Like most (if not all) Hackaday readers, I like to know how the technology I use works. I’m always amazed, for example, how many otherwise smart people have no idea how the cellphone network works other than “it’s a radio.” So now that I have two phones with fingerprint scanners on them, I decided I needed to know more about what’s going on in there.
Sure, I assumed the sensor was capacitive (but maybe not, I found out). Plus we all know some super glue, scotch tape, and gummy bears are all you need to fake one out. However, that’s been known for about 15 years and we are still seeing phones and other devices rolling out with the same scanners. So for now, put aside the debate about whether we should be using fingerprint scanners. Let’s talk about how those sensors work.
Three Tech
There are at least three common ways to scan a fingerprint: Take a picture of it, sense it capacitively, or sense it using ultrasound. However you do it, you wind up with an image of the print. Then from that image, you have to work out if it is the right finger or not.
Optical
Makes sense that you can take a picture of a fingerprint using a camera-like device. In fact, I’ve seen this used when getting fingerprints made for identification. The recent Samsung Galaxy S8+ uses an optical sensor under the phone’s screen. This was planned, apparently for the Galaxy S8, but was scrapped at the last minute due to technical issues. However, some optical sensors can be easy to fool with a picture of a finger and a dirty finger can cause issues, too. Some sensors use a second method to detect a live finger such as detecting a pulse or body heat.
Capacitance
There are two ways capacitive fingerprint sensors–the kind in most phones–can work: active or passive. Either way, each sensor element acts like a capacitor. For passive scanning, your finger forms the other plate of each capacitor. In active scanning, the sensor has both plates and your finger changes the expected capacitance.
Either way, these are cheap and fairly robust. The only problem is your finger has to come in close contact with the silicon sensor and that can cause problems if your finger has an electrostatic charge on it. Asking people to wear a wrist strap to unlock their phones isn’t practical, so the sensors require special construction to help them handle high voltages due to electrostatics.
Ultrasound
Some recent phones use ultrasound to sense the dermal layer of your finger which also has the fingerprint ridges. These don’t have problems with dirt and even a scar on your finger won’t stop it from identifying you. It may even be less susceptible to fake-finger spoofing, but time will tell if that’s true or not.
Identification, Please
So one way or another, you have a bitmapped image of a fingerprint. Now what? Apparently, there are three types of fingerprint patterns: arch, loop, and whorl. The arch is just what it sounds like and starts on one side of the finger and goes to the other. The loop doubles back and exits the same side it started. The whorl circles around a central point. Interestingly, family members often have similar fingerprint patterns, but even identical twins don’t have the exact same prints.
There are several algorithms for matching prints, but the most common one is the minutia matching algorithm. This looks at three things: where your ridges end, very short ridges, and places where ridges split into two. Based on those, there’s enough information to differentiate your print from most other people’s. You can find a short but scholarly paper describing the process if you want to try your own implementation. Or, if you search, there are multiple variations on GitHub, some based on later papers.
The algorithm isn’t foolproof, of course. But the chances of someone trying to unlock your phone randomly having the same pattern is pretty low. Google’s guidelines, for example, says the scanner can have no more than a 0.002% false positive rate. If 50,000 people try to unlock your phone, then, you can expect one of them will get in. Of course, if the one that gets in is the first one of the 50,000… maybe you should buy a lottery ticket if that happens.
Giving Your Phone the Finger
That’s how a fingerprint scanner works in a nutshell. Like I said, though, faking out a sensor isn’t that hard if you are committed (see the video below) so maybe you shouldn’t lock your bank password behind your fingerprint.
Despite that, we’ve’ seen fingerprints open garage doors and you can find USB scanners that will work with a Raspberry Pi, if you still want to use this technology.
Of course, you have to wonder why we even have fingerprints or why they are just on our fingers. Scientists don’t know, but they have disproved the old notion that it helped us grip better.
So, I’m guessing the fingerprint sensor on my Samsung is ultrasonic.
Any more info on ultrasonic-based sensors? This is the first time I’ve heard about one so small.
Me too.
https://www.qualcomm.com/products/features/security/sense-id
http://www.sonavation.com/
Some of the Xiaomi phones have them, if I’m not mistaken. I have heard if your finger is perfectly dry it doesn’t work.
Ohh, top-secret silicon righ now. Bet somebody is going to toss one under a microscope pretty soon.
http://www.sonavation.com/ultrasound-biometric-sensor/
Thanks Al!
Great article!! The optical fingerprinting part reminded me of someone from Germany’s chaos computer club taking a photo of a High ranking member of the German government finger and reproducing a finger print from it. https://www.wired.com/2008/03/hackers-publish/
I wonder how big of a database the Government has established with phones using this tech? It’s not like they don’t have exploits for just about everything already.
They wouldn’t do that. That would be a violation of our basic rights.
B^)
OK – I’ll take your word for it. I’m sure it’s just me being paranoid /s
Why would lizard-men care about human rights, you are just food to them.
“…why they are just on our fingers.”
Well, *finger*prints are only on our fingers, but we’ve got unique prints on our palms and feet, too. (c:
On a more serious note, do we have unique prints or skin patterns on the rest of our body, too? For instance, let’s say a criminal leaves a print with his shoulder in a crime scene, can that be matched just to his shoulder to the exclusion of anybody else’s?
If the “print” is unique enough with moles or scars or something distinctive, it could sway the jury. But it sounds like circumstantial evidence to me. Not sure if that would be technically admissible as irrefutable evidence.
Someones bare footprints would be, but an ass-print on a photocopying machine’s glass probably would not.
Knees seem unique enough to me. Would love to hear from an expert!
Bite (teeth arrangement) has been used in several court cases, Ear shape is distinct, iris/retina scans.
If you punch someone real hard with your fist, you will probably exchange some skin cells (DNA) in the impact.
Actually, bite marks may not be admissible in court, anymore. Or may be not as a standalone evidence. Or something along that line. The same with hair, bullet lead composition, and a few other forensic evidence that have been used in the past to get convictions. I think the issue is how they’re presented in court to the jury. In the past they’ve been presented as uniquely identifying where, really, all anybody can say about them is whether they’re consistent or inconsistent with the collected evidence from the crime scene.
Anyhow, I’d be interested to find out whether the rest of our body (i.e., skin) can leave an equally distinctive print as our hand and footprints. I watch a lot of Forensic Files-type shows and I don’t think I’ve ever seen an episode where something like this have come up. So, right now I’m guessing the answer is no.
>”The same with hair”
“We found this hair containing the suspect’s DNA at the crime scene.”
“Objection! Circumstantial! That could be ANYONE’S DNA!”
“Your honor, it’s a perfect genetic match.”
“Councilor, lots of people have DNA. I won’t allow this sort of flimsy evidence in my court.”
They don’t run a full sequence analysis though. False match rate could be as bad as 1 in 1000 (more likely millions)…
A better defense would be “yeah I walked past there the day before” in any case ;)
Not for nuthin’, but I find the referenced paper about grip less than convincing. First of all, they are not talking about grip; they are talking about friction, which is why they measured with smooth plastic sheets.
Lucy probably didn’t run into much Perspex out on the savanna.
The other major part of “grip” is mechanical interlock. At tiny sizes, the laymen call that friction, but it’s not. There seem to be a lot more non-smooth things in the world than smooth things.
I think fingerprint ridges are a biological hack to provide additional sensory input when comparing different surface textures. This would be analogous to how a fresnel lens makes changing light patterns more obvious. In other words, fingerprint ridges improve the signal to noise ratio of our sense of touch, functioning as something like a pre-amplifier.
Thanks Al, another interesting and informative article. Without you we would be stuck reading articles about the security flaws in IoT 3D printed beer holders that resemble cats.
Those have security flaws? Damn!
I thought it was security claws.
Yup!
https://www.youtube.com/watch?v=wK_RGH6PhnQ
Prediction:
Active ultrasonics + waterproof phone = Ultrasonic mister app that tracks everything. :P
There are three common types of fingerprint patterns but several more that are less common. The FBI used to search fingerprint cards by hand using these patterns and other characteristics using something called the Henry system.
Modern algorithms typically don’t use pattern since it is tricky to recognize and minutiae matching works well.
After reading your comment, I did a web search on the Henry system, very interesting.
Just a technicality, but wouldn’t your expectation for random entry be closer to 25,000 people, depending on the type of distribution?
The most important method above all was ignored: multi-spectral reading.