biometric recognition: how do i know who you...

Anil K. Jain

Dept. of Computer Science and Engineering

Biometric Recognition: How Do I know Who You are? Biometric Recognition:

How Do I know Who You are?

Dept. of Computer Science and Engineering

Michigan State University

http://biometrics.cse.msu.edu

Courtesy: The New Yorker, January 19, 2009

• Should John be granted a visa?

• Does Alice already have a passport?

• Has Robert already voted?

• Is Mary authorized to enter the securefacility?

Identity QuestionsIdentity Questions

• Is Mary authorized to enter the securefacility?

• Can Steve access the secure website?

• Is Cathy the owner of the bank account?

• Does Charlie have a criminal record?

We rely on credentials: documents & secrets

Al-Qaida Gets Fake PapersAl-Qaida Gets Fake Papers

290,000 passports issued by UK were lost/stolen in 2006

Dhiren Barot, the most senior al-Qaida terrorist ever captured in Britain, had 7 passports in his true identity and 2 further passports in fraudulent identities.

http://press.homeoffce.gov.uk/press-releases/passport-warning?version=1

Identity TheftIdentity Theft

Identity thieves steal customer ID & password

to create financial nightmare for customers

• Most common passwords: password, 123456,

Qwerty, abc123, letmein, monkey, myspace1

• Data breach at Heartland Payment Systems exposed

millions of credit cardholders to fraud (Times, Jan 21, 2009)

• NYPD sergeant uses a colleague username & pw to

access terrorist watch-list

Passwords and PINPasswords and PIN

access terrorist watch-list (HSDailyWire.com; 24 Jan, 2009)

• Total identity fraud in the US in 2007 ~ $50 billion

http://www.privacyrights.org/ar/idtheftsurveys.htm#Jav2007

• “As Dow falls, fraud websites rise” USA Today, Jan 29, 2009

7

Automatic method for recognizing humans based on

one or more intrinsic physical or behavioral traits

Biometric RecognitionBiometric Recognition

• Reduces fraud, enhance security, user convenience,..

• Multifactor authentication (card, PIN & biometric)

Bertillon SystemBertillon SystemBertillon system(1882) stored anthropomorphic features

H.T. F. Rhodes, Alphonse Bertillon: Father of Scientific Detection, Harrap, 1956

Friction Ridge PatternsFriction Ridge PatternsRidged (friction) skin on fingers, palms & soles

Cumins and Midlo, Finger Prints, Palms and Soles, Dover, 1961

FingerprintsFingerprints

“Perhaps the most beautiful and characteristic of all superficial marks (on human body) are the small furrows with the intervening ridges and their poresthat are disposed in a singularly complex yet even that are disposed in a singularly complex yet even order on the under surfaces of the hands and feet.”

Francis Galton, Nature, June 28, 1888

• Repeat Offenders: compare rolled inked

impressions (ten prints)

• Crime Scenes: compare latent prints with

forensic database

• First reported use of fingerprints in a

Fingerprints in ForensicsFingerprints in Forensics

• First reported use of fingerprints in a

criminal case was in Argentina (1895)

IAFIS: ~ 80 million 10 prints; ~80K searches/day;

automatic latent search is still very difficult

FBI Booking cardFBI Booking card

• Border security

• Multiple enrollments

• Financial fraud

• User convenience

Biometric: New EraBiometric: New Era

• User convenience

• Cheap & compact sensors

• Embedded systems

• Requirements: throughput, cost & HCI

Automatic Biometric RecognitionAutomatic Biometric Recognition

Enrollment vs. recognition; verification (1:1) vs. identification (1:N)

Smart Card

Physical Access Control

Logical Access Control

Border Control

Applications

Forensics

Consumer Products

ATM

Singapore Biometric PassportSingapore Biometric Passport

Fingerprint

Face

Started in August 2006

US-VISITUS-VISIT

~ 70M visitors have been processed at the borders

http://www.dhs.gov/usvisit/

People expelled from UAE make repeated efforts to

re-enter with new identities using forged documents

Border Crossing in UAEBorder Crossing in UAE

http://www.cl.cam.ac.uk/~jgd1000/UAEdeployment.pdf

Florida DMV found ~5,000 duplicates (multiple enrollments) by matching 700K face images against a database of 51M faces

Duplicate Driver LicenseDuplicate Driver License

Disney World, OrlandoDisney World, Orlando

Throughput: 100K/day, 365 days/ year; provides access to paying customers & denies access to non-paying customers

Meijer supermarket, Okemos Mobile phone transaction

Citibank, Singapore: pay by fingerprints Bank in Malawi uses fingerprints for micro-loans

Brazilian Elections: Voting MachinesBrazilian Elections: Voting Machines

• Voting machines with fingerprint ID

• TSE (Tribunal Superior Eleitoral) purchased 25,000

voting machines

• System will cover ~125 million Brazilian electors

http://idgnow.uol.com.br/seguranca/2006/08/30/idgnoticia.2006-08-29.2323285944/IDGNoticiaPrint_view

• Intrinsic failures

• Lack of uniqueness in biometric traits (large intra-class variability, small inter-user variability)

• Recognition error (FAR, FRR, failure to enroll)

• Adversary attacks

• Administrative/insider attacks (integrity of enrollment,

Biometric Systems: LimitationsBiometric Systems: Limitations

• Administrative/insider attacks (integrity of enrollment, collusion, coercion)

• Non-secure infrastructure (template security, channel security, software integrity)

• Biometric overtness (spoof attacks)

“State-of-the-art” Error Rates“State-of-the-art” Error Rates

Test Test ParameterFalse

Reject Rate False

Accept Rate

Fingerprint

FVC

[2006]

Heterogeneous population incl. manual workers and elderly people

2.2% 2.2%

FpVTE

[2003]

US govt. operational data

0.1% 1%

Controlled

25 25

FaceFRVT

[2006]

Controlled illumination,

high resolution

0.8%-1.6% 0.1%

IrisICE [2006]

Controlled illumination, broad quality range

1.1%-1.4% 0.1%

VoiceNIST

[2004]

Text independent, multi-lingual

5-10% 2-5%

~85M passengers at Atlanta airport in 2006; what is the acceptable error?

• Intrinsic failures

Biometric Systems: LimitationsBiometric Systems: Limitations

• Adversary attacks

Some ChallengesSome Challenges

• Matching latent friction ridge patterns

• Template security

• Fingerprint individuality

• Soft biometrics (Scars, Marks & Tattoos)

• Facial aging

• Facial Marks

• Sketch to photo matching

FingerprintsFingerprints

rolled plain latent

• Rolled/Plain to Rolled/Plain match

• Latent to Rolled/Plain match

Rolled/Plain Rolled/Plain MatchingMatchingNIST Fingerprint Vendor Technology Evaluation (FpVTE) 2003;

the best matcher (NEC) achieved 99.4% TAR at 0.01% FAR.

Challenges: low quality images, indexing, enhancing ”lights out” capability

Results are based on 10,000 flat fingerprints

Latent MatchingLatent Matching

Average rank-1 rate is ~60% (best ~80%) for

searching 100 latents against 10K rolled;

significantly lower than rolled/plain matching

NIST Evaluation of Latent Fingerprint Technologies (ELFT) 2007NIST Evaluation of Latent Fingerprint Technologies (ELFT) 2007

http://fingerprint.nist.gov/latent/elft07/phase1

Fingerprint Features Fingerprint Features

� Level 1: ridge orientation & frequency, singular point� Level 2: ridge, minutia� Level 3: incipient, dot, ridge contour, pore

Level 1 Level 2 Level 3

Ridge skeleton MinutiaeDelta CorePore Ridge contour

Correct Hits at RankCorrect Hits at Rank--11Rank-1 (rank-20) accuracy of matching 258 latents

against ~30K rolled is 74% (84%)

Matched minutiae shown in green;

index of matched minutiae in yellow;

unmatched minutiae shown in red

PalmprintsPalmprints~30% of crime scenes contain latent palmprints;

need for matching latents to full palmprints

Interdigital

Ridges

Distal transversecrease

ThenarHypothenar

Minutiae

Pores

Radial transversecrease

crease

Proximaltransversecrease

~1,000 minutiae in palmprint compared to ~100 in fingerprint

Latent with minutiae (Green: good quality)

100 latents matched to 10K full palmprints; rank-1

(20) accuracy is 69% (76%)

Latent Palmprint MatchingLatent Palmprint Matching

quality)

Corresponding full print Latent overlaid on full print

Template ProtectionTemplate Protection

• Myth: “A true biometric image cannot be created from master template..”• Template security

35 35

• Template security is critical because it is not easy to revoke templates like passwords

A. Ross, J. Shah and A. K. Jain, “From Templates to Images: Reconstructing Fingerprints from Minutiae Points”, IEEE Trans. on PAMI, Vol. 29, No. 4, pp. 544-560, April 2007

Are Fingerprints Unique?Are Fingerprints Unique?

• “Only Once during the Existence of Our Solar System

Will two Human Beings Be Born with Similar Finger

Markings.” Harper's headline, 1910

• "Two Like Fingerprints Would be Found Only Once

Every 1048 Years." Scientific American, 1911

• The uniqueness of fingerprints has been accepted over • The uniqueness of fingerprints has been accepted over

time due to lack of contradiction & relentless repetition

• Daubert ruling (1993): Hypothesis testing, known or

potential error rate; standards exist and maintained;

Peer reviewed and publications; general acceptance

• USA v. Byron Mitchell (1999)

Tattoo Tattoo Matching & RetrievalMatching & Retrieval

Retrieval ExamplesRetrieval ExamplesQuery Top-5 Retrieved Images with match scores

105

6

6

6

6

Query 1

6

Query 2 79 7324 22

16

How do we scale this to databases with millions of images?

Face RecognitionFace Recognition

1959

1960

?

1973

1972

Challenges in Face RecognitionChallenges in Face Recognition

Pose, lighting, expression

Occlusion

AgingSketch vs. photo

Age ModelingAge ModelingPhotographs of 4 sisters taken every year from 1975 to 2007

1975(age: 23, 15, 25, 21)

1976(age: 24, 16, 26, 22)

Nixon and Galassi, The Brown Sisters, Thirty-three Years, 2007, The Museum of Modern Art

(age: 24, 16, 26, 22)

2007(age: 56, 48, 58, 54)

Rank-one accuracy of Cognitec improved from 15.6% to 27.1%

Recognition with Facial MarksRecognition with Facial Marks

⊗Score fusion

≠ =

≠ =

Recognition failed at rank-1 (FaceVACS only)

Recognition succeeded at rank-1 (FaceVACS + face marks)

Matching with face marks

≠ =

Sketch to Photo MatchingSketch to Photo Matching

• Search a mug shot database for a sketch drawn by a

forensics artist based on witness/victim description

Mug-Shot

Matching

Forensic Artist Sketch

3D sketch Sketch-to-photo conversio

n

Score:0.01

Matching

Score:0.16

Images at different view-

points

Video Surveillance TrialVideo Surveillance TrialMainz Railway StationMainz Railway Station

• Performed by German Federal Police (Oct, 06 to Jan 07)

• Purpose: Test Face recognition systems in a real environment

of a train station; camera views at escalator & stairs

• Performance: Identification rate of 60% at a FAR of 0.1%

based on a gallery (watch list) of 200 enrolled persons

44

Privacy ConcernsPrivacy Concerns

• Will biometric be used to track people?

• Will biometric be used only for the intended purpose? Will the

databases be “linked”? (Function creep)

• How do we alleviate these concerns?

45

SummarySummary

• Biometric recognition provides a strong method

of linking persons to identity records

• With over 100 years of use in forensics,

biometrics is now permeating our society

• Like any security system, biometric systems

can fail and be circumvented; what are its can fail and be circumvented; what are its

implications on citizens?

• Biometrics is not a fully solved problem: ROI,

sensors, representation, robust matcher, fusion

of multiple traits, system security, privacy,

match on card, identification at a distance….

New Biometric Traits?New Biometric Traits?