Fake fingerprints can imitate real ones in biometric systems – research
Fake fingerprints can imitate
real ones in biometric systems – research
DeepMasterPrints created by a
machine learning technique have error rate of only one in five
Researchers have used a neural
network to generate artificial fingerprints that work as a “master key” for
biometric identification systems and prove fake fingerprints can be created.
According to a paper
presented at a security conference in Los Angeles, the artificially
generated fingerprints, dubbed “DeepMasterPrints” by the researchers from New
York University, were able to imitate more than one in five fingerprints in a
biometric system that should only have an error rate of one in a thousand.
The researchers, led by NYU’s
Philip Bontrager, say that “the underlying method is likely to have broad
applications in fingerprint security as well as fingerprint synthesis.” As with
much security research, demonstrating flaws in existing authentication systems
is considered to be an important part of developing more secure replacements in
the future.
In order to work, the
DeepMasterPrints take advantage of two properties of fingerprint-based
authentication systems. The first is that, for ergonomic reasons, most
fingerprint readers do not read the entire finger at once, instead imaging
whichever part of the finger touches the scanner.
Crucially, such systems do not
blend all the partial images in order to compare the full finger against a full
record; instead, they simply compare the partial scan against the partial
records. That means that an attacker has to match just one of tens or hundreds
of saved partial fingerprint in order to be granted access.
The second is that some features of fingerprints are more common
than others. That means that a fake print that contains a lot of very common
features is more likely to match with other fingerprints than pure chance would
suggest.
Based on those insights, the
researchers used a common machine learning technique, called a generative adversarial network, to
artificially create new fingerprints that matched as many partial fingerprints
as possible.
The neural network not only
allowed them to create multiple fingerprint images, it also created fakes which
look convincingly like a real fingerprint to a human eye – an improvement on a
previous technique, which created jagged, right-angled fingerprints that would
fool a scanner but not a visual inspection.
They compare the method to a
“dictionary attack” against passwords, where a hacker runs a pre-generated list
of common passwords against a security system.
Such attacks may not be able to
break into any specific account, but when used against accounts at scale, they
generate enough successes to be worth the effort.
Comments
Post a Comment