👆 Biometric Authentication

Biometric authentication represents a fundamental shift in how we prove our identity. Unlike passwords—which can be forgotten, stolen, or shared—biometric characteristics are inherently tied to the individual. Your fingerprint ridges, iris patterns, and facial geometry are as unique to you as your DNA.

This chapter introduces the three primary biometric modalities covered by the WIA-SEC-007 standard: fingerprint, iris, and face recognition. Each has distinct advantages, challenges, and use cases.

What is Biometric Authentication?

Biometric authentication verifies identity by measuring unique physical or behavioral characteristics. The process involves:

1. Enrollment: Capturing biometric samples and extracting features to create a template
2. Storage: Securely storing the encrypted template
3. Authentication: Capturing a new sample and comparing it to the enrolled template
4. Decision: Accepting or rejecting the claim based on similarity score

Advantages of Biometric Authentication

• Convenience: No need to remember passwords or carry physical tokens
• Security: Cannot be easily stolen or shared (with proper liveness detection)
• Non-repudiation: Strong proof of identity for audit trails
• Accessibility: Easier for users with disabilities (e.g., face recognition for those unable to type)

Challenges & Concerns

• Privacy: Biometric data is sensitive and permanent—you can't change your fingerprints
• Spoofing: Attackers may use fake fingerprints, photos, or videos
• Template Protection: Stored templates must be encrypted and revocable
• False Accepts/Rejects: No biometric system is 100% accurate

WIA-SEC-007 Standard Goals

This standard aims to:

• Define interoperable data formats for fingerprint, iris, and face templates
• Establish quality metrics and performance benchmarks
• Specify template protection mechanisms (cancelable biometrics)
• Integrate with modern standards (FIDO2, WebAuthn)
• Ensure privacy compliance (GDPR, CCPA)

Fingerprint recognition is the oldest and most widely deployed biometric technology. The uniqueness of fingerprint patterns has been recognized for over a century, and modern automated fingerprint identification systems (AFIS) can match fingerprints in milliseconds.

How Fingerprints Work

Your fingertips contain raised ridges and valleys that form unique patterns. These patterns include:

• Arch: Ridges enter from one side and exit the other
• Loop: Ridges enter, curve around, and exit the same side (60-65% of population)
• Whorl: Circular or spiral ridge patterns (30-35% of population)

Minutiae Points

Fingerprint matching relies on minutiae—tiny features where ridges end or split:

• Ridge ending: A ridge that abruptly terminates
• Bifurcation: A ridge that splits into two

A typical fingerprint contains 30-50 minutiae points. The spatial relationship (position and angle) of these points creates a unique template.

Capture Technologies

• Optical: Uses light to image the fingerprint (most common)
• Capacitive: Measures electrical capacitance differences between ridges and valleys (smartphones)
• Ultrasonic: Uses sound waves to map fingerprint in 3D (Samsung, Qualcomm)
• Thermal: Detects temperature differences

Quality Metrics (NFIQ)

The NIST Fingerprint Image Quality (NFIQ) score rates fingerprints on a 1-5 scale:

• 1 (Excellent): Clear ridges, high contrast
• 2-3 (Good): Acceptable for matching
• 4-5 (Poor): Should be rejected and recaptured

Performance

• EER (Equal Error Rate): 0.01% - 1% for good quality fingerprints
• Template Size: 200-500 bytes
• Matching Speed: <10ms on modern hardware

The human iris—the colored ring around the pupil—contains an incredibly complex pattern of crypts, furrows, and collarettes. Iris recognition is widely regarded as the most accurate biometric technology.

Why Iris is Unique

The iris develops during gestation and remains stable throughout life. Even identical twins have different iris patterns. Key features include:

• Crypts: Diamond-shaped holes in the iris stroma
• Furrows: Radial furrows extending from the pupil
• Collarette: The zigzag boundary dividing inner and outer iris
• Pigment spots: Areas of increased melanin

Daugman's IrisCode

John Daugman developed the dominant iris recognition algorithm in 1993. It works by:

1. Localization: Finding the pupil and iris boundaries
2. Normalization: Unwrapping the annular iris into a rectangular image
3. Encoding: Applying 2D Gabor wavelets to extract phase information
4. Comparison: Computing Hamming distance between IrisCodes

The result is a 2048-bit binary code (256 bytes) that uniquely represents the iris.

Near-Infrared Imaging

Iris scanners use near-infrared (NIR) light (700-900nm) because:

• Reveals texture in dark eyes (where visible light shows little detail)
• Reduces specular reflections from the cornea
• Minimizes pupil constriction (bright light causes pupils to shrink)

Performance

• EER: 0.001% - 0.1% (extremely accurate)
• Template Size: 512 bytes (256 bytes code + 256 bytes mask)
• False Match Rate: 1 in 1 million (or better)
• Capture Distance: 10-30 cm (contact-free)

Challenges

• Requires user cooperation (gaze at camera)
• Difficult with glasses, contact lenses, or eyelid occlusion
• More expensive sensors than fingerprint
• Cultural sensitivity in some regions

Face recognition has transformed from a futuristic dream to an everyday reality, powering smartphone unlocking, airport boarding, and payment authentication. Modern deep learning has made face recognition both highly accurate and remarkably convenient.

How Face Recognition Works

Face recognition involves three key steps:

1. Detection: Locate faces in an image (Viola-Jones, MTCNN, RetinaFace)
2. Alignment: Normalize face pose using facial landmarks (eyes, nose, mouth)
3. Recognition: Extract a feature vector (embedding) and compare

Deep Learning Revolution

Pre-2012, face recognition relied on hand-crafted features (LBP, HOG). Deep learning changed everything:

• DeepFace (Facebook, 2014): First deep learning system to achieve human-level accuracy
• FaceNet (Google, 2015): Introduced triplet loss and 128-D embeddings
• ArcFace (2018): State-of-the-art angular margin loss

These systems learn to map faces into a high-dimensional space where similar faces are close together.

3D Face Recognition

2D face recognition struggles with pose, lighting, and spoofing. 3D face recognition adds depth:

• Structured Light: Project a pattern and measure distortion (iPhone Face ID)
• Time-of-Flight (ToF): Measure light reflection time
• Stereo Vision: Two cameras compute depth from disparity

3D face recognition is much more robust to lighting changes and spoofing attacks.

Liveness Detection

To prevent photo/video attacks, face recognition systems employ:

• Depth: 2D photos/screens have no depth
• Texture Analysis: Detect print artifacts, screen pixels
• Motion: Request user to blink, smile, turn head
• Thermal: Detect body heat signature

Performance

• 2D Face (RGB): EER 1-5% (sensitive to lighting, pose)
• 3D Face: EER 0.1-1% (much more robust)
• Template Size: 512 bytes - 2 KB (128 or 512-D embedding)
• Capture Distance: 30-200 cm (highly convenient)

Privacy Considerations

Face recognition raises unique privacy concerns:

• Can be captured at a distance without consent
• Enables mass surveillance
• Subject to bias (lower accuracy for certain demographics)

Responsible deployment requires transparency, consent, and regular bias audits.

No biometric system is perfect. Understanding error rates is crucial for deploying systems that balance security and convenience.

The Two Fundamental Errors

False Accept Rate (FAR)

The probability that the system incorrectly accepts an impostor.

Example: If FAR = 0.01%, then 1 in 10,000 impostor attempts will be accepted.

False Reject Rate (FRR)

The probability that the system incorrectly rejects a genuine user.

Example: If FRR = 1%, then genuine users will be rejected 1 in 100 times.

The Security vs. Convenience Tradeoff

FAR and FRR are inversely related. Lowering the matching threshold makes the system:

• More convenient (lower FRR—fewer rejections)
• Less secure (higher FAR—more impostor accepts)

Raising the threshold does the opposite.

Equal Error Rate (EER)

The EER is the point where FAR = FRR. It's a single number that summarizes system performance:

• Lower EER = Better system
• Typical EER values:
  • Fingerprint: 0.01% - 1%
  • Iris: 0.001% - 0.1%
  • Face (2D): 1% - 5%
  • Face (3D): 0.1% - 1%

ROC Curve (Receiver Operating Characteristic)

The ROC curve plots True Accept Rate (1 - FRR) vs. False Accept Rate (FAR) at different thresholds. The area under the curve (AUC) measures overall performance:

• AUC = 1.0: Perfect classifier
• AUC = 0.5: Random guessing
• AUC > 0.99: Excellent biometric system

Selecting the Operating Point

Different applications require different thresholds:

• High Security (Banking, Government): FAR = 0.001%, tolerate higher FRR
• Convenience (Smartphone unlock): FRR = 1%, tolerate higher FAR
• Balanced (Enterprise access): Operate near EER

Your biometric data is permanent. If stolen, you cannot change your fingerprints like you change a password. Template protection is therefore critical.

The Threat Model

Consider these attack scenarios:

• Database Breach: Attacker steals encrypted templates
• Replay Attack: Attacker intercepts and replays captured template
• Presentation Attack: Fake fingerprints, photos, 3D-printed faces
• Cross-Matching: Attacker correlates templates across different systems

Cancelable Biometrics

Unlike passwords, you can't change your biometrics—but you can change how they're stored:

BioHashing

Combine the biometric template with a user-specific token (password, PIN, or random key). If compromised, revoke by changing the token.

Fuzzy Vault

Hide a secret (e.g., cryptographic key) among biometric features. Only a matching biometric can unlock the secret. Add "chaff" points to obscure the genuine features.

Homomorphic Encryption

Encrypt the template such that matching can be performed in the encrypted domain—the server never sees the plaintext biometric.

Secure Storage

Store biometric templates in:

• Secure Enclave: Hardware-protected memory (Apple Secure Enclave, ARM TrustZone)
• TPM (Trusted Platform Module): Hardware security chip
• HSM (Hardware Security Module): For enterprise/government

Always encrypt templates with AES-256-GCM before storage.

Privacy Regulations

GDPR (General Data Protection Regulation)

Biometric data is "special category personal data" requiring:

• Explicit user consent
• Right to deletion
• Data portability
• Purpose limitation

CCPA (California Consumer Privacy Act)

Similar requirements for California residents.

BIPA (Illinois Biometric Information Privacy Act)

Requires written consent and disclosure before biometric collection.

Best Practices

• Never store raw biometric images—only protected templates
• Use template protection (cancelable biometrics)
• Encrypt templates at rest and in transit
• Implement liveness detection
• Provide clear consent mechanisms
• Enable user deletion of biometric data
• Conduct regular security audits
• Test for demographic bias

FIDO2 (Fast Identity Online) and WebAuthn bring passwordless biometric authentication to the web. This chapter explains how they work and why they're a game-changer for online security.

The Password Problem

• Users reuse passwords across sites (one breach compromises all)
• Phishing attacks trick users into entering passwords on fake sites
• Passwords can be guessed, cracked, or stolen

How FIDO2 Solves This

FIDO2 eliminates passwords by using public key cryptography + biometric authentication:

1. Registration: Device generates a key pair (public + private). Public key sent to server, private key stays on device.
2. Authentication: Server sends challenge. User proves identity with biometric. Device signs challenge with private key.
3. Verification: Server verifies signature with public key.

Key Advantages

• Phishing-Resistant: Private key never leaves device, can't be phished
• No Passwords: Nothing to remember or type
• Privacy-Preserving: Biometric never sent to server (only signature)
• Site-Specific Keys: Each site gets a unique key pair (no cross-site tracking)

Components

WebAuthn API

Browser JavaScript API for registration and authentication:

• navigator.credentials.create() - Register authenticator
• navigator.credentials.get() - Authenticate

CTAP (Client to Authenticator Protocol)

Communication between browser and authenticator (e.g., fingerprint sensor, YubiKey).

Authenticators

• Platform: Built into device (Touch ID, Face ID, Windows Hello)
• Roaming: External (YubiKey, USB security key)

User Experience

Registration:

1. User clicks "Sign up"
2. Browser prompts: "Use Touch ID to register?"
3. User authenticates with fingerprint/face
4. Done—no password to create!

Authentication:

1. User clicks "Sign in"
2. Browser prompts: "Use Touch ID?"
3. User authenticates with biometric
4. Signed in!

Security Properties

• Attestation: Cryptographic proof of authenticator model (verify hardware is genuine)
• User Verification: Ensures biometric was checked
• Counter: Prevents cloning (increments with each use)
• Origin Binding: Challenge includes domain name (prevents phishing)

Biometric authentication has moved from science fiction to everyday reality. This chapter explores real-world deployments across industries.

Consumer Devices

Smartphones

• Apple Touch ID/Face ID: Over 1 billion devices, <1% FRR
• Samsung Ultrasonic Fingerprint: Under-display sensor
• Google Pixel Face Unlock: Dual IR camera system

Laptops

• Windows Hello: Face/fingerprint for Windows login
• MacBook Touch ID: Fingerprint in power button

Financial Services

ATMs

Banks in Japan, India, and Brazil deploy fingerprint/iris ATMs—no card needed.

Mobile Payments

• Apple Pay: Touch ID/Face ID for transaction approval
• Mastercard Biometric Card: Fingerprint sensor embedded in credit card

Border Control & Travel

e-Gates

Automated border control using face + passport chip. Deployed at airports worldwide (UK, EU, Australia).

TSA PreCheck

Fingerprint enrollment for expedited airport security (US).

India Aadhaar

World's largest biometric database: 1.3 billion people enrolled with fingerprint + iris.

Healthcare

Patient Identification

Hospitals use fingerprint/iris to prevent medical identity theft and ensure correct patient records.

Prescription Drug Monitoring

Fingerprint verification when dispensing opioids (to prevent abuse).

Enterprise Access Control

Physical Security

• Fingerprint/face readers for building entry
• Biometric time & attendance systems

Logical Security

• Biometric login to workstations
• Multi-factor authentication (biometric + PIN)

Law Enforcement

AFIS (Automated Fingerprint Identification System)

FBI maintains database of 100+ million fingerprints for criminal investigations.

Mobile ID

Police officers use portable fingerprint scanners to identify suspects in the field.

Humanitarian Applications

Refugee Registration

UNHCR uses iris recognition to register refugees and distribute aid (preventing fraud).

Child Welfare

Fingerprint/face recognition reunites missing children with families.

Challenges & Ethical Considerations

• Bias: Lower accuracy for certain demographics requires ongoing testing
• Surveillance: Mass face recognition raises civil liberties concerns
• Consent: Ensure users understand and agree to biometric use
• Security: Database breaches have severe consequences

Thank you for reading this guide. May it serve humanity well.