Biometric measures

Computer Science · Biometric authentication

Stand at the scanner

First pick who is at the scanner. Then pick what the comparison finds. Every route ends somewhere different.

Who is at the scanner? → Is the new scan close enough to the stored template?

On A finger is placed on the fingerprint scanner. 2 branches to choose from.

The enrolled user's fingerprint is already stored as a template. Walk both people up to the scanner and see where each ends up.

Predict, then check

A phone needs your fingerprint and your PIN. A thief has watched you type the PIN.

The thief now knows the PIN but has a different fingerprint. What happens when they try to unlock it?

What you need to know

• A biometric measure checks who you are using a physical or behavioural characteristic that is unique to you.
• Fingerprints, face recognition, the iris or retina of the eye, and voice are all examples.
• Have a goYour mate swears their gran's PIN is a biometric measure because it's 'unique to her'. Which part of the definition does a PIN fail?

  A PIN is not a physical or behavioural characteristic of the person.

  Biometrics authenticate you from a characteristic of you, such as a fingerprint or your voice. A PIN is just a code someone chose.

• At enrolment, your characteristic is scanned once and stored as a template.
• At every later login it is scanned again and compared with that stored template.
• Access is granted only when the new scan matches the template closely enough.
• Have a goA user's login scan is very close to their template but not identical. Granted or refused?

  Granted, because the scan matches closely enough.

  The check is for a close match, not a perfect copy, so 'not identical' on its own does not cause a refusal.

• Because it is a closeness check, it can wrongly reject an authorised user or wrongly accept an unauthorised one.
• Compared with passwords, a characteristic cannot be forgotten, is difficult to guess, share or copy, and is always with you.
• The costs: special hardware such as a scanner or camera, and sensitive data that cannot be changed if stolen.
• Have a goMaya's password leaks, and separately Sam's fingerprint data leaks. Who has the bigger long-term problem, and why?

  Sam, because he cannot change his fingerprint.

  Maya can replace a leaked password, but biometric data cannot be changed if it is stolen.

• Because of this, biometrics are often used with a password or PIN, so more than one factor is needed.

The big picture

Biometric authentication scans a characteristic of the person, stores it as a template at enrolment, and later asks one question: is today's scan close enough to that template? That closeness check is why it beats passwords on forgetting, guessing and sharing, why it can still get things wrong, and why it is often paired with a password or PIN.

⚠ Watch out

Thinking a fingerprint or face scan is an exact, infallible match. The new scan is compared with a stored template and accepted if it matches closely enough, so an authorised user can be wrongly rejected and an unauthorised one wrongly accepted.

Memory hook

Enrol once, compare every time, and ask 'close enough?'. A fingerprint can't be forgotten or guessed, but if it's stolen you can never change it.

Check yourself

Without looking back, tell the whole story in order: what happens at enrolment, what happens at each login, and at which point each of the two wrong results can happen.