Simple Web Security

I recently attended a conference on information security where the President of our company was giving a presentation on biometric security. Since our version of biometrics uses fingerprints a number of fingerprint related questions came up. One of them surprised me so I thought I’d do a short blog post on the subject. Folks were concerned that we “stored their fingerprints” and might be able to use them for some nefarious purpose. That’s a reasonable concern particularly because we say that we store fingerprints but in fact, we don’t actually store an image of the fingerprint. It would be big, hard to use and very slow to access.

All the fingerprint verification security systems I know of actually use a “template” as opposed to using an actual image of the fingerprint. So what’s a template? Your fingerprint is made up of the fine “friction ridges” on your fingertips. You have similar ridges on your palms and even on the soles of your feet. Scientists believe that they are there to aid in grasping objects and possibly to amplify the vibrations that allow you to discern fine textures on a surface. Whatever their reason, they appear to be unique to each individual; even identical twins don’t share fingerprints. The details of the shape of the ridges, the places where they start and end and the way that they split and join are called “minutiae”. Most of these features are found near the center of your fingerprint. When a fingerprint is scanned a gray-scale image is captured and a sophisticated computer program identifies the key minutiae and how they relate to one another and produces a mathematical representation of your fingerprint called a template. The template is easy for the computer to deal with where an actual image would be very clumsy. You could think of your template as a complex and long digital password.

For the folks at the conference who were concerned about a security system saving their fingerprints, well, they can relax. The thing that’s saved isn’t an image of the fingerprint and just as importantly, the template cannot be used to backward engineer an image of your fingerprint. The template is a brand new entity that was created using data from your fingerprint but just like a picture of a leaf isn’t a leaf; a template isn’t your fingerprint.

A nice article on the history of fingerprints can be found at http://www.onin.com/fp/fphistory.html

Tags: biometrics

This entry was posted on Saturday, March 7th, 2009 at 11:32 pm and is filed under protocol. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.