Li S.Z., Jain A.K. (eds.) Encyclopedia of Biometrics
Подождите немного. Документ загружается.
Enrol: Performs an enrolment to create a template
and stores the template in module . To execute this
function, either Capture for Enrol or Acquire for
Enrol functions has to be called in advance. Enrol
with process w ith the samples temporally stored
in the module. The return value is the number of
template internally assigned.
Erase Enrolments: Erases all enrolment templates
or the indicated (by number) template.
Finally, the fourth group is dedicated to all those
commands that are dealing with biometric functions.
It covers the capture process, feature extraction, and
comparison. Even with comparison, it handles com-
parisons with internal templates, or templates coming
from the external world.
Capture: Performs a biometric capture (using
on-board sensor), returning biometric sample.
Process: Processes biometric sample to create com-
parable recognition data (feature vector). Depend-
ing on module capabi lities, the input sample can
be a raw sample or a preprocessed one.
Capture and Process: Performs a biometric capture
(using on-board sensor), returning its feature vector.
Compare External: Comp ares a feature vector with
the template sent by the external world.
Process and Compare External: Processes a biomet-
ric sample and compares it with the template sent
by the external world.
Capture and Compare External: Perform a biomet-
ric capture (using on-board sensor), process the
biometric sample, and compares it with the tem-
plate sent by the external world.
Compare Internal: Compares a feature vector with
templates stored in the module. If the input
parameter is 0xFF, comparison will be done with
all templates stored. In other case, comparison is
done only with the template whose internal num-
ber is given at the input parameter.
Process and Compare Internal: Processes a biomet-
ric sample and compares it with templates stored in
the module. If the input parameter is 0xFF, com-
parison will be done with all templates stored. In
other case, comparison is done only with the tem-
plate whose internal number is given at the input
parameter.
Capture and Compare Internal: Perform a biomet-
ric capture (using on-board sensor), process the
biometric sample, and compares it with templates
stored in the module. If the input parameter is
0xFF, comparison will be done with all templates
stored. In other case, comparison is done only with
the template whose internal number is given at the
input parameter.
Some of these instructions involve user interaction.
Therefore, manufacturer shall consider time-out
values to cancel operat ion if it is exceeded, reporting
that situation within the protocol used.
Applicability of Tamper-Proof O.S.
As mentioned above, this kind of Operati ng System
is desirable to be included in all devices related to
Biometric Identification, but unfortunately this is not
always possible. As in many applications a general
purpose computer is used, gen eral purpose Operating
Systems are used (such as Windows, Linux, etc.).
Developing those O.S. in a Tamper-proof way, without
restricting usability and generality is nearly impossible.
Therefore, Tamper-proof Operating Systems are meant
for those embedded systems, sensors and personal
tokens, dealing with personal identification.
Using this kind of Tamper-proof O.S. in these
devices, restrict the number of security holes to the
minimum within the device, and to be concentrated
only in those general purpose systems used. As some
tasks will be performed in such secured devices, secu-
rity leaks will be avoided. For example, if a biometric
system uses personal tamper-proof tokens with match-
on-card capabi lity, the user’s template will never be
exposed, and possibility of hill-climbing or replay
attacks will be cancelled. Thus, all comparison and
decision blocks will be secured, restricting the potential
security problems to the relevant previous modules.
Summary
Due to the sensibility of biometric data, security in
biometric devices has to be considered. One of the
ways to protect privacy is to include a Tamper-proof
operating system. This O.S. would not allow direct
access to hardware resources of the device, neither
to temporary nor permanent data. This O.S. has also
to control the different life stages of the device. A set of
requirements have been defined that have to be con-
sidered when developing such Tamper-proof O.S.
1320
T
Tamper-proof Operating System
Finally an example of the commands to be covered
by some dev ices have been given. Including this kind
of O.S. in all biometric devices w ill improve the secu-
rity of the whole system . Unfortunately, when some
parts of the biometric system has to be implemented in
a general purpose computer with an open Operating
System, applying these rules is not easy.
Related Entries
▶ Biometric Security Threat
▶ Biometric Token
▶ Biometric Vulnerabilities
▶ Match-off-Card
▶ Match-on-Card
▶ Template Security
References
1. Rejman-Greene: Security considerations in the use of biometric
devices. Information Security Technical Report 3, 77–80 (1998)
2. Ratha, N.K., Connell, J.H.B.R.M.: Enhancing security and pri-
vacy in biometrics-based authentication systems. IBM Systems
Journal 40(3), 614–634 (2001)
3. Roberts, C.: Biometric attack vectors and defences. Computers &
Security 26(1), 14–25 (2007)
4. Criteria, C.: Biometric evaluation methodology supplement
(bem). Common Methodology for Information Technology
Security Evaluation - http://www.cesg.gov.uk/site/ast/biometrics/
media/BEM_10.pdf (2002)
5. Matthews, A.: Side-channel attacks on smartcards. Network
Security 2006(12), 18–20 (2006)
6. Sanchez-Reillo, R.: Achieving Security in Integrated Circuit Card
Applications: Reality or Desire? IEEE Aerospace and Electronic
Systems Magazine 17, 4–8 (2002)
7. Sanchez-Reillo, R., Gonzalez-Marcos, A.: Access control system
with hand geometry verification and smart cards. Aerospace and
Electronic Systems Magazine, IEEE 15(2), 45–48. (2000). DOI
10.1109/62.825671
8. Sanchez-Reillo, R.: Smart card information and operations using
biometrics. Aerospace and Electronic Systems Magazine, IEEE
16(4), 3–6 (2001). DOI 10.1109/62.918014
9. ISO∕IEC_JTC1∕SC17: ISO/IEC 7816 Parts 3, 4, 8, 9 & 11
(1987–2005)
Target Detection
▶ Human Detection and Tracking
Target Population
▶ Test Sample and Size
Target-Dependent Fusion
▶ Fusion, User-Specific
Technology Tests
Technology tests are those in which biometric
algorithms enroll and compare archived (i.e., previ-
ously-collected) data. An essential characteristic of
technolog y testing is that the test subject is not ‘‘in
the loop’’ – the test subject provides data in advance,
and biometric algorithms are implemented to process
large quantities of test data. Technology tests often
involve cross-comparison of hundreds of thousands
of biometric samples over the course of days or
weeks. Methods of executing and handling the outputs
of such cross-comparisons are a major component
of technology-based performance testing standards.
Technology tests are suitable for evaluation of both
verification- and identification-based systems, al-
though most technology tests are verification-based.
▶ Performance Testing Methodology Standardization
Template
The features extracted from an individual’s biometric
trait during enrollment is stored in the biometric
database and is referred to as a template. During au-
thentication, the system compares an individual’s bio-
metric features against this template. The template
Template
T
1321
T
may be updated over time in order to reflect changes in
an individual’s trait (if any).
▶ Biometrics, Overv iew
▶ On-Card Matching
Template Distortion
Template distor tion consists of applying either invert-
ible or non invertible distortions to a biometric tem-
plate. The distortion can be performed using either an
invertible or a non invertible transform. In both cases
the transform is chosen on the basis of a user key,
which mu st be known when authentication is per-
formed. In the case when an invertible transform is
chosen, the whole security of the system relies on the
key. On the contrary when non invertible transform s
are used, even if the key is known by an adversary, no
significant information about the template can be ac-
quired. Then, the distorted data are stored in the
database. Different distorted data can be generated
from the same original data, simply by changing the
transform key. Moreover, even if the database is com-
promised, the biometric data cannot be retrieved un-
less user dependent keys are revealed, when dealing
with invertible transforms.
▶ Conformance Testing for Biometric Data Inter-
change Formats, Standardization of
▶ Iris Template Protection
Template Protection
It is a method to keep away from biometric template
attack, storing transformed template data rather than
raw template data in a biometric system.
▶ Iris Templat e Protection
▶ User Interface, System Design
Template Reconstruction
▶ Template Security
Template Security
ANDY ADLER
1
,RAFFAELE CAPPELLI
2
1
Carleton University, Ottawa, ON, Canada
2
Biometric System Laboratory - DEIS - University of
Bologna, Italy
Synonyms
Image regeneration from templates; Template
reconstruction
Definition
Template security refers to techniques which allow
regeneration of enrolled images from templates. Such
image regeneration poses a security and privacy vul-
nerability because the images may be used to spoof or
masquerade as the enrolled individual. Image regener-
ation is of two types. The first relies on decoding the
features in the template and estimating a biometrically
reasonable image with the appropriate features. Results
have been published for fingerprint templates, but
such algorithms are easily implemented for face and
iris recognition. The second type of image regeneration
uses the abilit y to compare images against the target
and obtain the match score to perform hill-climbing to
iteratively improve an image estimate. Appropriate
biometric template security measures requires strong
encryption of all biometric data, including templates
and match results.
Introduction
It is generally understood that source biometric
images – those captured at the sensor for enrollment
and matching – need to be handled carefully; compro-
mise of these images can impact user privacy and
provide a pathway for security breaches (see
▶ Biomet-
ric Vulnerabilities, Overview). On the other hand,
other types of biometric data are not necessarily man-
aged with the same care as the biometrics images, and
recent work has shown that it is often possible to
regenerate the source images, or learn other important
information, from these data. Image regeneration may
be performed from two data sources, biometric
1322
T
Template Distortion
templates and match (or similarity) score results. This
topic has come to be known as ‘‘biometric template
security,’’ or ‘‘template reconstruction,’’ even when it
applies to security issues around the match scores.
Perhaps the best overview of the issues in biometric
template security is given by Jain et al. [1, 2].
Biometric templates carry the most important bio-
metric information – the features considered most
discriminating for the identity of the subject. and
thus present an important concern for privacy and
security of systems. The basic concern is that templates
may be used to spoof the owner of the document.
Biometric algorithm vendors have largely claimed
that it is impossible or infeas ible to regenerate the
image from the templates [3]; thus biometric tem-
plates are sometimes considered to be effectively non-
identifiable data, much like a password hash. These
claims are supported by: (1) the template records fea-
tures (such as fingerprint minutiae) and not image
primitives, (2) templates are typically calculated using
only a small portion of the image, (3) templates are
small – a few hundred bytes – much smaller than the
sample image, and (4) the proprietary nature of the
storage format makes templates infeasible to ‘‘hack.’’
Two pathways are considered from which to regenerate
images from templates: (1) from the template directly,
based on a knowledge of the features, and (2) from
match score values from a biometric algorithm.
Image Regeneration from Templates
The goal of image regeneration from a biometric tem-
plate is to compute an image which best matches the
feature values encoded in the template, while mainta-
ing a ‘‘reasonable’’ appearance. The constraints on the
image appearance depends on whether the regenerated
images are designed to be shown to humans (experts
or casual observers) or only to be used to fool a
biometric algorithm. In order to regenerate images in
this way, it is necessary for templates to be available in
unencrypted form. Thus, encryption of template data
storage does impede this vulnerability; however, since
templates must be available in unencrypted form to
perform matching, they are vulnerable at that point.
Published work on image regeneration from tem-
plates is for fingerprints, for the reason that regenera-
tion is trivial for most iris and face recognition
templates, in which the template features are typically
based on subspace image transforms. A biometric tem-
plate based on such transforms may be used to regen-
erate the image as follows: assume the template feature
vector, y, is computed from an image, x using a trans-
form that can be approximated by a linear equation
y ¼ Hx for a linear subspace transform expressed as a
matrix, H, then a reconstructed image,
^
x, can be
computed from
^
x ¼ H
y
y using a pseudoinverse H
{
.
Construction of H
{
would use the well understood
techniques of inverse problem theory (e.g., [4]).
Images reconstructed in this way would typically suffer
some blurriness, due to the inherent ill-conditioning of
such inverse problems.
Because fingerprint template features cannot be
expressed as linear functions of the image data, recon-
struction of fingerprint images from templates is a
nonlinear, and considerably more difficult problem.
The earliest template reconstruction technique for fin-
gerprints was proposed by Hill [5], who developed an
ad-hoc approach to calculate an image from the tem-
plate of an unspecified fingerprint system vendor. Soft-
ware was designed to create line pattern images which
had a sufficient resemblance to the underlying ridge
pattern to be verified by the match software. This work
also devised a simple scheme to predict the shape
(class) of the fingerprint using the minu tiae template.
The algorithm iterated over each orientation, core and
delta position keeping the image with the best match
score. It is worth noting the reconstructed line patterns
do not visually resemble a fingerprint, although
these images could be easily improved manually or
automatically.
More recently, Ross et al. [6, 7] have demonstrated
a tech nique to reconstruct fingerprint image s from a
minutiae description, without using match score
values. First, the orientation map and the class are
inferred based on analysis of local minutiae triplets
and a nearest neighbor classifier, trained with feature
exemplars. Then, Gabor-like filters were used to recon-
struct fingerprints using the orientation information.
Correct classification of fingerprint class was obtained
in 82% of cases, and regenerated images resembled
the overall structure of the original, although the
images were visually clearly synthetic and had gaps
in regions which lacked minutiae. Another valuable
contribution of this work is calculation of the proba-
bility density fields of minutiae; such information
could be used to attack fingerprint based biometric
encryption schemes.
Template Security
T
1323
T
In 2007, Capp elli et al. [8, 9 ] demonstrated a
technique which allows synthesis of highly realistic
fingerprint images from minutiae data in templates.
The reconstruction approach is based on a sequence
of steps to estimate various aspects of the original
unknown fingerprint from the template (Fig. 1):
the fingerprint area, the orientation field, and the
ridge-line pattern. First, a simple elliptical model is
adopted and its parameters estimated by calculating
the minimal area that encloses all the minutiae. Next,
starting from each minutia direction, the orientation
field is estimated by optimizing the parameters of the
model proposed in [10]. Finally, the ridge-line pattern
is generated , starting from the estimated orientation
field estimated and from generic minutiae prototypes
positioned according to the template information. The
reconstructed images are very similar to the original
fingerprints. Although the reconstructed images may
not fool a human expert, they may be used to success-
fully attack automatic recognition systems; the per-
centage of successful attacks against nine different
systems was 81% at a high security level, and 90% at
a medium security level.
Image Regeneration from Match
Scores
The other approach to regeneration of biometric
images is based on match score values and does not
require access to the template. This means that tem-
plate encryption is not a countermeasure, bu t also
means that a large number of matc h score comparisons
are needed. For this to be feasable, the requirements are
Template Security. Figure 1 A functional schema of the reconstruction from fingerprint templates using the approach
of Cappelli et al. [9]. The minutiae information in the template is used to: estimate the orientation field, generate a
reasonable fingerprint area and place synthetic minutia prototypes on an blank image. Then, given a constant frequency,
a ridge-line pattern is generated according to the orientation field, starting from the prototypes. Finally noise is added to
make the reconstructed image more realistic.
1324
T
Template Security
the ability to present arbitrary images for matching
against a target, and access to calculated match scores.
The goal is to: (1) determine an image which matches
against the target for the specific biometric algorithm,
and (2) determine a good estimate of the original
image. Clearly, if one can test arbitrary images, one
could mount a brute force attack. Given a biometric
database of sufficient quality and variety, it should be
possible to attain the first goal in approximately 1 ∕ FAR
attempts. A brute-force attack would be guaranteed to
succeed in the second goal, but the size of image space
is extremely large.
Brute force searches would only be necessary if
biometric image space were random, and nothing
could be learned from the output of previous tests.
Soutar et al. [11] first proposed the possibility of
‘‘hill-climbing’’ in order to practically regenerate
images from match score data (Fig. 2). A hill-climbing
algorithm functions as follows:
1. Initial image selecion: Choose an initial image esti-
mate (IM). Typi cally, a sample of initial biometric
patterns are tested and the one with the largest
match score, MS, is selected.
Template Security. Figure 2 Regenerated images using hill-climbing techniques. (a–b): Regenerated
fingerprint minutiae (from [13]). The target fingerprint with labeled minutiae (a), and regenerated minutiae positions (b ).
(c–e): Regenerated face images (from [12]). The target face image (c); the initial selected image for hill-climbing (d), and
regenerated face image (e).
Template Security
T
1325
T
2. Iterative estimate improvement:
a. Modify IM (to get IM
test
) in a random, but
biometrically reasonable way (details below).
b. Calculate MS
test
for IM
test
.
c. If MS
test
> MS, set IM ¼ IM
test
and MS ¼ MS
test
.
d. End iterations if MS is no longer increasing.
The only difficulty to a practical implementation of
this algorithm is to implement ‘‘biometrically reason-
able’’ modifications. For face images, Adler [12] added
a small factor times a PCA (eigenface) comp onent to
the face image. For fingerprint minutiae, Uludag and
Jain [13] made modifications to perturb , add, replace, or
delete an existing minutiae point at each step. The k ey
constraint is that such modifications attempt to main-
tain ‘‘ biometric feasibility’ ’ in the search space. Other
image modifications, such as changing random pixels
in the image, do not conv erge under hill-climbing.
In fact, ‘‘hill-climbing’’ algorithms are simply one
type of multidimensional optimization algorithm.
Other methods for unconstrained minimization (or
maximization) such as the Nelder–Mead simplex ap-
pear to perform equally or better than hill-climbing
(unpublished observations).
In order to protect against regeneration of biomet-
ric images, Soutar et al. [11] suggested that match
score output be quantized to a limited set of levels.
The idea is that small image modifications are unlikely
to push the MS up by one quantum, so that the hill-
climbing algorithm will not see the effect of its changes.
This recommendation is maintained in the BioAPI
specification [14]. However, by an appropriate modi-
fication of the algorithm, Adler showed that hill-
climbing could still function [15]. Each hill-climbing
iteration is applied to a quadrant of IM. Before each
calculation, noise is added to the image in the opposite
quadrant, in order to force the match score to a value
just below the quantization threshold. This means that
the quantized match score is brought into a range
where it provides useful information. Images were
successfully regenerated for quantization levels equal
to a 10% change in FAR.
These results suggest that biometric images can gen-
erally be regenerated if: (1) arbitrary images can be
input into the biometric system, and (2) raw or quan-
tized match score values are output. The images calcu-
lated are of sufficient quality to masquerade to the
algorithm as the target, and give a good visual impres-
sion of the biometric characteristics. In order to prevent
this attack, it is necessary to either limit image input, or
to provide only Match/Nonmatch decisions.
Consequences of Template Security
Breaches
There has been some criticism of the research on
biometric template security which accuses the author s
of fearmongering (need ref). Specifically, it is claimed
that there are no (or very few) practical scenarios in
which image regeneration from templates is a serious
security consideration. While this criticism has some
merit, there do exist several security breaches which are
facilitated by these techniques, such as the following
examples:
Fraudulent use of passports. Passports conforming
to the most recent ICAO specification (and re-
quired for visa–waiver entry into USA) encode
the fingerprint or iris templates of the holder in
an embedded smart card. Similarly, t he new ILO
standard for the seafarers ID card [16] encodes the
fingerprint minutiae into a 2D barcode on the
document in a standardized format. In general, it
may be assumed that even when these data are
encrypted, it will be possible to decode, either
through errors in the issuance process (e.g., [17])
or by using the public keys of the issuance agencies.
After decoding the document data, the template
may be read, and an image reconstructed which is
sufficiently similar to match. It would then be
possible to fabricate a spoofed biometric to allow
a criminal or terrorist to fraud ulently use the doc-
ument and bypass the biometric secu rity.
Biometrically locked digital media. Biometrics have
been proposed as a way to control access to digital
media, with the primary interest being in prevent-
ing copyright infringement. Digital documents
encoded with the biometric of the user(s) with
approved access will presumably be subject to
attacks, especially since both the documents and
the software to access them will be widely
distributed. The techniques described in this article
would facilitate attacking the digital locks and im-
pact the privacy of the content owner.
Regenerating watchlist images from match scores.In
many cases, governments may allow collaborating
agencies to perform searches against a biometric
watch list; however, for security reasons, the
1326
T
Template Security
primary agency may not want to distribute watch
list images. Using the techniques described here, it
may effectively be possi ble to generate these watch-
list images from the match score data, thus bypass-
ing the security.
Summary
This article summarizes the current research in tem-
plate security. This work shows that, in all cases
tested, a high quality image of an enrolled fingerprint
or face can be regenerated if access is given to bio-
metric templates or to match scores. This is strong
evidence to refute the somewhat naı
¨
ve assumption
commonly made that biometric templates are secure
in a similar way to a cry ptographic hash function.
Based on these results, a prudent design for biometric
security should consider any biometric data to poten-
tially ‘‘leak’’ information about the source images,
and provide a potential attack pathway. One partial
solution is the use of cryptographic techniques to
protect biometric data in databases and communicated
over networks.
Related Entries
▶ Biometric Encryption
▶ Biometric System Design
▶ Biometric Vulnerabilities
▶ Security and Liveness, Overview
References
1. Jain, A.K., Nagar, A., Nandakumar, K.: Biometric
templatesecurity.EURASIP.J.Adv.SignalProc.(2008).
doi:http://hindawi.com/RecentlyAcceptedArticlePDF.aspx?
journal=ASP&number=579416
2. Jain, A.K., Ross, A., Uludag, U.: Biometric template security:
Challenges and solutions. In: Proceedings of 13th European
Signal Processing Conference (EUSIPCO2005), Antalya, Turkey,
2005
3. International Biometric Group.: Generating images from
templates. (2002) www.biometricgroup.com/reports /public/
reports/templates images.html
4. Tarantola, A.: Inverse problem theory and methods for model
parameter estimation. Society for Industrial and Applied Math-
ematics (2005). ISBN 0-89871-572-5
5. Hill, C.: Risk of Masquerade arising from the storage
of biometrics. Dissertation, Austrailian National University
(2001)
6. Ross, A., Shah, J., Jain, A.K.: Towards reconstructing fingerprints
from minutiae points. In: Conference of SPIE Biometric Tech-
nology for Human Identification, II, 5779, 68–80 (2005)
7. Ross, A., Shah, J., Jain, A.K.: From template to image: recon-
structing fingerprints from minutiae points. IEEE Trans. Pattern
Anal. Machine Intel. 29, 544–560 (2007)
8. Cappelli, R., Lumini, A., Maio, D., Maltoni, D.: Evaluating
minutiae template vulnerability to masquerade attack. In: Pro-
ceedings of 5th IEEE Workshop Auto Ident. Adv Technol.
Alghero, Italy, 7–8 June 2007
9. Cappelli, R., Lumini, A., Maio, D., Maltoni, D.: Fingerprint
image reconstruction from standard templates. IEEE Trans. Pat-
tern Match. Mach. Intell. 29, 1489–1503 (2007)
10. Vizcaya, P., Gerhardt, L.: A nonlinear orientation model
for global description of fingerprints. Pattern Recogn. 29,
1221–1231 (1996)
11. Soutar, C., Gilroy, R., Stoianov, A.: Biometric system perfor-
mance and security. In: Proceedings of the Conference of IEEE
Auto Identification Advanced Technology (1999)
12. Adler, A.: Sample images can be independently restored from
face recognition templates. In: Proceedings of Can. Conf. Elec.
Comp. Eng. Montre
´
al, Canada, pp. 1163–1166 (2003)
13. Uludag, U., Jain, A.K.: Attacks on biometric systems: a case
study in fingerprints. In: Proc. SPIE-EI 2004, Security, Stegano-
graphy and Watermarking of Multimedia Contents VI 5306,
622–633 (2004)
14. BioAPI Consortium.: BioAPI Specification version 1.1 (2001)
15. Adler, A.: Images can be regenerated from quantized biometric
match score data. In: Proceedings of Can. Conf. Elec. Comp.
Eng. Niagara Falls, Canada, pp. 469–472 (2004)
16. International Labour Organization.: Biometric testing campaign
report (Addendum to Part I). Geneva (2005)
17. The Guardian.: Cracked it! (17 Nov. 2006)
Temporal Characterization of Faces
Temporal characterization of faces is the process of
modeling the way appearance of a face varies with
time. As a face moves, its appearance as captured in a
video changes due to change in pose, illumination
conditions, expression, etc. The pattern of these varia-
tions is often specific to the individual, containing
distinguishing information that can be used by video-
based face recognition systems for improved
performance.
▶ Face Recognition, Video-based
Temporal Characterization of Faces
T
1327
T
Temporal Domain
When a face is captured over a period of time, as in
video recording, it is often said that a facial image is
available in temporal domain or that it has temporal
resolution. In contrast, when only a single image of a
face is available, as in a passport photograph, it is said
that facial image is not available in tem poral domain.
In sensing data, a natural tradeoff is observed: either
sensory data are of high spatial resolution or temporal
resolution, but not of both at the same time. For
example, an image of a face in a printable document
is of high resolution, whereas faces observed live on TV
are normally of very small resolution. As demonstrated
by biological vision systems, recognizing an object that
is observed in temporal domain (e.g., recognizing a
face on TV ) can be done just as efficiently or even
more efficiently than recognizing the same object
from a single high-resolution sample. For automated
recognition systems however this is not the case yet.
▶ Face Databases and Evaluation
Tenprint Capture
▶ Biometric Technical Interface, Standardization
Tensor
In mathematics, tensor is a topic in multilinear alge-
bra. A tensor, which can be expressed as a multi-
dimensional array, is an object extending the notion
of scalar, vector, and matrix. For example, tensor sin-
gular value decomposition (SVD) is a generalization of
matrix SVD to multilinear higher-order SVD.
▶ Face Sample Quality
Test Sample and Size
MIC HAEL E. SCHUCKE RS
St. Lawrence University, Canton, NY, USA
Synonyms
Crew designs; Sample size; Target population
Definition
The testing and evaluation of biometrics is a complex
task. The difficulties in such an endeavor include the
selection of the number and type of individuals that
will participate in this process of testing. Determining
the amount of data to be collected is another impor-
tant factor in this process. Choosing an appropriate set
of individuals from which to collect biometrics data
is another important aspect of testing a biometrics
system.
Introduction
The assessment of a biometric system’s matching per-
formance is an important part of evaluating such a
system. A biometric implementation is an ongoing
process and as such will be treated as a process in the
sense of Hahn and Meeker [1]. Thus, any inference
regarding that process will be analytic in nature rather
than enumerative as deline ated by Deming [2]:
An enumerative study has for its aim an estimate of
the number of units of a frame that belong to a speci-
fied class. An
▶ analytic study has for its aim a basis for
action on the cause-system or the process, to improve
product of the future.
Here focus is on determining the amount and type
of data necessary for assessing the current matching
performance of a biometrics system.
The matching performance measures that are com-
monly considered most important are the false match
rate (FMR) and the false non-match rate (FNMR).
One of the important parts of designing a test of a
biometrics system is to determine, prior to comple-
tion, the amount of testing that will be done. Below
calculations that explicitly allow for determining the
1328
T
Temporal Domain
amount of biometric data which will be sampled are
described. As with any calculations of this kind it is
necessary to make some estimates about the nature of
process beforehand. Without these, it is not possible to
determine the amount of data to collect. These sample
size calculations will be derived to achieve a certain
level of sampling variability. It is important to recog-
nize that there are oth er potential sources of variability
in any data collection process.
Selection of the indiv iduals from whom these
images will be taken is another difficulty because of
the need to ensure that the biometric samples taken are
representative of the match ing and decision making
process. The goal of any data collection should be to
take a sample that is as representative as possible of the
process about which inference will be made. Ideally,
some probabilistic mechanism should be utilized to
select individuals from a targeted population. In reali-
ty, because of limitations of time and cost, this is a
difficult undertaking and often results in a
▶ conve-
nience sample, Hahn and Meeker [1].
Test Size Calculation
Determining the amount of biometric information to
collect is an ongoing concern for the evaluatio n of a
biometrics system. Several early attempts to address
this problem include those by Wayman [3] and [4]as
well as the description in Mansfield and Wayman [5]of
the ‘‘Rule of 3’’ and the ‘‘Rule of 30’’. The former is
due to several authors incl uding Louis [6] as well as
Jovanovic and Levy [7], while the latter, the so-called
Doddington’s Rule, is due to Doddi ngton et al. [8].
Mansfield and Wayman note that neither of these
approaches is satisfactory since they assume that
error rates are due to a ‘‘single source of variability’’,
which is not generally the case with biometrics. Ten
enrolment-test sample pairs from each of a hundred
people is not statistically equivalent to a single enrol-
ment-test sample pair from each of a thousand people,
and will not deliver the same level of certainty in
the results.
Effectively, the use of either the ‘‘Rule of 3’’ or the
‘‘Rule of 30’’ requires the assumption that the decisions
used to estimate error rates are uncorrelated. More
recently, Schuckers [9] provided a method for dealing
with the issue of the dual sources of variability and the
resulting correlations that arise from this structure.
The calculation given below is for the determina-
tion of the number of comparison pairs, n, from which
samples need to be taken. Define a comparison pair,
similar to the enrolmen t-test sample pair of Mansfield
and Wayman [5], as a pair of possibly identical indi-
viduals from whom biometric data or images have
been taken and compared. If the two indi viduals are
the same then call the comparison pair a genuine one.
If the two individuals are distinct then call the com-
parison pair an imposter one. In order to use this
information to determine test size, it is necessary to
specify some estimates of the process parameters be-
fore the data collection is complete. In order to obtain
sample size calculations it is necessary to make these
specifications. It is worthwhile noting here that most
other biological and medical disciplines use such cal-
culations on a regular basis and the U.S. Food and
Drug Administration requires them for clinical trials.
Approaches to carrying this out are discussed below.
Let the error rate of interest, either FMR or FNMR,
for a process be represented by g and let Y
ij
represent
the decision for the jth pair of captures collected on the
ith comparison pair, where n is the number of com-
parison pairs, i ¼ 1, ..., n and j 1, ..., m
i
. Thu s, the
number of decisions that are made for the ith compar-
ison pair is m
i
, and n is the number of different com-
parison pairs being compared. Define
Y
ij
¼
1
if jth decision from comparison
pair i is incorrect
0 otherwise:
8
<
:
ð1Þ
Assume for the Y
ij
’s that E[Y
ij
] ¼g and V [Y
ij
] ¼g(1g)
where E[X] and V [X] represent the mean and variance
of X, respectively. Estimation of g is done separately for
FNMR and FMR and so there is a seperate collection of
Y
ij
’s for each. The form of the variance is a result of
each decision being binary. The correlation structure
for the Y
ij
0
s is
CorrðY
ij
; Y
i
0
j
0
Þ¼
1if i ¼ i
0
; j ¼ j
0
r if i ¼ i
0
; j 6¼ j
0
0 otherwise
8
<
:
ð2Þ
This correlation structure is based upon the idea that
there will only be correlations between decisions made
on the comparison pair but not between decisions
made on different comparison pairs. Thus, conditional
upon the error rate, there is no correlation between
decisions on the ith comparison pair and decisions on
Test Sample and Size
T
1329
T