Proactive forensic science in biometrics: Novel materials for fingerprint spoofing.

Motivated by the need to prepare for the next generation of fingerprint spoofing, we applied the "proactive forensic science" strategy to the biometric field. The working concept, already successful in a few fields, aimed at adopting the sophisticated criminals' way of thinking, predicting their next move so that the crime-fighting authorities can be one step ahead of them and take preventive measures, against biometric spoofing in this instance. This strategy involved the design, production, and characterization of innovative polymeric materials that could possibly serve in advanced fingerprint spoofs. Special attention was given to materials capable of fooling fingerprint readers equipped with spoof-detecting abilities, known as "Presentation Attack Detection" (PAD) systems and often referred to as liveness detection. A series of direct cast fake fingerprints was produced from known commercially available spoofing materials, and was functionally tested to compare their performance with that of spoofs produced from the new polymers. The novel materials thus prepared were hydrogels based on polyethylene glycols (PEGs) that were chain-extended. They showed good performance in deceiving security systems, considerably better than that of spoofs produced from commercial materials, and are, therefore, good spoofing candidates that law-enforcement authorities should be aware of.

In this research, we applied the “proactive forensic science” strategy to biometrics.

This strategy involved the design, production, and characterization of innovative polymeric materials as potential advanced fingerprint spoofs.

Methodically modified PEG‐hydrogels, thus, prepared showed good performance in deceiving fingerprint readers.

INTRODUCTION

The contest between crime and the law often takes the format of a vicious circle as in the case of new psychoactive substances that regularly appear on the market when not yet covered by legal provisions. It is only after they have been identified and characterized by forensic laboratories that they are added to the list of illegal substances in various countries’ Illicit Drugs Acts. However, in the meantime, newer compounds appear and the cycle continues [1]. A similar situation prevails in the biometric domain, especially in fingerprint recognition, with their increased use in controlled‐access systems throughout the past decade [2, 3, 4, 5, 6].

Despite their numerous advantages, fingerprint recognition systems are vulnerable to a variety of attacks. One of them, the presentation of fingerprint spoofs, was proven successful [7, 8]. Moreover, certain dedicated websites such as the Chaos Computer Club at https://www.ccc.de/en/ provide instructions on how to fake fingerprints (and published on http://biometrics.mainguet.org/ website) [9]. Indeed, several anecdotal cases of fraud by means of spoof fingerprints have been reported [10, 11, 12, 13, 14], all used by individuals for the purpose of impersonating or deceiving controls.

The vulnerabilities of current fingerprint readers have been studied by several research groups who demonstrated that many sensors can be fooled by fake fingerprints [15, 16, 17, 18]. Fingerprint patches made of commercially available materials such as silicone, latex, or gelatin are among the best‐known spoofs, producing “gummy fingers” [7, 8, 16].

Consequently, developers of fingerprints sensors have designed countermeasures [19, 20] and biometric systems’ manufacturers have added anti‐spoofing capabilities, presentation attack detection (PAD) systems, to their devices. Many of them are hardware‐based, several rely on the electrical properties of the skin, some are based on multispectral imaging, and a few have added a separate sensor for that purpose [21, 22, 23, 24, 25]. Others are software‐based, trying to identify the fakes by image analysis, nowadays using convolutional neural networks (CNN) [21, 26, 27, 28]. The latter, apparently, is more susceptible to being fooled by high‐quality spoofs made of superior mimicking materials. This work focuses on fingerprint‐readers equipped with hardware‐based PADs, especially optical and solid‐state sensor readers, as they are the most widespread devices [29].

The known spoofs are quite efficient and easy to produce, but from the criminal’s point of view, they suffer from several shortcomings such as short shelf life and poor chemical resistance. In addition, some of them, e.g., silicone replicas, are effective only against certain readers, primarily the optical ones [22].

We anticipate that the sophisticated criminals may try to produce more advanced spoofs, undetectable by the new PADs [30, 31]. Furthermore, the organized‐crime groups have the resources and the technological know‐how that enable them to design and synthesize such advanced and efficient new spoofing materials [32, 33, 34, 35].

This research stems from the proactive forensic strategy already introduced in 2014 [36], with the goal of enabling crime‐fighting organizations to be one‐step ahead of “educated” criminals, in this case, fingerprint forgers. This preemptive strategy, often referred to as “forensic intelligence,” has already been successful in combating cyber‐crime [37] and has shown potential also within the battle against new designer drugs [1, 38]. With the growing use of biometrics, we suspect that the next war on terrorism and organized crime with regard to identity theft and fraud will be conducted mainly against biometric spoofing.

Following this proactive approach, we aimed at producing new fingerprint spoofs from new materials specifically designed and synthesized for this purpose.

The mimicking material should enable exact replication of the pattern and the relevant properties of the fingers without any machine‐distinguishable defects. Hence, the material has to be able to reproduce the morphology and the fine details of the fingertip, while at the same time, be compatible with a live finger and show similar physical or optical properties. Only a few properties of the finger are essential when applied to the reader, most importantly its topography, its hardness, and its electrical conductivity. Hydrogels were selected as a promising material for the purpose for the following reasons: While being insoluble in water, hydrogels are distinguished by their ability to contain water [39], which contributes to the polymer’s conductivity. Additionally, like many other polymers, hydrogels can be tailored to meet specific requirements based on their exact composition, commonly used for various biomedical applications [40, 41]. The properties of these materials depend on their building blocks and on the preparation procedures and can be extensively modified.

Many of the most widely used hydrogels are based on polyethylene glycol (PEG), also known as polyethylene oxide (PEO). Hydrogels based on PEG derivatives are likewise widely applied [42].

Aiming at producing a series of high‐quality fingerprint spoofs, which will successfully deceive selected PAD systems, this research focused on synthesizing novel spoofing materials based on PEGs and PEG derivatives, chain‐extended to produce new polymers. The PEG is the main component of the backbone and its high hydrophilicity is restrained and controlled by introducing hydrophobic functional groups to the polymer.

PEG‐based spoofs were produced by the direct cast method [21, 43] under the assumption that the criminals involved in “high‐quality” spoofing will usually get the cooperation needed. This method was chosen due to the fact that it generally produces better impressions [15, 29, 43].

Due to the sensitivity of the subject, we have chosen not to disclose detailed information such as the specific chemicals involved and the devices tested.

MATERIALS AND METHODS

Reagents and compounds preparation

All the new polymers were based on polyethylene glycols (PEGs) or analogous diamines commercially available chemicals, purchased from Sigma ‒ Aldrich Israel. Syntheses were conducted based on a variety of homologous hydrogels, with molecular weights ranging from 400 to 20,000 Da.

All syntheses were performed by a one‐pot reaction, producing polyurethane, polyurea, and polyamide hydrogels. The different polymers were investigated and characterized, from the molecular level and up to the functional level, according to the requirements defined. Various analyses were conducted: chemical analysis by H1NMR and FTIR, molecular weight by GPC, morphology by DSC, water uptake by the gravimetric technique, mechanical properties using a universal testing machine (UTM), and a hardness tester. Electrical resistance was measured by a high‐sensitivity multimeter.

Artifacts and database production

A collection of artificial fingerprints was created by the direct cast method from 13 volunteers' fingers, producing 78 silicone molds of “cooperating fingerprint‐donors.” The database was built both digitally and physically. Six fingers of each of the volunteers were enrolled using three different fingerprint readers, two optical and one multispectral, each of the three readers equipped with a different proprietary presentation attack system (PAD).

Following the enrolment, silicone molds were fabricated using a commercial dental impression‐material, by applying the molding material on the volunteers’ fingers. Subsequently, different replicas of the fingerprints were produced by casting the spoofing material into the molds.

The hydrogel spoof samples were prepared by solvent casting from an organic solvents solution. Replicas made from known spoofing materials, commercially available silicone, polyurethane, and latex similar to some of those used in the LivDet competitions [44, 45, 46, 47, 48], were produced to compare their performance and deceiving ability to that of the new spoofs.

Biometric instruments and systems

The new spoofs were functionally tested using the three capturing devices, verifying the readability of the spoofs and the response in PAD mode. Preliminary PAD testing was also conducted on a fourth system that has a different PAD system and was acquired in the course of the research.

Functional evaluation and analysis

Functional tests were conducted on the database created using the spoofs produced. First, identification of the spoofs was carried out using the Neurotechnology’s Neurotec Biometric 6.0 (VeriFinger) software and the three readers.

Each sample was then tested in the enrolment mode with each of the three readers with some preliminary tests with the fourth reader, using their corresponding software and their PAD system. The Neurotec software’s anti‐spoofing feature was too limited; it did not fully support the PAD system of the readers.

The various artifacts were then tested for spoofing by applying them on the different readers and recording the response of the PAD systems, three times each, setting the detection threshold level to the default values. The rate of spoofing success was noted as the False Acceptance Rate (FAR), according to the “liveness score” attained.

Additionally, a similar functional performance analysis was conducted by testing artifacts on one commercial software‐based PAD. This latter system was trained using LivDet databases [44, 45, 46]. Several images of the various spoofs were examined by the software and their “liveness” score was recorded.

Quality measure

The quality of the various spoofs, both commercially based and novel‐hydrogels, was determined using the NIST quality engine NFIQ 2 [49] after reformatting the images (BMP) to meet the requirements of the software. NFIQ is a fingerprint image quality algorithm issued by NIST in 2004; an upgraded version, the NFIQ 2 [50], was released in 2016 and used in this research.

RESULTS

Among the various candidates available, we chose polyethylene glycol (PEG) [1] as the backbone (Figure 1).

FIGURE 1

Polyethylene glycol (PEG)

PEGs, differing in their molecular weights, were chain‐extended using hexamethylene diisocyanate (HDI) [2] thus producing new polymers. The chemical reaction is shown in Figure 2.

FIGURE 2

Poly‐PEG‐urethanes formation

Similarly, Jeffamine ED [3], analogous diamines, were chain extended using HDI [2], producing a comparable polyurea‐hydrogel, as shown in Figure 3.

FIGURE 3

Poly‐Jeffamine‐urea formation

Several series of high‐quality spoofs were produced in the silicone molds, one is shown below in Figure 4. The spoofs were produced via the direct cast method that generated molds of high quality, thereby, enabling good replication of the fine details of the fingers’ topography. One of the hydrogel spoofs is shown in Figure 5.

FIGURE 4

A silicone mold [Color figure can be viewed at wileyonlinelibrary.com]

FIGURE 5

A hydrogel spoof [Color figure can be viewed at wileyonlinelibrary.com]

The PEG‐based hydrogels exhibited good characteristics and improved functional properties.

Referring to the main properties required, the leading new materials achieved an adequate electrical resistivity of about 15‒50 MΩ, expressing the conductivity, and a hardness similar to that of a human finger, Shore A ranging from 9 to 26, as measured in the laboratory and shown in Table 1. The conductivity, although being low, still enabled reading by the device when necessary.

TABLE 1

Hardness and resistivity of selected hydrogels versus human skin properties

	Shore A	Resistivity (MΩ)
Human	3~18	4~27
Hydrogel #1	9.7±0.6	16.8±3.6
Hydrogel #2	23.3±2.3	45.1±7.4

The two selected hydrogels showed good functional properties as detailed below, one somewhat better than the other although its properties relatively inferior, due to the different functional groups within the polymer and their frequency along the chain, the first based on the urea linking groups and the second on urethane groups.

When tested by the biometric readers, the image quality of the spoofs was not very high, due to the presence of air bubbles entrapped in the product. The quality was later improved as detailed hereafter. All of them, however, were readily recognized by the readers and received high scores upon biometric identification, 48 being the default and recommended minimum score, as presented in Figure 6 below.

FIGURE 6

Example of a screen image of finger identification with Neurotec Biometric 6 – Identification score of hydrogel #2 spoof of subject no. 13 right index, enrolled with the reader no. 3 [Color figure can be viewed at wileyonlinelibrary.com]

Biometric testing and evaluation

All the spoofs were identified as the original finger without exception and with high matching scores, as expected from the real ones. The quality of the images acquired and the scores reached in verification mode presented a good replication of the original finger. Finally, the false acceptance rate (FAR), the ability to deceive the system using the PAD, was higher than that of commercial materials, as reported hereafter.

The spoofs produced from the new materials showed a high rate of successful attacks on two of the three biometric systems, reaching high scores of deception, i.e., high FAR; the fakes which were prepared from commercially available polymers were rejected by the three systems at much higher rates, i.e., low FAR, as shown in Table 2.

TABLE 2

False acceptance rates (FAR), materials versus readers

		A			B			C
		Pass	Fail	%	Pass	Fail	%	Pass	Fail	%
Polyurethane		0	94	0	9	102	8.1	0	90	0
Silicone		6	88	6.4	6	105	5.4	0	108	0
Latex		80	19	80.8	1	92	1.1	0	96	0
Hydrogel #1	a	187	48	79.6	151	104	59.2	2	178	1.1
	b	160	35	82.0	103	74	58.2	0	61	0
Hydrogel #2	a	39	6	86.7	32	16	66.6	0	39	0
	b	34	1	97.1	32	8	80.0	0	17	0

The hydrogel spoofs (two batches, a and b) were accepted in about 80% and 60% of the trials on the first two devices (A and B), respectively, while almost all the commercially available spoofs failed to fool these two systems, with the exception of the latex fakes versus the first one that accepted 80% of them.

All the spoofs were detected as such by the third device (C), based on multispectral technology, aside from the only two hydrogel‐spoofs artifacts, which was probably a genuine error of the system.

Software‐based PAD

One Spoof Detection software was used as an example of presentation attack detection by image analysis. The false reject rate (FRR) of authentic fingers was about 21%, perceived as 79% acceptance rate, and is considered a relatively high error rate. The different spoofs attained a comparatively high FAR as well, as shown in Table 3, about 35% of the polyurethanes, 32% of the silicones, 18% of the latex, and 37% to 46% of the new polymers were falsely accepted.

TABLE 3

Acceptance and reject rates of the software‐based PAD

	Authentic		Polyurethane		Silicone		Latex		Hydrogel #1		Hydrogel #2
	Count	%	Count	%	Count	%	Count	%	Count	%	Count	%
Pass (>499)	64	79.0	9	34.6	13	31.7	6	18.2	36	36.7	16	45.7
Fail (<500)	17	21.0	7	26.9	27	65.9	9	27.3	37	37.8	18	51.4
No response	0	0.0	10	38.5	1	2.4	18	54.5	25	25.5	1	2.9
Total	81	100.0	26	100.0	41	100.0	33	100.0	98	100.0	35	100.0

Image quality

The image quality attained by the different spoofs was measured by the NFIQ 2 image‐analysis software, and compared with images of authentic fingers. The common practice is to accept the highest 40% of the scoring images for enrollment, and the highest 60% for verification purposes. Most of the images reached acceptable quality scores, above 60, as seen in Table 4. Only 67% of the authentic fingers obtained a score higher than 60 and 98% more than 40, while the polyurethane and silicone artifacts attained slightly lower scores and the latex ones performed better. Only 42%‒55% of the hydrogels achieved a score of more than 60, probably due to many air bubbles entrapped in the product. This could be improved by further optimization of the production technique. Nevertheless, most of them received high scores upon biometric identification, as mentioned above. It is noteworthy that the latex‐spoofs attained the highest scores, even higher than authentic fingers, due to the higher quality of the replication with fewer imperfections and apparently better wetting capability relatively to fingers, as some might be too dry for good visualization on the readers.

TABLE 4

NFIQ 2 image quality score distribution of the different spoofs vs. authentic fingers [%]

NFIQ2 score	Authentic	PU	Si	Latex	Hydrogel #1	Hydrogel #2
Number of images	81	26	41	33	118	38
>60	66.7	50.0	70.7	93.9	42.4	55.3
40~60	31.3	38.5	17.1	3.1	38.1	26.3
<40	2.0	11.5	12.2	3.0	19.5	18.4

DISCUSSION

The new PEG‐based hydrogels show high potential as novel spoofing materials. The efficiency of the spoofs was achieved by the particular structure of the rationally designed polymers.

As expected, due to the flexible segments along the polymer backbone and the hydrophilicity of the linking groups, the polymer was fine‐tuned according to the length of the basic chain, the nature of the linking bond, or both. These segments produced chemical linking to water molecules and modified the polymers' properties according to their frequency along the polymer chain. The flexibility and the hydrophilicity achieved enabled the artifacts to present high‐quality images of the fake fingerprints with an adequate electrical conductivity similar to real fingers when needed, effectively deceiving some PAD systems. The hydrogels, thus, prepared exhibited superior mechanical and electrical properties.

The solvent‐casting method enabled clear reproduction of the fine details of the fingerprint, attaining high‐quality NFIQ2 scores, and proved to be suitable for the task. Some spoofs achieved higher scores than the original real fingers, most likely owing to the higher wetting capabilities of the materials relative to fingers, dry fingers in particular which often present low‐quality images. Several products presented some shortcomings expressed in lower quality scores, due principally to the presence of air bubbles in the casted finger. Hence, the production technique was subsequently improved and could be further developed, essentially by choosing the appropriate mixture of solvents and the optimal material concentration. Sample images of spoof fingerprints are seen in Figure 7.

FIGURE 7

Images of hydrogel #1 (A) and hydrogel #2 (B) spoofs as acquired by device A. (optical)

The images acquired by the various devices reached relatively high false‐acceptance rates of the software‐based PAD system, showing the importance of the quality of the artifacts, allowing a high probability of successful spoofing by the presented method and materials.

Most of the hydrogel spoofs were not detected by some of the PAD systems, reaching much higher deceiving scores than those made up from commercial materials. Nevertheless, some systems are quite good at detecting spoofs; for example, the multispectral technology (device C) exhibited very good resistance to spoofing, even by the new materials. The use of different wavelengths allows scanning both surface and sub‐surface features of the finger, efficiently distinguishing fakes from the reals. Similarly, the fourth reader, with a PAD system based on the electrical properties of the skin, rejected all the spoofs successfully.

CONCLUSIONS

This research has illustrated the working concept of proactive forensic science in biometrics. This approach involves the exploitation of forensic science in order to generate new insights on crime, fingerprint spoofing in the present case. The threat of fingerprint spoofing is growing along with the increasing use of biometric systems and the constant race between crime and law enforcement agencies will most likely continue in this field due to the high possible gain for the criminals.

The aim of our work was to design new polymers with improved properties as potential fingerprint‐spoofing materials. Flexible, hydrophilic materials with appropriate mechanical properties, which meet the functional requirements, have been developed by rationally modifying the polymers' structure.

New hydrogel‐based spoofs were produced by gradually increasing the molecular weight of the basic polymer and changing the nature of the linking group, based on relatively simple and straight‐forward chemistry. Several novel‐material spoofs were manufactured and functionally tested, confirming the feasibility of conceiving such new materials able to effectively deceive some presentation attack detection systems. We showed that hydrogels are good candidates; hence, these new spoofing materials might present a serious threat to biometric readers and PAD systems.

Law enforcement agencies should be aware of this threat and take appropriate countermeasures, developing new technologies and methods to detect new sophisticated spoofs.