TWC: Small: Collaborative: The Master Print: Investigating and Addressing Vulnerabilities in Fingerprint-based Authentication Systems

本项目的目标是研究指纹认证系统的安全性，特别是那些使用部分指纹的系统。许多消费电子设备（诸如智能电话）开始并入指纹传感器以用于用户认证。嵌入这些设备中的传感器通常非常小，因此所产生的图像在尺寸上受到限制。为了补偿有限的尺寸，这些设备通常在注册期间获取单个手指的多个部分印象（模板），以确保它们中的至少一个将与在认证期间从用户获得的图像成功匹配。在某些情况下，用户甚至可以被允许注册多个手指，并且与这些多个手指有关的模板与相同的身份相关联（即，一个用户）。如果在认证期间获得的部分指纹与所存储的模板中的任何一个匹配，则用户被视为成功认证。该项目正在研究生成“主指纹”的可能性，主指纹是一种合成的或真实的部分指纹，偶然与多个用户的大量部分印象相匹配。这类似于拥有一个主密码，可以解锁一组不同的用户帐户。在这方面，正在开展以下工作：（a）通过制定生成主指纹的方法，分析使用部分指纹的指纹认证系统的脆弱性;（B）计算部分指纹与完整指纹相比的独特性或独特性的模型;（c）减少与对抗性使用主指纹相关的脆弱性的方法。

The objective of this project is to investigate the security of fingerprint authentication systems, especially those using partial fingerprints. A number of consumer electronic devices, such as smartphones, are beginning to incorporate fingerprint sensors for user authentication. The sensors embedded in these devices are generally very small and the resulting images are, therefore, limited in size. To compensate for the limited size, these devices often acquire multiple partial impressions (templates) of a single finger during enrollment to ensure that at least one of them will successfully match with the image obtained from the user during authentication. In some cases, the user may even be allowed to enroll multiple fingers, and the templates pertaining to these multiple fingers are associated with the same identity (i.e., one user). A user is deemed to be successfully authenticated if the partial fingerprint obtained during authentication matches with any one of the stored templates. This project is investigating the possibility of generating a "Master Print," a synthetic or real partial fingerprint that serendipitously matches with a large number of partial impressions pertaining to multiple users. This is akin to having a Master Password that can unlock a diverse set of user accounts. In this regard, the following tasks are being conducted: (a) Analyzing the vulnerability of fingerprint authentication systems that use partial fingerprints by developing methods to generate Master Prints; (b) Models for computing the distinctiveness or uniqueness of partial fingerprints compared to full prints; (c) Methods for mitigating the vulnerability associated with the adversarial use of Master Prints.