Biometric recognition and authentication systems

How it Works

The subcutaneous blood vessels of the human body form a distinctive pattern for each person. Vein patterns can be captured by illuminating a body region with infrared light, and photographing the reflected light. 

In some systems, photographs are taken of the infrared light transmitted through the body tissue being imaged. Blood vessels absorb infra-red light more than the surrounding tissue, and appear darker in the acquired image.

Products are designed to work with body parts that can easily be presented to the sensor: palms, fingers, wrists and the back of the hand.

Attacks

An unsophisticated attacker is likely to present their own vein biometric data (typically palm or finger) to the sensor in the hope that they match with an enrolled biometric reference stored in the database. The chance of success is then determined by the false match rate of the system which is generally low enough for success to be highly unlikely. 

Spoofing

Due to the internal nature of the vein pattern, specialised hardware and the cooperation of the target is necessary to acquire a vein pattern image. It is necessary to reproduce this vein pattern with suitable materials to mimic what is seen under infrared light. If the system includes some form of “liveness” detection, the material used would have to match the intrinsic properties of human flesh well enough to fool these countermeasures.

Implementation notes

Due to a relatively low uptake and limited third party testing, the knowledge base on this technology is limited.

Protections

Although there is no explicit presentation attack detection, the difficulty in imaging vein patterns provides some protection against spoofing attacks.

Summary

Vein biometrics forms a family of similar modalities - finger, palm and wrist vein technologies are different to each other making generalised statements about their performance difficult. The internal nature of vein patterns makes passive observation difficult, presenting some challenges for attackers. Levels of performance for palm and finger vein biometrics has been measured as good in limited testing.