New Study Flags Vulnerabilities of “Fingerphoto” Biometrics

Researchers from the Norwegian University of Science and Technology (NTNU) are flagging the vulnerabilities of fingerprint-based smartphone authentication in a new report.

As detailed in a research paper titled “Fingerphoto morphing attack generation using texture descriptors based landmarks”, a study by Hailin Li and Raghavendra Ramachandra looks at novel methods for generating morphing attacks on “fingerphoto” biometrics captured using smartphones. Three different image-level morphing attack generation algorithms are proposed to create high-quality fingerphoto morphing images with minimal distortions.

Extensive experiments conducted on two datasets, captured under various environmental conditions using different smartphones, demonstrate the effectiveness of the proposed morphing algorithms in compromising commercial off-the-shelf (COTS) and block-directional fingerprint verification systems.

“Morphing algorithms” refers to computational techniques that blend or merge multiple biometric images to create a composite image that retains features from each source image. Offering a kind of “master key”, these techniques are often used to exploit vulnerabilities in biometric verification systems.

Fingerphoto biometrics have gained popularity due to their usability and scalability across various smartphones, since they simply use a mobile camera to capture a user’s fingerprint. But these systems are susceptible to both direct and indirect attacks. Direct attacks involve presenting forged biometric data directly to the capture device, while indirect attacks require access to a component of the system and involve providing forged data at some internal step of authentication.

The NTNU study emphasizes that fingerphoto verification systems are particularly vulnerable to direct attacks, as it is relatively easy to generate fingerphoto artifacts and present them to the capture device without any need for knowledge of the system’s functional aspects.

The research outlines a comprehensive method for generating fingerphoto morphing attacks inspired by face morphing techniques. The method involves pre-processing steps such as segmentation, region of interest (ROI) extraction, and alignment, followed by triangulation, warping, and blending of fingerphoto images from different subjects. The proposed method uses local descriptors to estimate keypoints within rectangular grids on the preprocessed fingerphotos, allowing for reliable morph generation.

The study presents a detailed analysis of the morphing process, including the impact of grid sizes and keypoint extraction methods on the quality of the generated morphing images.

The vulnerability assessment conducted in the study shows that the proposed fingerphoto morphing techniques can effectively bypass both COTS and block-directional fingerprint verification systems. The analysis indicates that the quality of the morphing images depends – unsurprisingly – on the quality of the source fingerphoto images, with higher-quality images leading to higher vulnerability.

The research also highlights the influence of smartphone devices and capture conditions on the vulnerability of fingerprint systems, demonstrating that higher-quality capture devices and favorable environmental conditions result in more effective morphing attacks.

In addition to generating morphing attacks, the study proposes several detection techniques to identify these attacks on fingerphoto biometrics. The detection methods use both handcrafted and deep features, with extensive experiments showing that deep features, particularly those extracted using ResNet, offer the best detection performance. Handcrafted features are specific details chosen by experts to identify patterns in images, while deep features are patterns learned by complex computer models like ResNet, which is a powerful tool for recognizing images.

That having been said, the results indicate that even the best-performing detection methods struggle to achieve high accuracy, underscoring the significant threat posed by fingerphoto morphing attacks.

Source: Nature

–

July 15, 2024 – by Cass Kennedy and Alex Perala