T215B-Session 7

T215B
Communication and
information technologies (II)
Arab Open University Spring 2021

Session 7
Block 4
Protecting and prying 1
Session Outline
• Part 6: Biometrics (Cont.)
• Fingerprint recognition systems
• Fingerprint Matching

• Fingerprint Classification
• Errors in biometric recognition systems
• Biometric applications
• Concerns and issues relating to biometric
systems
2
3.4 Fingerprint matching [1/3]
• Fingerprint matching is a process of evaluating the degree of
similarity (or difference) of two given fingerprints.
• Matching difficulties:
• Matching problems occur whenever there are:
• Small interclass differences: Some fingerprints from different

fingers can be similar.
• Large intra-class differences: Some fingerprints from the same
finger can be different.
The intra-class variations are particularly problematic, as

they are much more likely to happen.
3
• Reasons for intra-class variations:
• displacement: different parts of the fingertip are presented to
the sensor.
• Rotation: the fingertip is presented to the sensor at a different
angle.

• Pressure of the impression: the finger is pressed on the sensor
with a different force.
• Skin condition: on different occasions the fingertip may be dry,
wet, scratched or dirty.
• condition of the sensor surface: on different occasions the
surface may be clean, dirty or greasy.
• Feature extraction accuracy.
4

5
3.4.1 Matching methods [1/3]
• Matching methods for fingerprints can be broadly classified
into three categories
• Correlation-based matching
• Minutiae-based matching
• Ridge-feature-based matching

• Correlation-based matching:
• Correlation-based matching works by superimposing one
image over another image and changing their alignments (by
moving and rotating one of the images) until the correlation
between the corresponding pixels of the two images is
maximised.
• The time and resources required to match the images pixel by 6
pixel are huge. 
• Minutiae-based matching:
• Minutiae-based matching addresses the correlation-
based shortcomings
• In a Minutiae-based matching, the matching is

conducted by working out the similarity between
Minutiae instead of all pixels.
• Minutiae-based matching is the most commonly used
matching method adopted by automatic fingerprint
recognition systems.
7
• Ridge-feature-based matching:
• Ridge-feature-based matching is used when the qualities
of the fingerprint images are not good (minutiae
extraction is difficult).

• In a Ridge-feature-based matching, other ridge features
may be used to help in matching fingerprints such as:
ridge orientation, ridge frequency, shape and texture,
and ridge counts between minutiae.
We will now focus on “Minutiae Based

Matching” 8
3.4.2 Minutiae-based matching [1/12]
• Reminder:
• Minutiae are points in a fingerprint where ridge lines discontinue
abruptly from their original path.
• A matcher compares two fingerprint “templates”
• The output of a matching process is a similarity value.

• Fingerprint matching process:
• For fingerprint matching purposes, the location, orientation and
type of the minutiae are commonly used as attributes for
comparison.
• There are three main steps in the matching process:
1. Alignment
2. Evaluating the distance between each pair of minutiae
9
3. Determining the outcome.
1. Alignment:
• Step 1: Defining the core
• To align two fingerprints efficiently, a Core
reference point known as the core is
often used.
• A core is commonly set to the centre of

the northern-most loop-type singularity
• a loop-type singularity is a loop or a
whorl
• ‘northern-most’ here implies an
analogy with maps, where north is at
the top.
• When fingerprints have no loop-type
singularity, the core is commonly set to
the point of maximum ridge line 10
curvature.
1. Alignment:
• Step 2: Translation
• The two fingerprint images are shifted so that the locations of
the cores of the two fingerprints are at the same fixed point,
such as the center, of the frame.

• After the translation, the two fingerprint images are closer for
comparison
Translation
11
But there may still be a rotation variance!

1. Alignment:
• Step 3: Rotation
• To minimize the rotation variance, the two images need to be
rotated so that they have the same orientation.
• One common method is to make use of the average
orientation of two regions located at both sides of the core.

• The fingerprint image is rotated with respect to the core point.
• The rotation stops when the angles between the average
orientations of both regions and the vertical axis have a
minimized difference
12
Average ridge Average ridge
orientation angle Core orientation angle
(a: left side) (b: right side)

Translation
&
Rotation
Original fingerprint image: Fingerprint image after

• Core not centered Translation & Rotation: 13
• a≠b • Core centered
• a≈b
2. Evaluating the distance between each pair of minutiae:
• After the fingerprint images are translated & Rotated, the two
fingerprint images can be superimposed on each other.
• The minutiae of the two fingerprint images are then
compared.

• The general practice is to measure the difference between each
minutia pair
• Some of the minutiae could not be aligned perfectly due to errors in
translation or from other processes.
• The differences of interest are:
• the location difference of the minutia pair.
• the orientation difference of the minutia pair.
14
• Some systems also compare the minutia types.
Input fingerprint Image Stored fingerprint Image

Matched Minutiae pairs
Superimposed
fingerprint Images
15
3. Determining the outcome:
• The outcome could be:
• Similarity Value (or Difference Value)
• Or a decision: “Match” or “Non Match”
• Finding a Similarity Value:

• The overall difference between the two fingerprints is evaluated
• One possible method: Calculate the difference between each
minutia pair.
• Calculate the average difference of all the minutia pairs
• Other methods can be also used.
16
• 3. Determining the outcome:
• Take a Decision:
• When the outcome of the matching is required to be a decision
(match or no match), a threshold is required.
• The fingerprints are considered as a “match”: If the similarity value

is higher than the threshold.
• The fingerprints are considered as “non match”: If the similarity
value is less than the threshold.
• The threshold is usually set according to the required security

level.
• The higher the threshold, the more difficult it is for two fingerprints
to be considered as a match.
• The lower the threshold the easier it is for them to be considered a
match. 17
• Example - Activity 6.9:
• Two fingerprint images are to be matched using the minutiae-
based matching methods described previously.
• For simplicity, let’s assume there are only 10 minutiae in each
image. After the images are translated and superimposed, 10

minutiae pairs are identified and their differences are
evaluated.
• Table 6.4 shows the differences of the minutiae pairs.
18
• Activity 6.9 (Cont.):
• (a) Assume the threshold is set to 80%, which means that the
two fingerprints will be considered as a match only if the
differences of at least 8 out of the 10 pairs are at or below the
acceptable difference. Also assume the acceptable difference

is set to 0.05. Will the two fingerprints be considered a match?
• (b) If the threshold is now raised to 90% and the acceptable
difference is lowered to 0.03, what happens to the match
result?
19
• Activity 6.9 (Sol.):
• (a) The two fingerprints will be considered a match
• Only pair number 1 is greater than the acceptable difference (0.05)
• The differences of the other nine pairs are within the acceptable
level.

• 90% pairs are acceptable, which is over the 80% threshold.
• (b) The two fingerprints are no longer considered a match.
• Pairs number 1, 7 and 10 are not within the acceptable difference
(0.03)
• The differences of only 7 out of 10 pairs are within the acceptable
level.
• This is 70%, which is below the new 90% threshold.
20
Session Outline

systems
21
3.5 Fingerprint classification [1/2]
• Reminder: Identification is a process of identifying an
individual from a population of individuals.
• If the population is large, identification may take a very long

time to search through the database.

• Example: Consider that a fingerprint database contains 50
million records. If the identification system can perform
10000 fingerprint comparisons per second, how long would it
take to search through all the records?
• Time = number of records/processing speed= 50 x 106 / 104 =
5000 s
• It would take 5000 seconds – that’s about 83 minutes!
• This very long time is not acceptable for practical applications. 22
Any Solution?
3.5 Fingerprint classification [2/2]
• To enhance the system performance, a common strategy is to
divide the database into many bins.
• Each bin contains only fingerprints of the same class.
• When a fingerprint is to be identified, it is compared only with
those in the bin of the same class.

How to classify the fingerprints?
• The fingerprints can be classified using singularities: arch,

tented arch, left loop, right loop and whorl.
• However, dividing the database into only five bins does not help
much in improving the performance!
• Other ridge information can be used for classification, such 23
as ridge count between two distinctive features
Session Outline

systems
24
3.6 Errors in biometric recognition systems [1/7]
• Reminder: the sensitivity of a fingerprint recognition system is

determined by thresholds.
• The thresholds used in biometric recognition systems set the

balance point between security and convenience.

• To increase the system SECURITY, the threshold should be set High
• Only fingerprints with high similarity values are considered as Match
• BUT in this case, false non-match can occur.
• When a threshold is set too high biometric data from the same person can
appear not to match because of slight variations.
• To increase the system CONVENIENCE, the threshold should be set
Low
• Fingerprints with low similarity values are considered as Match
• BUT in this case, false match can occur.
25
• When a threshold is set too low different biometric data can appear to match
when they are not the same!
• False match refers to incorrectly believing that two given sets

of biometric data are matched
• The consequence is that imposters could gain access to resources
they are not allowed to access → Less security
• False match is also referred to as ‘false acceptance’ or ‘false

positive’
• False non-match refers to incorrectly believing that two given
sets of biometric data are not matched.
• The consequence is that legitimate users could be refused access
to resources they are entitled to access. → Less convenience
• False non-match is also referred to as ‘false rejection’ or ‘false
negative’.
26
• False match and false non-match errors are unavoidable

with current technologies but, ideally, both types should
be kept to a minimum.
• Biometric recognition systems are typically assessed

based on statistical information:
• The false match rate (FMR): the probability of a false match type
of error
• The false non-match rate (FNMR): the probability of a false non-
match type of error.
How to assess a biometric recognition system?

27
• Example: Authentication system

• In an initial trial an authentication system set to a particular threshold has
been tested 1000 times by a number of people, of whom 400 were legitimate
users and 600 were illegitimate users. The system made false matches 30
times and false non-matches 60 times. What is the FMR and FNMR of this
authentication system? What can you say about this authentication system?
• Solution:

• Calculating the FMR:
• A false match occur when an illegitimate user’s fingerprint MATCHES with
one of the stored fingerprints of legitimate users.
• So false matches can only occur for illegitimate users.
• FMR = 30/600*100 = 5%
• Calculating the FNMR:
• A false non-match occur when an legitimate user’s fingerprint DOES NOT
MATCHE with anyone of the stored fingerprints (of legitimate users).
• So false non-match can only occur for legitimate users.
• FNMR = 60/400*100 = 15%
• In this system, there is more likelihood that legitimate users will be 28
refused access than that illegitimate users will be able to gain access
• This system favours security rather than convenience.
How to choose a the threshold of a fingerprint

recognition system?
• Setting the threshold:

• It is very difficult for a system designer to set the threshold
appropriately during the design phase
• No statistical information!
• Authentication systems are usually tested before being used.
• A set of thresholds is defined.
• FMR and FNMR are calculated and recorded for a each threshold
in the set.
29
• An analysis is then conducted to establish three common

indicators that aids the system administrators to set the threshold
• The equal error rate (EER): is the error rate at a particular
threshold for which the FMR and FNMR are equal.
• Convenience = Security
• The zero false match rate (ZeroFMR): the lowest value of the

FNMR for which the FMR is zero.
• No illegitimate users will be accepted but many more legitimate
users will be refused.
• Maximum Security but minimum Convenience
• The zero false non-match rate (ZeroFNMR): The lowest value of
the FMR for which the FNMR is zero
• No legitimate users will be refused but it is much more likely that
illegitimate users will be accepted
• Maximum Convenience but minimum Security 30
ZeroFMR:
the lowest value of
the FNMR for which
ZeroFMR: the FMR is zero
the lowest value of
the FMR for which
the FNMR is zero

Equal Error Rate:
The intersection
between FMR(t)
and FNMR(t)
FNMR = 0 FMR = 0
• The FMR decreases as the threshold increases, and The

FNMR increases
• A higher threshold means that the two samples must be more 31
similar to be considered a match.
Session Outline

• Building site access control and clocking
system
• The smart ID cards
systems
32
4. Biometric applications [1/2]
• Biometric-based applications have recently begun to be
more common.
• Some examples are:
• Facial or fingerprint recognition for immigration control at

national borders
• Fingerprint matching for access control to notebook computers
• The use of a key derived from a biometric template for data
encryption.
• Recall that there are two main types of recognition
systems:
• Authentication (also called verification)
33
• Identification.
4. Biometric applications [2/2]
• Authentication is usually appropriate for real-time
applications such as access control and payment
authentication.
• Identification is appropriate for applications such as

criminal identification and parenthood determination.
• To give examples of some real biometric applications, we
present two case studies:
• A building site access control and clocking system
• The Hong Kong smart ID card replacement exercise.
34
4.1 Case study: building site access
control and clocking system [1/7]
• A UK construction firm wanted to install a secured and fully
automatic entry system.
• They also wanted to prevent fraudulent attempts by the workers
to clock in for their friends
• A biometric-based system was selected because it would be

much harder for a worker to pretend to be their friend at
clock-in and clock-out, because of the unique and personal
nature of biometrics.
Facial or fingerprint biometric system?

35
• Construction workers often have worn fingerprints, so a
system based on fingerprints was not appropriate for this
application.
• Facial biometric has been selected.
• Reminder:

• Facial biometric derive from a photographic image of a face.
• the sensor in this case is a camera.
• The following can make the recognition difficult:
• different facial expressions,
• different angles of the face to the camera
• different lighting conditions
• workers could sometimes be wearing hard hats and sometimes not. 36
• To enhance the reliability of the facial recognition system,
the following was included in the system:
• An enclosure: to reduce the amount of external light entering.
• Controlled lights and infrared flash: to maintain sufficient and
even light on the worker.

• The touch-screen display:
• to enable the workers to see their faces so that they could help in
achieving the required angle and orientation of the image.
• to provide an interface for the worker to interact with the system.
• High-resolution camera: to capture images of good enough
quality to extract the key biometric features.
37
• Face recognition system for building • The console of the face recognition
site use system

38
• During the enrolment process:
• Each worker stood directly facing the camera in the enclosure.
• Several photographs of the worker were taken.
• The feature extractor extracted the facial biometric features

and produced a template.
• The templates were associated with a user ID and stored on a
smart card under the supervision of an administrator.
39
• During the matching process:
• When a worker clocked in, he stands directly facing the camera in
the enclosure for their photograph to be taken.
• The worker presents his smart card to the card reader.
• His stored templates is loaded into the system.

• The matcher compares them with the template derived from the
photograph that had just been taken.
• A decision maker take the decision Match or Non-Match
• If Match
• The turnstile would be opened so that the user could get into the site.
• The date and time of the clock-in, along with the user ID and other
relevant information, are recorded.
• If non- match
• The turnstile would remain locked
40
• The photograph just taken is stored for subsequent investigation.
• Activity 6.12: Is this identification system or an
authentication system? Justify your answer.
• Sol:
• This is an authentication system as users are required to

identify themselves using a token. The system then
verifies whether they are who they claim they are.
41
Session Outline

• Building site access control and clocking
system
• The smart ID cards
systems
42
4.2.2 The smart ID card [1/3]
• Features of the smart Hong Kong ID
Cards:
• They are of a similar size and format
to standard credit cards.
• Personal information, such as the
bearer’s full name, gender, date of

birth and photograph, is printed on
the card.
• The card electronically stores the
encrypted templates of the
thumbprints of both hands.
• As a security measure, the
thumbprint templates and other
data are stored separately in
different partitions (locations) and 43
are strongly encrypted by different
keys.
• Smart Hong Kong ID recognition system:
• The main automatic recognition application is for immigration
control at Hong Kong’s borders.
• So called ‘e-Channels’, which are fully automatic, have been
installed at all major border crossings and ports and at the

airport of Hong Kong.
• During the enrolment process:

• The card bearer is assisted in supplying several samples of the
thumbprints of both hands.
• Digital photographs are also taken.
44
• Smart Hong Kong ID recognition system:
• During the matching process:
• The user is required to insert the ID card in a reader in the e-
Channel and place either one of their thumbs on the scanner.
• The system attempts to match the live scanned thumbprint

with the ones stored on the card.
• If there is a match, the gate will open to allow the user to walk
through.
• Otherwise, the gate will remain closed.
• The whole process usually takes about half a minute to
complete.
45
Session Outline

systems
• Reliability
• Risks
46
5. Concerns and issues relating to
biometric systems
• Many aspects of our lives may be affected by the
increasing use of biometric systems.
• For Example: How we use ATMs or how we enter our
own or a foreign country.

• Such changes will inevitably cause some concerns.
• In this section, we look at some concerns and
issues relating to the use of biometric systems.
47
5.1 Reliability [1/2]
• How reliable are current biometric systems?
• Can we really rely on them for authentication?
• Some media reports suggest biometric systems can be
fooled; is this a real concern or has it been exaggerated?

• These questions can be categorised into two main types
of reliability concern:
• Circumvention,
• and recognition errors.
48
5.1 Reliability [2/2]
• Circumvention:
• Some commercial biometric systems are believed to be very difficult
to circumvent (e.g. the Hong Kong e-Channels),
• BUT, their high-tech image should not lead the general public to think
they are infallible!
• Biometric recognition is a complex process and not completely

foolproof.
• For example, in 2002 a Japanese researcher successfully fooled some
basic fingerprint systems using gelatin.
• Recognition errors:
• Biometric security systems have non-zero false match rates (FMRs).
• Biometric security systems can allow impostors access where access
should be denied.
How to improve the reliability of biometric systems? 49
How to reduce the recognition Errors?

5.1.1 Use of multiple biometrics [1/5]
• Recognition errors can be reduced by applying multiple
metrics to identify a person.
• Using more than one biometric such as face and fingerprint
• Or using a biometric along with a conventional security measure
(example: fingerprint with a password).

• It is more unlikely that two individuals would have similar
multiple metrics, so the probability of a false match is lower.
What if a recognition system makes use of

combined face and fingerprint biometric
subsystems? 50
• A Combined Face and Fingerprint biometric system:
Combined biometric
Finger Fingerprint biometric Match/Non Match
subsystem
system
Match/

AND
Non Match
Face Facial biometric
subsystem Match/Non Match
• The system consists of two subsystems, face and fingerprint.

• Each subsystem provides a decision (Match or Non-Match)
• Suppose that the subsystems decisions are combined as follows:
• The outcome of the combined system will be a match only when the 51
outcomes of both of the subsystems are matches.
• When the outcome of either subsystem is a non-match, the outcome of the
combined system will be a non-match.
• To discover how much more stringent the combine system
is, we do some calculations:
• Assume that the following values have been obtained for the two

systems separately,
• the FMR for the face subsystem is 5%
• the FNMR for the face subsystem is 10%
• the FMR of the fingerprint subsystem is 1%
• the FNMR of the fingerprint subsystem is 8%.
• What is the FMR and FNMR of the combined system?
52
• Combined FMR:
• A false match can only occur if BOTH subsystems
wrongly say there is a match.

• FMR of the combined system: FMRC = FMR1 x FMR2
5 1 5
FMRc = × = = 0.0005 = 0.05%
100 100 10000
• Observation: The FMRC of the combined system is
much smaller (at 0.05%) than is the FMR of either
subsystems (which are 5% and 1%).
53
• Combined FNMR:
• A false non-match can occur if EITHER the face subsystem or
the fingerprint subsystem gives a false non-match.

• FNMR of the combined system :
FNMRC = FNMR1 + FNMR2 – (FNMR1 x FNMR2)
• FNMRC = 10% + 8% – (10% × 8%) = 18% – 0.8% = 17.2%.
• Observation: The FNMR of the combined system has not
gone down – it has gone up!
• Conclusion: Fewer illegitimate users will be allowed access
(More security), but more legitimate users will be denied 54
access (less convenience).
5.1.2 Vulnerability [1/2]
• Even where biometric systems are more secure than conventional
systems, they still have vulnerabilities.
• Vulnerability 1:
• Some biometric identifiers may be acquired secretly and could be
used to make fake objects designed to fool automatic biometric
recognition systems.

• For example, a photograph of a face can be taken remotely and without
the subject’s knowledge
• Fingerprints can be taken from smooth surfaces that the subject
touched.
• Solutions:
• Multiple biometrics can be employed as it is harder to collect
multiple samples and produce multiple fake objects.
• Check the ‘live-ness’ of the biometric sample 55
• The temperature profile, sweating behaviour, etc.
5.1.2 Vulnerability [2/2]
• Biometric systems, especially unsupervised ones, can be
accidentally damaged or even vandalised.
• The sensor, which is usually situated at an exterior location for
obtaining biometric samples, is particularly vulnerable

• When a sensor is malfunctioning the whole system will not work!
• A biometric system, and in particular a biometric identification
system, requires a database to store the biometric templates.
• The database usually stores information of a population of
users.
• If this database is corrupted or stolen, the identities of those
users may be compromised. 56
5.2 Risks
• In biometric recognition systems risks concern ways in which
a system may fail or be compromised and the resulting
consequences.
• In the case of biometric security systems risks are:
• The system fails to recognise a legitimate user

• Consequence: the user is unable to access some system or service.
• This may result in a temporary inconvenience, or may be very serious if a
time-critical service is required.
• The system fails to prevent an illegitimate user from accessing
the system or service
• Consequence: the user gains access to sensitive information or
perhaps even sabotages a system.
57

T215B-Session 7

Uploaded by

Document Information

Original Description:

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

T215B-Session 7

Uploaded by

Copyright:

Available Formats

T215B

Arab Open University Spring 2021

Arab Open University Spring 2021

Arab Open University Spring 2021

The intra-class variations are particularly problematic, as

Arab Open University Spring 2021

Arab Open University Spring 2021

Arab Open University Spring 2021

Arab Open University Spring 2021

Arab Open University Spring 2021

We will now focus on “Minutiae Based

Arab Open University Spring 2021

Arab Open University Spring 2021

Arab Open University Spring 2021

But there may still be a rotation variance!

Arab Open University Spring 2021

Arab Open University Spring 2021

Original fingerprint image: Fingerprint image after

Arab Open University Spring 2021

Arab Open University Spring 2021

Arab Open University Spring 2021

Arab Open University Spring 2021

• The threshold is usually set according to the required security

Arab Open University Spring 2021

Arab Open University Spring 2021

Arab Open University Spring 2021

Arab Open University Spring 2021

• If the population is large, identification may take a very long

Arab Open University Spring 2021

Arab Open University Spring 2021

• The fingerprints can be classified using singularities: arch,

Arab Open University Spring 2021

• Reminder: the sensitivity of a fingerprint recognition system is

• The thresholds used in biometric recognition systems set the

Arab Open University Spring 2021

• False match refers to incorrectly believing that two given sets

Arab Open University Spring 2021

• False match and false non-match errors are unavoidable

Arab Open University Spring 2021

How to assess a biometric recognition system?

• Example: Authentication system

Arab Open University Spring 2021

How to choose a the threshold of a fingerprint

• Setting the threshold:

Arab Open University Spring 2021

• An analysis is then conducted to establish three common

Arab Open University Spring 2021

Arab Open University Spring 2021

• The FMR decreases as the threshold increases, and The

Arab Open University Spring 2021

Arab Open University Spring 2021

Arab Open University Spring 2021

Arab Open University Spring 2021

Facial or fingerprint biometric system?

Arab Open University Spring 2021

Arab Open University Spring 2021

Arab Open University Spring 2021

Arab Open University Spring 2021

Arab Open University Spring 2021

Arab Open University Spring 2021

Arab Open University Spring 2021

Arab Open University Spring 2021

Arab Open University Spring 2021