Targeted impersonation as a tool for the detection of biometric system vulnerabilities

Abstract

This paper argues that biometric verification evaluations can obscure vulnerabilities that increase the chances that an attacker could be falsely accepted. This can occur because existing evaluations implicitly assume that an imposter claiming a false identity would claim a random identity rather than consciously selecting a target to impersonate. This paper shows how an attacker can select a target with a similar biometric signature in order to increase their chances of false acceptance. It demonstrates this effect using a publicly available iris recognition algorithm. The evaluation shows that the system can be vulnerable to attackers targeting subjects who are enrolled with a smaller section of iris due to occlusion. The evaluation shows how the traditional DET curve analysis conceals this vulnerability. As a result, traditional analysis underestimates the importance of an existing score normalisation method for addressing occlusion. The paper concludes by evaluating how the targeted false acceptance rate increases with the number of available targets. Consistent with a previous investigation of targeted face verification performance, the experiment shows that the false acceptance rate can be modelled using the traditional FAR measure with an additional term that is proportional to the logarithm of the number of available targets.

Biometric‐enabled watchlists technology

“…In some particular cases, a person of interest can be introduced by synthetic facial images constructed by composite machines [35]. The phenomenon of impersonation (passive or zero-effort attack) has been experimentally detected in speech recognition by Doddington et al [36] and in other forms of biometric modalities [37][38][39]. Unfortunately, not only are passive attacks an inherent property of watchlist technology, impersonation from other sources, such as social networks, can also influence the reliability of the watchlist [40,41].…”

“…1. Sources of personal information, such as national and international databases [2] and virtual sources (media and social networks) [37,41,70].…”

Risk assessment in the face-based watchlist screening in e-borders

“…The DRC helps assess the effects of impersonation and mis-identification [5]; to combat these effects, many studies suggest the use of multiple biometrics [18]. However, in the current ABC machines, the persons of interest are mostly represented by facial traits from both the physical and digital world, and are less likely to be represented by fingerprints or irises [3].…”

Biometric-Enabled Authentication Machines: A Survey of Open-Set Real-World Applications

“…Impersonation can only be observed in an A-machine based on identification, i.e., when using databases. Multibiometrics mitigates these effects by consolidating evidence from multiple sources of information [41]- [43]. There is no impersonation effect in the verification mode of the A-machine, such as the one for e-passport holders [4], [44], [45].…”