1. ENTROPY OF FINGERPRINT SENSORS

2. Do different fingerprint sensors affect the entropy of a fingerprint? RESEARCH QUESTION/HYPOTHESIS

3. Industry has been pushing for biometrics to replace passwords More convenient, but are biometrics still as secure as a traditional password? STATEMENT OF THE PROBLEM

4. The purpose is to discover whether or not different fingerprint sensors will produce different results for entropy across the same subjects and the same finger in all trials STATEMENT OF PURPOSE/SCOPE

5. LITERATURE REVIEW

6. Biometrics refers to the identification of an individual based on singular physiological or behavioral traits A biometric factor must be measurable, permanent in nature, and unique to an individual Examples include fingerprints, face, hand geometry and iris etc. BIOMETRICS

7. Passwords are secret based authentication, meaning that the person being authenticated has to have the knowledge of the password They can be guessed by brute force attack methods PASSWORDS

8. Entropy, in the case of biometrics, refers to the randomness of the biometric sample as it is collected and converted into a template Unlike passwords, which can be changed or varied in length, each unique biometric sample has only one possible character key associated with it BIOMETRICS AND PASSWORDS

9. What makes a fingerprint unique is the pattern, made up of the various ridges, bifurcations and endings. Each line has a specific beginning and an end, or sometimes splits into two lines MINUTIAE

10. Shannon coined the term entropy in information theory Since been used in cryptography as a measure of the difficulty of guessing a password or secret key SHANNON’S THEORY

11. When relating entropy and passwords, the higher the entropy, the longer the password needs to be ENTROPY AND PASSWORDS

12. The logic of defining entropy of a user selected password is an estimate. The first character is taken to be 4 bits of entropy The entropy of the next 7 characters are 2 bits per character The 9th through the 20th character is 1.5 bits per character For characters 21 and above entropy is 1 bit per character An additional 6 bits of entropy is added for the composition rule. The composition rule requires lower-case, upper-case, and non-alphabetic characters USER SELECTED PASSWORDS 94 CHARACTERS

13. 3 bits of Entropy for the first character 2 bits of Entropy for the next three characters 1 bit of Entropy for the rest of the characters USER SELECTED PASSWORDS 10 CHARACTERS

14. RANDOMLY SELECTED PASSWORDS

15. METHODOLOGY

16. 151 Subjects 107 male 44 female Each supplied their right index finger 6 times on 8 different sensors All sensors produced consistent image sizes DATA COLLECTION

17. SENSORS

18. DatarunArea (Pixels)Type 1761300x428Thermal Swipe 1762640x480Optical Touch 1763330x357Optical Touch 1764300x300Capacitive Touch 1765320x480Optical Touch 1766248x292Optical Touch 1767186x270Capacitive Swipe 1768256x360Capacitive Touch HARDWARE USED

19. VeriFinger SDK v5 Extract minutiae data Megamatcher Used for ground truthing Visual Studio (C#) Used for Entropy calculations Filemaker 13 Used to manage the samples SOFTWARE USED

20. Created data runs to only include those subjects who successfully supplied 6 samples across all 8 sensors Extracted the data from the database and processed the images through VeriFinger SDK 5.0 to extract the minutiae information Subjects were removed from all 8 data runs if one of their samples were unable to extract minutiae DATA MANAGEMENT

21. VeriFinger SDK V.5 outputted the minutiae data including the x, y, theta, and type of minutiae point x and y are the location of the point in the image Theta is the angle of the minutiae point Theta is classified as either 1, 2, 3, or 4 depending on the angle Type is either ridge ending or bifurcation Ending = 1 Bifurcation = 2 MINUTIAE DATA

22. Angle 1: 0° - 89° Angle 2: 90° - 179° Angle 3: 180° - 269° Angle 4: 270° - 359° 14 32

23. Keyspace needs to be determined Based on two parameters Possible pixel locations, denoted by L, which is the surface area of the image (varied between data runs) Possible characteristics about a minutiae point, denoted by C, which is defined by type and angle as defined earlier ENTROPY CALCULATION

25. RESULTS

26. SAMPLES FROM EACH SENSOR The same subject across all 8 sensors

27. DatarunType Angle 1 Angle 2 Angle 3 Angle 4EndBifa1enda1bifa2enda2bifa3enda3bifa4enda4bif avg minutiaeentropy entropy per minutiae 1761 Thermal Swipe0.2350.2710.2940.2000.5230.4770.1230.1120.1420.1290.1540.1400.1050.09540.00064.5281.613 1762 Optical Touch0.2440.2880.2710.1980.6940.3060.1690.0750.2000.0880.1880.0830.1370.06039.00070.3611.804 1763 Optical Touch0.2880.2890.2670.1570.6350.3650.1830.1050.1830.1050.1690.0970.1000.05730.00052.2371.741 1764 Capacitive Touch0.3120.2990.2580.1320.6540.3460.2040.1080.1950.1030.1690.0890.0860.04624.00043.3191.805 1765 Optical Touch0.2520.2830.2750.1900.6170.3830.1560.0970.1750.1080.1700.1050.1170.07338.00063.5081.671 1766 Optical Touch0.2960.280 0.1430.5900.4100.1750.1210.1650.1150.1650.1150.0850.05927.00045.5911.689 1767 Capacitive Swipe0.2770.3180.2550.1500.5960.4040.1650.1120.1900.1280.1520.1030.0890.06025.00042.8021.712 1768 Capacitive Touch0.2590.2780.2810.1810.6090.3910.1580.1010.1690.1090.1710.110 0.07135.00057.9951.657 ENTROPY CALCULATIONS TABLE

28. The highest minutiae count was produced by a thermal swipe sensor Optical touch sensors seem to provide a higher average minutiae count than capacitive touch sensors A capacitive sensor provided the highest entropy per minutiae but least average minutiae. SENSOR RESULTS

29. MINUTIAE VS. CHARACTER LENGTH

30. Probability of Minutiae Location

39. ENTROPY AND PASSWORD LENGTH User ChosenRandomly Chosen 94 Char. Alphabet10 Char. Alphabet 94 Char. Datarun Avg. Minutiae EntropyNo Checks Dict. & Composition Rule 17614064.5494360 19.49.8 17623970.4554865 21.210.7 17633052.2363047 15.78.0 17642443.3272138 13.06.6 17653863.5484259 19.19.7 17662745.6302441 13.77.0 17672542.8272138 12.96.5 17683558.0423653 17.58.8

40. The first three columns are entropy calculations based on the data runs The next columns output a password length equal to the entropy of the data run There are also other conditions under which the password has constraints, such as being out of 94 possible characters or 10 EXPLANATION

41. CONCLUSIONS

42. When analyzing the data there seemed to be some scanners that had a very low quality image but high minutiae This could have to do with the scanner type specifically or rather a function image quality, or image size CONCLUSIONS

43. REFERENCES