The fingerprint is the oldest and best-known biometric feature: in the Chinese empire, it was probably used as an unmistakable signature as early as the 7th century. In 1888, the natural scientist Sir Francis Galton was able to provide scientific proof that the pattern of papillary lines on the fingertip is individual to each person.

For a long time, however, this finding was almost exclusively employed in forensic science, because the prints had to be transferred from the fingertip to paper with ink and then laboriously compared by hand. For large-scale use in everyday life, this method was far too slow and costly.

With increasing digitisation and growing computer capacity, this has changed fundamentally. Scanning a fingerprint and comparing it with a stored print or even an entire database can now be done within seconds – so it's no wonder that more and more applications for the use of fingerprints have opened up, from entry control at country borders to access control at events.

More applications, more spoofing attempts

However, the number of creative attempts to circumvent a technique often increases with the number of applications: “In the case of fingerprints, spoofing attempts range from using thin silicone fake prints to filing off the papillae or even to completely transplanting the skin on the fingertips,” says Professor Norbert Jung. The computer scientist heads the Institute of Safety and Security Research at Hochschule Bonn-Rhein-Sieg (H-BRS) and has been dealing with such tricks for a long time. He aims to develop techniques that prevent at least the most common fakes of biometric features.

In their current 3D-Finger project, Norbert Jung and his team want to add a third dimension to fingerprint scanning. They use a technique often employed by ophthalmologists and dermatologists: optical coherence tomography, or OCT for short. The OCT scanner can look about two millimetres deep into the skin and thus also image structures that lie beneath the outermost skin layer.

Alexander Kirfel, PhD student and research assistant in the project, explains the idea behind the 3D fingerprint: “The structures in the lower layers of skin follow those in the upper layer. So, there is an outer and an inner fingerprint, and they are very similar.” This finding turns out to be both a curse and a blessing for the project: on the one hand, this natural duplication makes faking attempts difficult because OCT technology can easily detect whether the inner and outer prints match. On the other hand, if the inner fingerprint differed more from the outer print, it would be an additional safety factor: a distinctive combination of two different features is harder to imitate than a combination of two matching features. “We had initially hoped that the differences would be greater,” says Kirfel.

Scanning and calculating in less than ten seconds

However, the young scientist has not been discouraged by this result. Instead, he has spent the last few months developing the algorithms that process the OCT images into a picture. Developing the OCT technology itself, however, is not the goal of the project, explains Professor Jung: “The proof-of-principle for the 3D fingerprint has been demonstrated in a precursor project at the Federal Office for Information Security (Bundesamt für Sicherheit in der Informationstechnik, BSI). While that project was carried out with a self-constructed OCT, we are now using a commercially available device with a wavelength of 1300 nanometres, as used by dermatologists.”

The team from the H-BRS is no longer concerned with basic research: 3D-Finger is already very close to a concrete application. The project goal is a functioning prototype that meets the high demands of future customers. A fast 3D fingerprint scanner might, for example, be used in fully automated kiosk systems at airports to process large numbers of passengers in a short time. For this, however, the scanner must be fast enough as well as cost-effective to compete with existing systems.

“The target for scanning speed determined by our industry partners is a maximum of ten seconds, including data evaluation,” says Kirfel. That is an ambitious goal, but not unattainable: Currently, a scan of 109 voxels (i.e. one thousand pixels each in height, width, and depth) takes about seven to eight seconds. This leaves two seconds for data evaluation. By having several graphics cards calculate in parallel, the team is now able to reach that requirement, too.

Field trials with the fake toolbox

Although the time target has been achieved, the project team still has a lot of work to do. After developing the algorithms, field trials are next on the agenda. “To render a biometric method fake-proof, you have to test it on as many different fakes as possible,” says Norbert Jung. Thanks to their experience in this area and the many years of cooperation with the BSI, the scientists have access to a “fake toolbox” containing a wide variety of fakes and can thus test their way through various fingerprint manipulation methods. On one point, however, they are already sure:  OCT scanners do not fall for simple silicone prints. The silicone layer immediately stands out in the scan as a “third print”, says Jung.

While the upcoming field trials will secure the system against attacks from outside, the software must of course be protected against intruders, too. “After all, the best spoof protection is of no use if hackers then steal the fingerprint data and misuse it,” Norbert Jung elaborates. One of the work packages therefore deals with template protection, a procedure for securely encrypting fingerprint data.

Contactless scan with many advantages

And the researchers have another important task on their hands: backwards compatibility with existing 2D fingerprints. There is an important difference between current fingerprint scanners and the new OCT method. When 2D prints are captured, the finger is placed on the scanner surface, being more or less flattened in the procedure. The 3D scanner, on the other hand, works contactless. The fingertip is scanned from a distance of a few millimetres without touching the scanner surface.

“The contactless scan has many advantages for us,” explains Kirfel: “You can capture a larger fingertip area, the fingerprint is more distinct, and fakes are easier to detect.” The downside, however, is that the software must calculate the differences between 3D and 2D fingerprints and include the spatial factor to enable reliable comparisons between old and new prints.

In a few years, the project team hopes, the first kiosk systems could be ready for border controls or resident registration offices. The 3D scanner might even be used at mass events to supplement access controls. Fakers and tricksters will then have to develop new creative ideas to bypass the controls – and Norbert Jung and his team will come up with new ways to prevent that.