Fingerprint Authentication Security

Among all the biometric authentication techniques, fingerprint based identification is the oldest and most familiar method. Fingerprints were first recognised as unique in 1684 though the FBI did not begin recording ten finger templates digitally until the 1970s. Everyone is known to have unique, immutable fingerprints. A fingerprint is made of a series of ridges and furrows on the surface of the finger.

The uniqueness of a fingerprint can be determined by this pattern of ridges and furrows. The fingerprint authentication scanner captures an image of the fingerprint and uses complex algorithms to either convert the image into a unique "map" of minutiae points or analyse the pattern. Minutiae points are local ridge characteristics that occur at either a ridge bifurcation (split) or a ridge ending.

This technique reads specific fingerprint 'ridge' characteristics and assigns an x/y co-ordinate. In most countries, a minimum of twelve of these points are legally required for positive identification in a criminal case, a typical biometric fingerprint reader can record in excess of 40 points. Only the data containing the location of the points of minutiae is stored in the template, not the actual fingerprint image. This keeps the file size to a minimum and helps prevent fraud as a fingerprint cannot be recreated from the stored template.

Fingerprint authentication technology is extremely secure with false acceptance rate of around 1 in 100,000.

http://www.cs.columbia.edu/~hgs/teaching/security/slides/people1.pdf

It is not possible for a would-be intruder to store the encoded fingerprint data for resubmission later - every single successive scan of the fingerprint will yield a different byte sequence, yet can still be resolved by the proprietary verification algorithm as being the same fingerprint! For maximum security, the database can be adapted to store each login attempt, and refuse any two attempts with exactly the same byte sequence. Note the above applies equally to all biometric authentication techniques used, be it fingerprint, voice, iris, or other kind of scan .