Biometrics - Finger printing

ballooba

I am planning a final year project for next year and want to incorporate biometrics in the form of fingerprinting.

Just wondering if anyone has any experience of this?

The fingerprint system would be used to validate the identity of members of a community of up to 20,000.

Could these be stored in a database? How much do readers cost?

Any help is greatly appreciated.

Thanks,

Steve.

minority

I think they are really cheap.
You can get them for a PC with usb.
You even get laptops with them now

Third_Echelon

yeah you can pick them up pretty cheaply now...

some companies are using them to logon to pc's now rather than usernames and passwords...

ballooba

They seem pretty cheap for single users, the prices im googling for 1,000 users is £1,500 sterling which is outside my budget.

I'm no security expert so I'll have to suss it out well before november start date.

dahamsta

Cola bottles rock!

adam

theciscokid

This may be of assistance..

http://www.biometricgroup.com/reports/public/reports_finger-scan.html

ballooba

Originally posted by dahamsta
Cola bottles rock!

adam

I know your wary of this kind of stuff as am I.

The system is only for validation of members of a club and would be combined with a photo system, so it doesn't need to be that secure.

I'm undecided on the ethics surrounding biometrics but i still want to learn about them.

Good article btw. Only had a quick scan through it as im in work but i must have a good read later. Thanks.

Hecate

This paper seems to be quite commonly referenced when it comes to fingerprint recognition, although its a bit of a read at 81 pages

http://www.redbrick.dcu.ie/~rob/MSSF/biometrics/coetzee92fingerprint.pdf

Specky

Well there's loads of theoretical hotch potch surrounding this subject but at the end of the day the technology is there and working and relatively inexpensive.

We sell the readers, the associated controllers and everything else you need to make an access control system.

So if you're interested PM me.

ecksor

I find your comments that "It's there and working" a bit rich on a security discussion forum when you're trying to sell the damn things. I'm sure (hope) you're aware that the technology has had some spectacular failings. Do a google for "matsumoto fingerprint" for a selection of articles on the matter.

Specky

Ecksor. I am more than adequately familiar with the results of these and many other studies, as I am familiar with studies that highlight the failings of pretty much every other identification technology available.

However, as with all identification technologies, there are still plenty of appropriate applications where any failings that have been identified with fingerprint ID are not really relevant.

In this specific application I believe we're talking about a club membership situation. In any security application the level of sophistication of those attempting to subvert the security system will be appropriate to the value of the benefits they can achieve by doing so.

If, as is widely publicised lately, you want to steal ATM cards and PIN numbers you have the potential of earning a considerable amount of money and hence it is worth investing heavily in the theft.

If, on the other hand, you want to get a free go on the weights machine I would think there would be easier ways of achieving your end than the lengths to which matsumoto went.

If you were to ask me would I depoly fingerprint ID in a high security application I would have to say no, not on it's own, but in high security applications you should not be relying on the access control system alone to keep the wrong people out....but that's a completely different subject.

Fingerprint readers are widely available and widely used. Sorry if that offends your delicate sensitivities but it's true.

By the way I am not "trying to sell" these. They happen to be a small part of we do and since I do have experience with them I could probably help this individual with what he's trying to do. Despite the many many opportunities that have appeared to reveal themselves through forums such as this down the years I have never sold anything to anyone as a result. People on forums have big ideas and empty pockets.

ecksor

Fingerprint readers are widely available and widely used. Sorry if that offends your delicate sensitivities but it's true.

I realise this and it isn't at all offensive to me. Feel free to discuss them and the risk analysis that goes with them. However, dismissing "theoretical hotch potch" and claiming "there and working" on a security discussion forum struck me as dismissive or misleading and is quite annoying when you also appear to be trying to sell them in the same post.

ballooba

Originally posted by Hecate
This paper seems to be quite commonly referenced when it comes to fingerprint recognition, although its a bit of a read at 81 pages

http://www.redbrick.dcu.ie/~rob/MSSF/biometrics/coetzee92fingerprint.pdf

That paper is very interesting but its gonna take me a while to get through.

I have made a fair bit of progress on this over the last two days but the thing that is holding me back is the price of the SDK for the hardware (several grand) I'm looking at.

Having investigated it further I really want to give it a go and my lecturer said it was an interesting project, which is always good.

trixter

Some security concerns when implementing biometric scanners, specifically fingerprint scanners.

The reader should be in a secure location. If I have access to your reader (either by way of a software or hardware tap) I can replay your print. Some readers have crypto algorithms in the reader and use shared secrets along with a nonce (one time disposable number used in hashes to prevent replay attacks) to encrypt the data that goes from the reader to the computer.

Fingerprints can easily be forged. From a database record (like the government has on many people, some governments take prints of all immigrants, people accused of crimes, military workers, and anyone with a security clearance) you can make a copy of someones prints (or you can lift them from the targets car or other place they are likely to touch). The process of duplicating prints is trivial, invert the inked print so that you have black where the valleys are in the minutia. Then etch on a circuit board that design. There are kits that use the output of a laser printer/copier to do the etching for you. Then apply a VERY thin coat of liquid latex (available at finer makeup stores, especially theatrical). You may awnt to apply 2-3 VERY thin layers instead of 1 thicker one. Then, using tweezers (after its dry) carefully peel off the latex, using spirit gum (glue used to hold on fake beards in theater) glue onto your finger. Many print scanners can be fooled into thinking that a 'live human' is giving the print, VERY few will know that anything is wrong. This method was used to defeat the print scanners at point of sale terminals in Germany.

Given these conciderations, you may then assess how secure you have really made things. Security, or the illusion of security?

In general there are 3 ways to authenticate someone.
Something you konw (passwords)
Something you are (biometrics)
Something you have (smart card or simmilar)

The more different categories you add the more secure you are, however, you want t obe sure that by adding one, or indeed replacing one all together, you dont open new security problems.

ballooba

Originally posted by Specky
Despite the many many opportunities that have appeared to reveal themselves through forums such as this down the years I have never sold anything to anyone as a result. People on forums have big ideas and empty pockets.

That appears to be the opinion of most of the companies I contacted.

I made loads of progress the first few days and then nothing at all since.

Like talking to a wall.

I think they reckon the SDK is outside my budget. Like in another solar system.

trixter

Originally posted by ballooba
I think they reckon the SDK is outside my budget. Like in another solar system.

I wish hardware vendors would realize that they sell hardware and not software. Far too often the SDK outprices the hardware

ballooba

Outprices???

That word does not come anywhere close to describing it.

The kit is €100 per unit. The SDK is several thou, like the 5 figures i think.

Its like some big secret how much though.

Superman

if your really into your biometrics i know there is a conference on the issue this summer in ireland. my mate is workin their and i can get you some info f you like.

ballooba

Originally posted by Superman
if your really into your biometrics i know there is a conference on the issue this summer in ireland. my mate is workin their and i can get you some info f you like.

Legendary, Thanks a mil.

I love the chance to put on a name tag, I think I'll register as Hugh Jarce this time.

Might as well post the deets up in case anyone else is interested too?