Better Than the Movies: How Fingerprint PAD is Closing Some of the Security Loopholes You See on Film

In Hollywood, fingerprint scanners are usually a thing to be defeated, an obstacle that the heroes need to get past in order to complete the heist or infiltrate the villain’s lair. That tends to warp the audience’s relationship with the technology. We don’t want movies with fool-proof biometric systems because we want to see the heroes succeed at the end of the film.

The same is very much not true when we’re using the technology in everyday life, where a thumbprint is often the only thing standing between a cybercriminal and our personal information. It would be foolish to trust our smartphone’s fingerprint sensor if someone could fool it with some ingenuity and a bit of tape. You need to know that the tricks that work on film won’t work if someone steals your phone and tries to break into your bank account.

Thankfully, Hollywood tends to exaggerate when it comes to technology. Nick Fury may have been able to use tape to break into a government facility in Captain Marvel, but that movie was set in the 90s, and fingerprint security has improved dramatically in the decades since. It is now far more difficult (and expensive) to create a convincing spoof, and it often requires a machine like a 3D printer and a considerable amount of technical know-how.

However, there are more recent examples of life imitating art, especially when it comes to consumer smartphones. In The Spy Who Dumped Me, the protagonists use a villain’s thumb to unlock his phone after he has been killed, and it turns out that that trick can, in fact, work in real life – even when that finger is no longer attached to that person’s body. Kieran Higgins recently lived a scene out of a horror movie when he used his own severed fingertip to unlock his Galaxy A20 smartphone, which means that some modern sensors cannot tell whether or not the person being authenticated is alive or dead.

That would seem to be the bare minimum requirement for a liveness detection system, though reality is a bit more complicated, as is often the case. When asked to comment on the Higgins case, Thales biometric devices manager Lucas Francese explained that there is a difference between liveness finger detection (LFD) and presentation attack detection (PAD).

“[LFD] stops fake fingers, such as those made by rubber or gelatine, but enables real fingers, dead or alive, to work,” he said in an interview with the Register. “Currently there is no technology deployed in consumer devices that can detect if fingers are live or not; however, these do exist.”

In Higgins’ case, that means that the fingerprint sensor worked exactly as intended. It was able to verify Higgins’ identity because he presented the same finger that he originally registered to his device, just as the spies in The Spy Who Dumped Me took advantage of the owner’s print.  

PAD solutions, on the other hand, can distinguish a dead finger from a live one. The technology is simply more complex and more difficult to implement, especially in personal devices like smartphones where space is at a premium. The risk with smartphones is also relatively low, since fraudsters would need both a finger and a physical device in order to execute a single attack, and it is tough to acquire either without alerting the owner in some capacity.

Having said that, PAD technology is already being used to secure certain high-risk applications, and Thales believes that it will eventually become commonplace as technology continues to improve. The company’s Cogent DactyID20 fingerprint scanner, for instance, recently became the first FAP 20 scanner to achieve compliance with Level 2 of the ISO 30107-3 PAD standard, and did not identify a single fake finger as a real one in independent testing.

So what does a PAD system do that an LFD system doesn’t? At the most basic level, a good PAD system can measure several traits that are only observed in living human tissue. For example, sweat tends to spread unevenly across the body, whereas fake fingers tend to be more uniform in their distribution. Live tissue also has blood running through it. A PAD system can detect that movement, in addition to the skin color changes that occur when blood flow gets restricted.

All of those sign-of-life indicators are absent in a fake finger, and in a real one that is no longer connected to a living person. That means that the next generation of fingerprint sensors are likely to be more robust than the ones that came before them, and to close some of the few security gaps that remain in modern biometric systems. That may make life more difficult for Tom Cruise, but the rest of us will be able to rest easy knowing that our secrets are secure.

–

July 6, 2021 – by Eric Weiss