A new study by researchers at Pace University has shown vulnerabilities in two widely-used licensed biometrics systems, which turned out to be thrown off by factors like simple disguises and the way cold weather changes people’s fingerprints.
The study comes at a time when the use of face and fingerprint biometrics products is growing. According to a senior Defense Department official quoted on Wired.com, chances are the U.S. forces used a handheld biometrics recorder that takes iris scans, fingerprints and facial scans to verify the biometric information of Osama bin Laden.
The Pace study was primarily done by undergraduates at Pace’s Seidenberg School of Computer Science and Information Systems, which for some years has offered courses and conducted research in biometrics. The findings were presented at the school’s annual research day conference on Friday, May 6 in White Plains, NY.
The researchers say they have absolutely no reason to cast doubt on the identification of bin Laden. They do say, however, that their findings suggest that identifications based on the two biometric systems they studied should not be considered completely reliable, and they suggest ways to improve the technique.
Misleading conditions
“The purpose of this study is to evaluate the accuracy of face and fingerprint biometrics using Neurotechnology’s VeriLook and VeriFinger software,” the researchers write. “More specifically, we examine the vulnerability of face and fingerprint biometrics under conditions that can potentially mislead the system.”
Licenses to use the associated Software Development Kits (SDKs) were purchased by Pace from Neurotechnology. The products were chosen for this study because of their availability and claimed performance. The researchers found the products did not perform as well as anticipated and access to detailed software information, such as the feature vectors, was not provided as promised in discussions with a company representative.
According to Neurotechnology’s web site, more than 2,000 system integrators and sensor providers in more than 100 countries license and integrate the company's technology into their own products.
The study, titled “Investigation of Two Licensed Biometric Products” was conducted by Pace undergraduate students Juan F. Amadiz, Jia T. Liu, Giovanni Lugones, Shashanka Tripuraneni, Alex Alexandrou, and Sadia Ismat. The research was done under the supervision of Professor Charles C. Tappert, Ph.D., the former IBM researcher who spearheaded the development of the handwriting recognizer in IBM's ThinkPad, and investigated the military potential of wearable computers for Army Research Labs.
In the Pace study, the VeriLook and VeriFinger software programs were tested and evaluated to determine if facial and fingerprint recognition are really practical mediums for security and how accurately the software can perform identifications. A number of variables were tested to isolate instances in which the software would be vulnerable to inaccuracy.
Previous studies have found facial software to be fooled by facial hair, making different facial expressions and adding props to the face. With fingerprints the Pace researchers found that an excessive amount of lotion would change the fingerprint reading, and a moderate change in temperature would also change the readings.
Dark glasses, hand lotion, and cold weather.
The researchers used facial disguises with dark/rose sunglasses, reading glasses, afro hair, a pirate’s cap, and a handlebar mustache; and hand lotion and sanitizer and extreme weather conditions to test the two systems.
They found that the accuracy of face recognition with VeriLook majorly depends on the quality of the face images. “It is vital to maintain image quality during enrollment, the process of creating templates, which is a frameset of the measurements of one’s face for addition to the program’s database, especially because face recognition accuracy is determined against those face templates,” the researchers write. “Among the many variables, we find face posture, facial expressions, and cameras used in the research to have the highest influence in achieving accuracy in face recognition and face identification.”
Facial expressions such as broad smile, raised eyebrows, frowning or closed eyes impacted the accuracy reading during the experiments. The researchers also found lower accuracy in face matching was achieved when the make and model of cameras were not the same in the enrollment and identification phases.
In an experiment with VeriFinger to simulate what would happen if a person experienced hot or cold weather before their fingerprint was scanned, the researchers put a subject’s finger on ice for ten minutes to lower the average temperature. The results showed that after putting the finger on ice, the average score dropped by half. In the same experiment with heat, a subject’s finger was put over heat and the score also dropped by half.
The importance of eyes
The VeriLook software concentrates greatly on the eyes and proved to be quite efficient when the area from below the eye to the forehead was provided. If the eyes were not clearly visible, the accuracy of the test would be greatly diminished, and vice versa if the eyes were clearly extracted. In various instances, the software was not able to identify faces when slightly turned away from the camera. The researchers say this could prove to be very discerning since in most uses, such as law enforcement, the camera does not always get a clear, straightforward shot of the subject.
The VeriFinger software was not efficient when a person stepped inside a building after being exposed to harsh weather, such as freezing or extremely hot temperatures. The system was able to identify that person but at a much lower accuracy rating. Also, after applying lotion or hand-sanitizer, the system was able to identify that person with a high accuracy rating -- unless a person applied so much lotion that it smudged the scanner or there was still lotion visible on their hand. The score of the accuracy after the person applied lotion or hand-sanitizer only dropped about ten points, compared to the score after the person stepped indoors from cold or hot weather, in which situation the score dropped by half the average rating.
About the Seidenberg School
This year's ninth Michael L. Gargano Annual Research Day conference was dedicated to the work of Dr. Frank Rosenblatt, the inventor of perceptrons. Inherent in The Seidenberg School’s activities and services to students, businesses, and the community is the belief that information technologies are tools for the empowerment of people. Established in 1983, Seidenberg is the youngest school within Pace University. Its mission is to prepare men and women for professional work, research, and lifelong participation in a new and dynamic information age. The school offers a student-oriented environment; small classes; committed teaching; research with professors; innovative programs, projects, and partnerships; and convenient multi-campus locations in New York City and Westchester County as well as online courses and programs.
About Pace University
For 105 years, Pace University has educated thinking professionals by providing high quality education for the professions on a firm base of liberal learning amid the advantages of the New York metropolitan area. A private university, Pace has campuses in New York City and Westchester County, New York, enrolling nearly 13,000 students in bachelor’s, master’s, and doctoral programs in its Lubin School of Business, Dyson College of Arts and Sciences, College of Health Professions, School of Education, School of Law, and Seidenberg School of Computer Science and Information Systems. www.pace.edu
Media contact: Bill Caldwell, Pace University, 212-346-1597, wcaldwell@pace.edu
