valid user (a
false match) or conversely, reject a valid
individual (a false non-match)
Best Practices: www.cesg.gov.uk/technology/biometrics
FRVT2002:www.frvt.org/
FVC 2004: bias.csr.unibo.it/fvc2004
NIST SV: www.nist.gov/speech/tests/spk
Jain, 2004
Performance Characterization
Performance Characterization
- Impostor Distribution
- Genuine Distribution
- Threshold
- False Accept Rate (FAR) or False Match Rate
- False Reject Rate (FRR) or False Non-match Rate
- Receiver Operating Characteristic (ROC) curve
- Equal Error Rate or Crossover Rate
- Failure to Enroll (FTE)
- Failure to Acquire (FTA) or Failure to Capture
Jain, 2004
Error Rates
Error Rates
False Match (False Accept): Mistaking biometric measurements from two different
persons to be from the same person; False Non-match (False reject): Mistaking
two biometric measurements from the same person to be from two different persons
Jain, 2004
Error vs Threshold
Error vs Threshold
Jain, 2004
ROC Curve
ROC Curve
Accuracy requirements of a biometric system are application dependent
Jain, 2004
Evaluation Protocol
Evaluation Protocol
- Define a protocol to test the system, select the
data and measure the performance
- Evaluations should be conducted by an
independent organization (that is not involved in
the design of the system)
- Test on biometric data previously unseen by the
system
- Size of the data-set and representative examples
of the data set should be provided for tuning
algorithmic parameters
- Face, Fingerprint and Voice systems have
undergone the most study and testing
Jain, 2004
Challenges in Biometric Systems
Challenges in Biometric Systems
Jain, 2004
Why is Biometric Recognition Difficult?
Why is Biometric Recognition Difficult?
- Large number of classes (e.g., millions of faces)
- Intra-class variability and inter-class similarity
- Segmentation
- Noisy and distorted images
- Population coverage & scalability
- System performance (error rate, speed, cost)
- Attacks on the biometric system
- Template ageing
- Non-uniqueness of biometric characteristics
- Addressing privacy concerns
Jain, 2004
Intra-class variability
Intra-class variability
Jain, 2004
Interclass Similarity
Interclass Similarity
Jain, 2004
Identical Twins
Jain, 2004
Time duration: 6 months
Time duration: 2 years
Temporal Variations
Temporal Variations
Jain, 2004
Segmentation: Face Detection
Segmentation: Face Detection
*Theo Pavlidis, http://home.att.net/~t.pavlidis/comphumans/comphuman.htm
Jain, 2004
Games Magazine, September 2001
Locating Faces in a Crowd
Locating Faces in a Crowd
Jain, 2004
Noisy Images
Noisy Images
- ~ 3% of the population has
poor quality fingerprint images
Four impressions of a users fingerprint
Jain, 2004
At NY airports, an average of ~ 300,000 passengers pass through daily. If
all of these used biometric-authenticated smart cards for identification,
there would be 600 falsely rejected (and inconvenienced) passengers per
day for fingerprints, 30,000 for face and 45,000 for voice. Similar numbers
can be computed for false accepts.
"State-of-the-art Error Rates
"State-of-the-art Error Rates
2.07% 2.07%
Deliberate
perturbations
FVC
[2004]
2-5% 10-20%
Text
Independent
NIST
[2000]
Voice
1% 10%
Varied lighting,
outdoor/indoor
FRVT
[2002]
Face
0.2% 0.2%
20 years
(average age)
FVC
[2002]
Fingerprint
False
Accept Rate
False
Reject Rate
Test
Parameter
Test
Jain, 2004
Reading List
Reading List
Performance Metrics and Evaluation
1. Fingerprint Verification Competition (FVC 2000, 2002, 2004):
http://bias.csr.unibo.it/fvc2004/
2. Fingerprint Vendor Technology Evaluation (FpVTE 2003):
http://fpvte.nist.gov/
3. Face Recognition Vendor Tests (FRVT 2000, 2002):
http://www.frvt.org/
4. Face Verification Contest on the BANCA dataset (2004):
http://www.ee.surrey.ac.uk/banca/icpr2004/
5. NIST - Speaker Recognition Evaluations (1996 - 2004):
http://www.nist.gov/speech/tests/spk/
6. Signature Verification Competition (SVC 2004):
http://www.cs.ust.hk/svc2004/
Jain, 2004
Multibiometrics
Multibiometrics
Jain, 2004
Multibiometrics
Multibiometrics
Face
Fingerprint
Hand
geometry
Helps improve accuracy and population coverage
Limited discrimination and non-universality of a biometric
Jain, 2004
Multimodal System: Modes of
Operation
- Serial/Cascade Mode
- Parallel Mode
- Hierarchical Mode
Jain, 2004
Fusion of Fingerprint and Face
- Three commercial fingerprint matchers and one
face matcher with EER values of 3.96%, 3.72%,
2.16% and 3.76%, respectively, were combined
- 972 individuals in the database
- The best EER values in individual columns (rows)
are indicated with bold typeface (star (*) )
1.62 *1.50 1.82 4.65 1.73 Tanh
*0.63 1.16 *0.63 5.43 0.94 QLQ
1.86 1.72 1.79 5.28 *1.71 Z-Score
*0.63 1.16 0.86 5.43 0.99 Min-Max
UW MW Max Min Sum
Fusion Technique
Normalization
Technique
MW - Matcher Weighting; UW - User Specific Weights
Jain, 2004
Security of Biometric System
Security of Biometric System
Sensor
Feature
Extractor
Matcher
Application Device
(e.g.,cash dispenser)
Stored
Templates
1. Fake
Biometric
2. Replay
Old Data
3. Override
Feature Extractor
Yes/No
8. Override Final Decision
5. Override
Matcher
4. Synthesized
Feature Vector
7. Intercept
the Channel
6. Modify
Template
Like any security system, biometric systems are not foolproof
Jain, 2004
- Spoofing a biometric trait
Dummy finger created from
a lifted impression
Attacks on Biometric Systems
Attacks on Biometric Systems
Artificial skin/fingers
(http://www.livingskin.com/)
Jain, 2004
Circumvention
Circumvention
Jain, 2004
Sensor Interoperability
Sensor Interoperability
Digital Biometrics optical sensor
(508x480)
Veridicom capacitive sensor
(300x300)
A rolled inked fingerprint
Fidelica pressure sensor
(256x256)
Sensors used during enrollment and verification may be different
Jain, 2004
Sensor Interoperability
Sensor Interoperability
- Sensors used during enrollment and verification may be different
Jain, 2004
Privacy
Privacy
- Biometrics = Big Brother?
- Will biometric data be used to track people, secretly violating
their right to privacy?
- Biometric data may provide medical history, e.g., retinal data
may divulge information about diabetes or hypertension
- Will biometric data be used only for their intended purpose?
Will biometric systems be "linked?
- Governments interest is motivated by desire to decrease
fraud and waste, increasing efficiency and public safety
- Trade off between public safety and personal freedom
- Government regulation may be needed to safeguard biometric
data
- By restricting access to personal information, biometric
actually provides effective privacy protection
Jain, 2004
Privacy Concerns
Privacy Concerns
- Biometric can help in protecting individual privacy; because biometrics
provides stronger identification than password, it can be used to guard
personal & sensitive information (Health Information Privacy
Protection Act)
- Will biometric data be used to track people (secretly) violating their
right to privacy?
- Functionality creep: Will biometric data be used only for their intended
purpose? Will various biometric databases be "linked?
Jain, 2004
Security vs Privacy
Security vs Privacy
Jain, 2004
National ID Card
National ID Card
The Case for a National ID Card
Big Brother already knows where you
live. Why not let him make you safer?
(Time, January 21, 2002)
Jain, 2004
National ID Card
National ID Card
- ID card would contain basic information about the
holder, including their SSN and a photograph along
with "biometric data; will be used to verify the
identity of the holder and check her legal status
- "The question is not whether the government
should issue ID cards and maintain databases -
they already do.. The question is whether the
ones we have can be made more effective,
especially when it comes to finding criminals.
-Larry Ellison, WSJ
- A recent Harris Poll found that 68% of Americans
favor some form of national identification
Jain, 2004
Applied Digital Solutions new "Verichip" about the
size of a grain of rice, seen at left in this handout
image, is the first-ever computer ID chip, that could
be embedded beneath a persons skin.
Yahoo! News 27 Feb '02
Verichip
Verichip
(AP Photo/Applied Digital Solutions)
Jain, 2004
Big Brother
Big Brother
Jain, 2004
Security vs Privacy
Security vs Privacy
Jain, 2004
Smart card and Biometrics
Smart card and Biometrics
- Biometric template resides in the personal smart card of a user
- Biometric verification takes place via a built-in chip on the card
- Template does not leave the card; no centralized biometric
database is required
Siemens Matcher on Card Version 1.1
Precise Biometrics
5
th
Sense from Veridicom
Jain, 2004
Religious/Cultural Objections
Religious/Cultural Objections
Orlando Sentinel
This is no different than acceptance of some other technologies
Jain, 2004
Summary
Summary
- Reliable and automatic person identification is becoming
a necessity; emerging applications include national ID
card, border crossing, access control Internet shopping,
and computer data security
- There is no substitute to biometrics for effective person
identification; it is becoming a necessary component of
any ID management system
- Biometric sensors are cheap; fingerprint, face and voice
sensors are available in laptops & mobile phones
- But, biometric system performance is not meeting the
expectations in many applications
- Research topics: new representation and matching
techniques; large database indexing problem; improving
image/signal quality; liveness detection; system security