Nothing is completely secure.
Locks can be picked, safes can be
broken into, and online passwords can be guessed sooner or later. How,
then, can we protect the things that we value? One way is to use biometrics—fingerprints, iris scans,
retinal scans, face scans, and other personal information
that is more difficult to forge. Not so long ago, if you'd had your
fingerprints taken, chances are you were being accused of a crime; now,
it's innocent people who are turning to fingerprints to protect
themselves. And you can find fingerprint scanners on everything from
high-security buildings to ATM machines and even laptop computers.
Let's take a closer look at how they work!
Photo: Taking a thumbprint with a handheld fingerprint scanner. The scanning area
is on top of the machine (on the left as we look at it) and you can see
the image of the print appearing on the LCD screen.
Photo by TSgt. Efren Lopez courtesy of US Army.
It's pretty obvious why we have fingerprints—the tiny friction
ridges on the ends of our fingers and thumbs make it easier to grip
things. By making our fingers rougher, these ridges increase the
force of friction between our hands and the objects we hold, making it
harder to drop things. You have fingerprints even before you're born.
In fact, fingerprints are completely formed by the time you're seven
months old in the womb. Unless you have accidents with your hands, your
fingerprints remain the same throughout your life.
Photo: Your fingerprints are like unique keys you carry everywhere. In theory, no-one else has the same prints as you. The word "fingerprint" is a bit misleading: these ridges on the ends of your fingers and toes aren't there to help people
identify you, but to give you better grip on things you pick up or walk on.
What makes fingerprints such a brilliant way of telling people
apart is that they are virtually unique: fingerprints develop through an
essentially random process according to the code in your DNA (the
genetic recipe that tells your body how to develop). Because the
environment in the womb also has an effect, even the prints of
identical twins are slightly different. While it's possible that
two people could be found who had identical fingerprints, the
chances of this happening are so small as to be virtually negligible.
In a criminal case, there are usually other pieces of
forensic evidence that can
be used with fingerprints to prove a person's guilt or innocence beyond
reasonable doubt. Where fingerprints are being used to control access
to something like a computer system, the chances of a random person
having just the right fingerprint to gain entry are, generally
speaking, too small to worry about—and much less the chance of someone
guessing the right password or being able to break through a physical
lock.
Photo: Fingerprint scanners turn analog fingerprints
into a digital (numeric) form that computers can store, process, and compare. When it comes to forensic investigation, the analog methods are often still the best. Here, a forensic investigator has sprinkled orange powder
onto a glass so that the hidden fingerprints on it show up in ultraviolet light. Photo by Micaiah Anthony courtesy of US Air Force.
Sponsored links
Enrollment and verification
Suppose you're in charge of security for a large bank and you want
to put a fingerprint scanning system on the main entry turnstile where
your employees come in each morning. How exactly would it work?
There are two separate stages involved in using a system like this.
First you have to go through a process called enrollment, where
the system learns about all the people it will have to recognize each
day. During enrollment, each person's fingerprints are scanned,
analyzed, and then stored in a coded form on a secure database.
Typically it takes less than a half second to store a person's prints
and the system works for over 99 percent of typical users (the failure
rate is higher for manual workers than for office workers).
Photo: Enrollment: "Recognize" means to identify something or someone you've seen
before. So you can only recognize a fingerprint if you've already seen it at least once already.
Enrollment is the process of scanning fingerprints for the first time so they can be checked again later.
Photo by Amber Leach courtesy of US Army and Wikimedia Commons.
Once enrollment is complete, the system is ready to use—and this is
the second stage, known as verification. Anyone who wants to
gain access has to put their finger on a scanner. The scanner takes
their fingerprint, checks it against all the prints in the database
stored during enrollment, and decides whether the person is entitled to
gain access or not. Sophisticated fingerprint systems can verify and
match up to 40,000 prints per second!
How fingerprints are stored and compared
When fingerprints were first used systematically for criminal
investigation in 1900, by Sir Edward Henry of the Metropolitan Police
in London, England, they were compared slowly and laboriously by hand.
You took a fingerprint from a crime scene and another fingerprint from
your suspect and simply compared them under a magnifying glass or
microscope. Unfortunately, fingerprints taken under different
conditions can often look quite different—the one from the crime scene
is much more likely to be incomplete or smudged—and comparing them to
prove that they are identical (or different) sometimes takes great
skill. That's why forensic scientists
(people who study evidence collected from crime scenes) developed a
reliable system for matching fingerprints where they looked for between
eight and sixteen distinct features. In the UK, two fingerprints need
to match in all sixteen respects for the prints to be judged the same;
in the United States, only eight features need to match.
Photo: A computer can compare fingerprints by identifying key features, then measuring the distances and angles between them. Algorithms can turn patterns like this into unique numeric codes.
When a computer checks your
fingerprints, there obviously isn't a little person with a magnifying
glass sitting inside, comparing your fingerprints with all the hundreds
or thousands stored in the database! So how can a computer compare
prints? During enrollment or verification, each print is analyzed for
very specific features called minutiae, where the lines in your
fingerprint terminate or split in two. The computer measures the
distances and angles between these features—a bit like drawing lines
between them—and then uses an algorithm (mathematical process) to turn
this information into a unique numeric code. Comparing fingerprints is
then simply a matter of comparing their unique codes. If the codes
match, the prints match, and the person gains access.
How fingerprint scanners work
Having your fingerprints taken at a police station involves pressing
your fingers onto an ink pad and then rolling your fingers onto paper
to leave a clean impression on the page. Your prints are also stored on
a computer database so the police can check if you've committed any
known crimes or if you do so in future.
But when fingerprints are being used to control access to buildings
and computer systems, more sophisticated methods have to be used: a
computer has to scan the surface of your finger very quickly and then
turn the scanned representation into a code it can check against its
database. How does this happen?
Photo: A typical optical fingerprint scanner—it's a bit like photocopying
your hand or placing it on a computer scanner. Photo by Aaron Schoenfeld II courtesy of US Navy and DVIDS
There are two three ways of scanning fingers. An optical scanner
works by shining a bright light over your fingerprint and taking what
is effectively a digital photograph.
If you've ever photocopied your hand,
you'll know exactly how this works. Instead of producing a dirty black
photocopy, the image feeds into a computer scanner.
The scanner uses a light-sensitive microchip (either a CCD, charge-coupled device, or a CMOS image sensor)
to produce a digital image. The computer analyzes the image automatically, selecting
just the fingerprint, and then uses sophisticated pattern-matching
software to turn it into a code.
Photo: A capacitive fingerprint scanner on the back of a Samsung
Galaxy A20e smartphone.
Another type of scanner, known as a capacitive scanner,
measures your finger electrically. When your finger rests on a surface,
the ridges in your fingerprints touch the surface while the hollows
between the ridges stand slightly clear of it. In other words, there
are varying distances between each part of your finger and the surface
below. A capacitive scanner builds up a picture of your fingerprint by
measuring these distances. Scanners like this are a bit like the
touchscreens on things like iPhones and iPads.
While capacitive scanners are faster and more secure than optical ones,
they don't work well in moisture (if your fingers are wet) and they can
be damaged by static electricity.
The third type of fingerprint reader is called an ultrasonic scanner,
because it uses high-frequency sound waves (ultrasound) to "map" your finger
instead of light. If you have a new Samsung smartphone, you'll probably find it has one
of these built under the display, which you can use to unlock the phone or secure access to your apps and data. According to Samsung, ultrasonic scanners are more secure (because they scan fingerprints in three dimensions) and work better outdoors (in bright light or low temperatures) than optical scanners,
though they tend to be slower than capacitive scanners.
What happens during a scan?
Unlike ordinary digital photos, scans have to capture exactly the right amount of detail—brightness and contrast—so that the individual ridges and other details in the fingerprint can be accurately matched to scans taken previously. Remember that fingerprints might be used as evidence in criminal trials, where a conviction could result in a long jail sentence or even the death penalty.
That's why "quality control" is such an important part of the fingerprint scanning process.
Photo: Quality counts: fingerprint scans have to produce images with enough detail to allow an accurate comparison with other scanned images.
Here's how the process works with a simple optical scanner:
A row of LEDs scans bright light onto the glass (or plastic) surface on which your finger is pressing (sometimes called the platen).
The quality of the image will vary according to how you're pressing, how clean or greasy your fingers are, how clean the scanning surface is, the light level in the room, and so on.
Reflected light bounces back from your finger, through the glass, onto a CCD or CMOS image sensor.
The longer this image-capture process takes, the brighter the image formed on the image sensor.
If the image is too bright, areas of the fingerprint (including important details) may be washed out completely—like an indoor digital photo where the flash is too close or too bright. If it's too dark, the whole image will look black and details will be invisible for the opposite reason.
An algorithm tests whether the image is too light or too dark; if so, an audible beep or LED indicator alerts the operator and we go back to step 1 to try again.
If the image is roughly acceptable, another algorithm tests the level of detail, typically by counting the number of ridges and making sure there are alternate light and dark areas (as you'd expect to find in a decent fingerprint image). If the image fails this test, we go back to step 1 and try again.
Providing the image passes these two tests, the scanner signals that the image is OK to the operator (again, either by beeping or with a different LED indicator). The image is stored as an acceptable scan in
flash memory, ready to be transmitted (by USB cable, wireless, Bluetooth, or some similar method) to a "host" computer where it can be processed further. Typically, images captured this way are 512×512 pixels (the dimensions used by the FBI), and the standard image is 2.5cm (1 inch) square, 500 dots per inch, and 256 shades of gray.
The host computer can either store the image on a database (temporarily or indefinitely) or automatically compare it against one or many other fingerprints to find a match.
What can you use fingerprint scanning for?
Photo: Biometrics isn't necessarily sinister. Here, a child's fingerprints
are being taken to help with identification after a humanitarian disaster.
Photo by Porter Anderson courtesy of US Navy and Wikimedia Commons.
Fingerprint scanning is the most popular biometric technology (used
in over half of all biometric security systems)—and it's easy to see
why. We store more and more information on our computers and share it,
online, in ever more risky ways. Much of the time, our bank information
and personal details are protected by just the few hastily thought-out
numbers in our passwords. Anyone can use your credit or debit card to
get money from an ATM (automated teller machine or "cashpoint") if they
know just four numbers!
In future, it will be much more common to have to confirm your
identity with biometric information: either your fingerprint, a scan of
the iris or retina in your eye, or a scan of your face. Some
laptop computers and most smartphones now use fingerprint scanning
to make them more secure. Large banks, such as Bank of America and JPMorgan Chase, have
introduced fingerprint authentication as part of the signin process for their smartphone apps.
Soon we could be seeing fingerprint scanners on ATMs, in airport security scanners,
on checkouts in grocery stores, in electronic voting systems, and perhaps
even replacing the keys in our (self-driving) automobiles!
Some people don't like the sound of a "Big Brother" society where
you have to do everything with your fingerprints—and it's true that
there are important issues of privacy. But humans have always used
biometrics for personal identification: we tell one another apart
chiefly by recognizing one another's faces and voices. Worry about the
drawbacks, by all means, but don't forget the advantages too: your
information should be much more secure from criminals—and you'll never
again have the problem of losing your keys or forgetting your password!
Print 3D Fingerprints for Better Biometrics by Eliza Strickland. IEEE Spectrum, March 6, 2014. How do you do realistic tests of fingerprint systems? By 3D printing your own test fingers!
Fingerprints and other biometrics: This FBI page points to a variety of useful documents, including guides on how to take fingerprints, the US standard fingerprint form, and details of next-generation biometric systems, such as Advanced Fingerprint Identification Technology (AFIT).
Patents
You can find much more detailed technical descriptions of how real fingerprint systems work by browsing through patents. Here are a few representative ones I've picked out, but there are many more:
Please do NOT copy our articles onto blogs and other websites
Articles from this website are registered at the US Copyright Office. Copying or otherwise using registered works without permission, removing this or other copyright notices, and/or infringing related rights could make you liable to severe civil or criminal penalties.
