Biometric recognition and authentication systems

How it works

Speaker recognition is based on the sound of the voice. Speaker recognition has two forms:

• Text dependent - with the subject uttering a specific password or pass phrase.
• Text independent - with the subject speaking in an unconstrained manner.

Like all biometric methods, speaker recognition combines both physical and behavioural components. It makes use of the acoustic characteristics of an individual's speech, influenced by biological features such as the shape of the vocal tract and the larynx. In addition to these physical traits, each speaker has developed additional characteristics, including accent, rhythm, intonation, choice of vocabulary, and so on.

Speaker recognition systems sample these characteristics and build a distinctive model for each 'known' speaker. Speakers are recognised based on the differences between their speech patterns and a “universal background model” of general speakers of the same language.

Speaker recognition should not be confused with the related non-biometric technology of speech recognition which is used to recognise words for dictation or automate instructions given over the telephone.

Attacks

Speaker recognition systems are vulnerable to the a number of attacks. Some of the most common are:

Replay attacks
This is a simple attack which involves recording a target and replaying it when prompted. The recording may be altered to be sufficiently different from the original in order to fool any replay protection. 

Speech Synthesis attack

This attack method would construct a computer model for producing the target's voice allowing any written text to be converted replayed in the target's voice. State of the art text to speech synthesisers represent a genuine threat to speaker recognition techniques.

Voice imitation
Imitating or mimicking a target's voice is an unsophisticated attack. The shortcoming of the attack is that mimicry only successfully replicates the learned features of voice - pronunciation, accent, timing and so on. The physical features that most speaker recognition focuses on are not taken into account, so this attack is unlikely to work, unless the voices are generally similar, as may be the case with siblings.

Voice conversion (aka voice transformation or voice morphing) 

Voice conversion is essentially the process of converting an attacker's voice to sound like a target's. To accomplish this, a mathematical model is created of both the attacker's and the target's voice. Features can then be extracted from the target and overlaid on the attacker's sample to produce realistic sounding speech.

Implementation notes

One benefit of speaker recognition is that it doesn't require any bespoke hardware, just a telephone, whether landline or mobile. However, switching between handsets can cause a degradation in performance of the speaker recognition system. 

Protections

To improve the security of a text-dependent system, the following steps may be considered:

• Randomise the passphrase
  A more secure, but less usable, implementation of the spoken passphrase approach is to prompt the user to say a number sequence that is generated for each interaction e.g. 47-95-83, where the numbers 1-9, 20,30,40...90 are spoken during enrolment. This effectively mitigates the replay attack as an attacker would have to generate passphrases on the fly. 
  
  
• Use in conjunction with a text-independent system
  When enrolling, the user would be prompted to speak for long enough to generate a text independent speaker model as well as a text dependent speaker model. While the user is talking, after they have logged in, the system continues to model their voice to compare it to the claimed enrolled user.

A speaker recognition system may log information about previous calls in order to provide protection against replay attacks.

Summary

Speaker recognition offers an authentication system that doesn't require any bespoke hardware and its use is familiar.

Like any biometric, there is scope for spoofing. But, depending on the implementation of the speaker recognition, it can be robust against such attacks and can offer an acceptable level of discrimination for verification use.