Matsumoto Labratory - Artificial Fingers for Fingerprint Scanners

8/8/2019 Matsumoto Labratory - Artificial Fingers for Fingerprint Scanners

1/33

ITU-T Workshop on Security, Seoul

Importance of Open Discussion on

Adversarial Analyses for Mobile Security

Technologies--- A Case Study for User Identification ---

14 May 2002

Tsutomu MatsumotoGraduate School of Environment and Information Sciences

Yokohama National University

email:[email protected]


2/33

Mobile Security Technologies

Security Architecture

Operating Systems Security

Software Tamper ResistanceMobile Code Security

Physical Tamper ResistanceCommunications Security

Cryptographic Protocol

User Identification


3/33

Adversarial Analysis

Security assessmentof biometric user identificationsystems should be conducted not only for the accuracy

of authentication, but also for security against fraud.

In this presentation we focus on Fingerprint

Systems which may become widespread forMobile Terminals.

Can we make artificial fingers that fool fingerprint systems?

Examine Adversarial Analysis as A Third Party

What are acceptance rates?


4/33

Fingerprint Systems

Typical structure of a fingerprint systemTypical structure of a fingerprint system

Types of sensorsTypes of sensors

Optical sensors

Capacitive sensorsThermal sensors, Ultrasound sensors, etc.

Finger

Finger Data

Feature Extraction

Finger Information Database

Fingerprint System

Enrollment

Verification or Identification

Recording

Capturing

Presenting

Result

Referring

Comparison

Live and Well Detection


5/33

A Risk Analysis for Fingerprint Systems

Attackers may present1) the registered finger,by an armed criminal, under duress, or with a sleeping

drug,

2) an unregistered finger (an imposter's finger),i.e., non-effort forgery,

3) a severed fingertip from the registered finger,

4) a genetic clone of the registered finger,

5) an artificial clone of the registered finger, and

6) the others,

such as a well-known method as a fault based attack.


6/33


7/33

Fraud with Artificial Fingers I

X

L(X)

X

L(X)

EnrollmentEnrollment

A(X)s

Distribution of A(X)sDistribution of A(X)s

Y X

Y obtains A(X).Y obtains A(X).

A(X)

X or Y

AuthenticationAuthentication

A(X)


8/33

Fraud with Artificial Fingers II

Y X

X obtains A(Y).X obtains A(Y).

A(Y)

X

A(Y)

X

A(Y)

X enrolls A(Y).X enrolls A(Y).


A(Y)

or L(Y)

X or Y

A(Y)s

Distribution of A(Y)sDistribution of A(Y)s


9/33

Fraud with Artificial Fingers III

X Y

Y makes A(X).Y makes A(X).

A(X)

L(X)

X

L(X)L(X)

EnrollmentEnrollment

X

A(X)s

Distribution of A(X)sDistribution of A(X)s

Y


A(X)


10/33

Mapping a Fingerprint onto Artificial Fingers

Finegerprint

Impression

Artificial Finger

e.g., Molds, Residual Fingerprints, ...

e.g., Live Fingers, Generators, ...


11/33

Known Results

Process 0

(1) Finger

(2) Mold

(3) Silicone Rubber Finger


12/33

Fact

Often Accepts

Silicone Rubber Fingers

Finger

LightSource

Det

ector

Finger

Array of Electrodes

Usually Rejects

Silicone Rubber Fingers

Optical SensorOptical Sensor Capacitive SensorCapacitive Sensor


13/33

Gummy Fingers

Our ResultProcess 1(1) Finger

(2) Plastic Mold

(3) Gummy Finger

Our ResultProcess 1(1) Finger

(2) Plastic Mold

(3) Gummy Finger


14/33


15/33

Recipe 1-2

Put the plastic

into hot water

to soften it.Press a live finger

against it.

The moldIt takes around 10 minutes.

How to make a moldHow to make a mold

Making an Artificial Finger directly from a Live Finger

R i 1 3


16/33

Recipe 1-3


Preparation of material

A liquid in which immersed gelatin at 50 wt.% .

Preparation of material

Add boiling water (30cc) to solid gelatin (30g) in a

bottle and mix up them.

It takes around 20 minutes.

R i 1 4


17/33

Recipe 1-4


How to make a gummy fingerHow to make a gummy finger

It takes around 10 minutes.

Put it into

a refrigerator to cool.

Pour the liquid

into the mold.

The gummy finger

Si il it ith Li Fi


18/33

Similarity with Live Fingers

The photomicrographs of fingersThe photomicrographs of fingers

(a) Live Finger (b) Silicone Finger (c) Gummy Finger

C t d I


19/33

Captured Images

Captured images with the device C (an optical sensor).Captured images with the device C (an optical sensor).

(a) Live Finger (b) Silicone Finger (c) Gummy Finger

Captured images with the device H (a capacitive sensor).Captured images with the device H (a capacitive sensor).

(a) Live Finger (b) Gummy Finger

E i t


20/33

Experiments

Fingerprint systems: 11 types

Subjects: five persons whose ages are from 20s to 40s

We attempted one-to-one verification 100 times counting thenumber of times that it accepts a finger presented.

Types of experiments

Experiment Enrollment Verification

Type 1 Live Finger Live Finger

Type 2 Live Finger Gummy FingerType 3 Gummy Finger Live Finger

Type 4 Gummy Finger Gummy Finger

The List of Fingerprint Devices


21/33

The List of Fingerprint Devices

H ardw are S pecifications So ftwa re Spe cific ationsM e thods

M anufacturer /

Selling Agency P ro duc t N am e T yp e

Pr oduc t

N u m b e r Sensor

Live and

W e llDetect ion

M anufacturer /

S e l ling Agency

Product Name

(Application)

C ompar i son

Levels

fo r

Verification

D evice ACo m p a q Co m p u ter

Corpora t ion

Co m p a q S t a n d -Alo n e

Fingerprint Identification

Uni t

D F R -200 E 0 38 11U S 00 1Opt ica l

Se n so ru n k n o wn

Co m p a q Co m p u ter

Corpora t ion

F in gerprint Identification

T echnology Sof tw are

version 1.1

1 through 3M inut iae

Ma tc h in g

D evice B

M I T S U B I S H I

E L E C T R I C

C O R P O R A T I O N

Fingerprint R ec ognizer F PR -D T mkII 003 136Opt ica l

Se n so ru n k n o wn

Su m ik in I z u m i

Com puter Serv ice co .

Ltd .

S ecFP V 1.11 F ix edM inut iae

Ma tc h in g

D evice C NEC Co rp o ra ti o n Fingerprint IdentificationUnit (P rism)

N 7 95 0-41 9 Y00 00 3 Opt ica lSe n so r

unk now n N E C C orp ora tion B asic U til it ies forF in gerprint Identification

Fixed

M inut iae

Ma tc h in g(Minut ia and

Rela t ion)

D evice D OMRON Co rp o ra t i o nFingerprint Recognition

SensorFP S-100 0 9 050 085 4

Opt ica l

Se n so runk now n O M R O N C or por ation

"Y U B I P A S S " U.a re .UF in gerprint Ver ification

So f twa re

FixedM inut iae

Ma tc h in g

D evice E Sony Corpora t ionSony F ingerpr in t

Identification U nitF IU -00 2-F11 0 07 09

Opt ica l

Se n so r

Live Finger

detection

T S U B A SA S Y S T E M

C O . , L T D .

F in gerprint Identification

U n it W in do ws 9 5Inte rac t ive Demo Ver sion

1 .0 Bu i ld 13

1 through 5Pa t te rn

matching

D evice F FU J IT SU L IM IT E D Fingsensor FS-2 00U 00 A A 0 002 57Capac i t ive

Se n so runknow n F U JIT S U L IM IT ED

Logon for Fingsensor V1.0

for W indows 95/98Fixed

M inut iae

Ma tc h in g

(Corre la t ion)

D evice G NEC Co rp o ra ti o nFingerprint Identification

Unit (Seria l)P K-FP 002 03 005 29S

Capac i t ive

Se n so runk now n N E C C orp ora tion

B asic U til it ies for

F in gerprint IdentificationFixed

M inut iae

Ma tc h in g

(Minut ia and

Rela t ion)

D evice HSiemens A G (Infineon

Technologies AG )

FingerTIP

E V A L U A T I O N K I T

E V A L U A T I O N -

KIT

C 9 8 4 5 1 -

D6 1 0 0 -A9 0 0 -

4

Capac i t ive

Se n so r

u n k n o wnSiemens AG (Infineon

T echnologies AG)

F ingerTIP So f twa reD e v elo pm e n t Ki t (SDK )

V ersion: V0.90 , B e ta 3"De m o P ro g ra m "

FixedMin u t i a

matching

D evice I Sony Corpora t ionSony F ingerpr in t

Identification UnitF IU -710 30 00 398

Capac i t ive

Se n so r

Live Finger

detectionSystemneeds Inc . Good- bye " PASSWORD" s 1 through 5

Pa t te rn

matching

D evice J Secu gen Ey eD m ouse II S M B - 8 0 0 9650172004OpticalSensor

u n k n o wn SecugenSecuDesktop 1.55

1 through 9Minutiamatching

D evice K Ethenticae thent ica t ior MS 3 000 PC

Ca rdM S 3 0 0 0 M300F200991

OpticalSensor

unknown EthenticaSecure Sui t eReleas e1. 0

FixedMinutiamatching

Experimental Results


22/33



0

20

40

60

80

100

A B C D E F G H I J K

Fingerprint Device

TheN

um

ber

of

Ac

ceptance(tim

es/100ate

m

pts)

L - L L - A A - L A - A

Gummy Fingers


23/33

Gummy Fingers

Our ResultProcess 2(1) Residual Fingerprint(2) Digital Image Data

(3) Printed Circuit Board

(4) Gummy Finger

Our ResultProcess 2(1) Residual Fingerprint(2) Digital Image Data

(3) Printed Circuit Board

(4) Gummy Finger

Recipe 2 1


24/33

Recipe 2-1

Making an Artificial Finger from a Residual Fingerprint

MaterialsMaterials

A photosensitive

coated Printed Circuit

Board (PCB)

10K by Sanhayato Co., Ltd .

Solid gelatin sheet

GELATINE LEAF by MARUHA CORP

200JPY/30grams

320JPY/sheet

Recipe 2-2


25/33

Recipe 2-2

Digital Microscope

KEYENCE VH6300: 900k pixels

Inkjet Printer

Canon BJ-F800: 1200x600dpi

Residual Fingerprint

Enhancing

Capturing

Fingerprint Image

Image Processing

Transparent Film

Mask

PhotosensitiveCoated PCB

Cyanoacrylate

Adhesive

Adobe Photoshop 6.0

Printing

Exposing

Developing

Etching

Mold

UV light

Recipe 2-3


26/33

Recipe 2-3

A Mask with Fingerprint Images

An Enhanced Fingerprint A Fingerprint Image

Recipe 2-4


27/33

Recipe 2 4

Gelatin Liquid

Put this mold intoa refrigerator to cool,

and then peel carefully.

40wt.%

Drip the liquid

onto the mold.

The Mold and the Gummy Finger


28/33

The Mold and the Gummy Finger

Mold: 70JPY/piece

(Ten molds can be obtained

in the PCB.)

Gummy Finger: 50JPY/piece

Resolution of Fingerprint Images


29/33

Resolution of Fingerprint Images

Pores can be observed.

Captured Fingerprint Image of

the Gummy Finger

with the device H (a capacitive sensor)Enhanced Fingerprint



30/33

p

from Residual Fingerprints (for 1 subject)

0

20

40

60

80

100

A B C D E F G H I J K

Fingerprint Device

TheN

um

ber

of

Acceptance(t

im

es/100ate

m

pts)

L - L L - A A - L A - A

Characteristics of Gummy Fingers


31/33

f y g

0

100

200

300

400

500

0 50 100 150

Pressure Sensor O utput (g)

Tac

tile

Sensor

O

utpt

(H

z)

Gummy Finger

Live Finger

Moisture Electric Resistance

Live Finger 16% 16 Mohms/cm

Gummy Finger 23% 20 Mohms/cm

Silicone Finger impossible to measure impossible to measure

The compliance was also examined for live andgummy fingers.

Conclusions


32/33

Conclusions

There can be various dishonest acts using artificial fingers

against the fingerprint systems.

Gummy fingers, which are easy to make with cheep, easilyobtainable tools and materials, can be accepted by 11 types of

fingerprint systems.

The experimental study on the gummy fingers will haveconsiderable impact on security assessment of fingerprint

systems.

Manufacturers,vendors, and users of biometric systems shouldcarefully examine security of their system against artificial

clones.

How to treat such information should be an important issue.

For Details


33/33

For Details

Paper:

T. Matsumoto, H. Matsumoto, K. Yamada, S. Hoshino,Impact of Artificial Gummy Fingers on Fingerprint

Systems Proceedings of SPIE Vol. #4677,

Optical Security and Counterfeit Deterrence Techniques IV.

Matsumoto Labratory - Artificial Fingers for Fingerprint Scanners

Documents

Transcript of Matsumoto Labratory - Artificial Fingers for Fingerprint Scanners