Biometrics: Metrics, Derivation, and Real-World Applications Report

This report delves into the technical aspects of biometrics, focusing on the derivation and application of key performance metrics. It begins with an introduction to biometric systems, their increasing adoption, and their role in authentication and security across various sectors. The report then provides a technical description of biometric processes, including the different types of biometric identification (physiological and behavioral) and the components of biometric systems. A significant portion of the report is dedicated to explaining and deriving the metrics used to evaluate biometric system performance, such as False Match Rate (FMR), False Non-Match Rate (FNMR), Equal Error Rate (EER), Failure to Enroll Rate (FTE), Ability to Verify Rate (ATV), and Ability to Spoof Rate (ATSR). The report also includes case studies, assessing fingerprint and face recognition algorithms from vendors like Digital Persona and Neurotechnology. The report concludes by discussing the typical applications for which the sensors tested would be suitable and why, and the industrial standard metrics to be used in the practical work are outlined.

Running head: DERIVATION OF METRICS USED IN BIOMETRICS
application of Biometrics
Derivation of Metrics Used in Biometrics
Name of the Author
Name of the University

1DERIVATION OF METRICS USED IN BIOMETRICS
Table of Contents
Introduction................................................................................................................................2
Technical Description................................................................................................................2
Biometrics Types...................................................................................................................5
Metrics used in Biometrics.........................................................................................................6
Derivation of Metrics.................................................................................................................8
FMR, FNMR and EER...........................................................................................................8
Failure to Enrol Rate (FTE)...................................................................................................9
Ability to Verify Rate (ATV).................................................................................................9
Ability to Spoof Rate (ATSR)..............................................................................................10
Windows Login with Digital Persona......................................................................................11
Face Recognition with Neurotec Software..............................................................................14
Finger Template Attack with Neurotec Software....................................................................16
Conclusion................................................................................................................................20
References................................................................................................................................21

2DERIVATION OF METRICS USED IN BIOMETRICS
Introduction
In the last five years digital media has taken the world by storm and this has resulted
in a dramatic rise in adoption of biometric systems across the globe. These biometric systems
are being used to authenticate parties involving in digital transactions, authorizing access to
various resources as well as creating portfolios or performing registration of citizens in
various parts of the world. Here the study investigates these biometric systems and how safe
and secure a process they are in performing the above-mentioned check for various
individuals. The study starts with a technical description of biometrics where the process is
defined and the origin of the term is discussed. Then the working model of biometric systems
also get explained with the help of a diagram. Thereafter the various components of the
process are identified and discussed. When this is complete the different modes of biometric
activities are investigated. After this the different metrics used for evaluating the performance
of biometric systems are identified and their derivation is provided. Having completed this
the fingerprint and face recognition algorithms of different vendors are assessed. These
vendors are mainly digital persona and neurotechnology. After talking about the
multibiometric functionalities of neurotechnology the study ends with conclusion notes.
Technical Description
Biometrics can be measured as the statistics based analysis of the specific physical as
well as behavioural characteristics of people. This technology gets used in the process of
identifying and controlling access of human individuals that are under surveillance of the
owner of the biometric device (Young 2018). The key advantage of biometric identification is
that individual people can be uniquely identified by means of attributes relating to their
behaviour or their physical self (Elliot, Hamlin and Lizamore 2019). This is why the term

3DERIVATION OF METRICS USED IN BIOMETRICS
‘biometric’ was coined, which is a Greek word where bio refers to life and metric means
measurement. The biometric process is shown in the picture below.
The two primary jobs of fingerprint scanners are as follows – the biometric system
requires to obtain the physical print of a finger. These fingerprints contain an array of ridges
and valleys in them. The pattern of these ridges and valleys vary from individual to
individual. The job of the biometric system is to see if the print matches the pre-scanned set
of prints which are the fingerprints of the authentic individuals that are stored within the
system. If a match is found, the individual claimant of the fingerprint is considered to be
authentic or authorized to enter. Otherwise the individual is probably an imposter and is
denied access to the organization resources. The pre-scanned set of fingerprints are stored in
the system at the time of enrolment of authentic individuals to the biometric system and all

4DERIVATION OF METRICS USED IN BIOMETRICS
their fingerprint information is kept in the data stores (Othman and Callahan 2018). The
enrolment process of individuals to the biometric system and the consequent functioning of
the biometric system is illustrated in the diagram shown above.
In general biometrics are mainly used for authentication purposes and is very common
in public and corporate security environments as also for security in consumer electronics and
point of sale (POS) devices (Saevanee et al. 2015). On the top of providing standalone
security, the major factor behind the success of biometric verification has turned out to be the
convenient usage of biometric mechanisms implemented in supported devices equipped with
fingerprint sensors, face recognition, retina scan and other biometric techniques as can be
noted from the picture above (Ashbourn 2015). As per the picture, the different components
that facilitate the biometric services can include the following:
Readers: A reader is that part of the devise which is responsible for performing the scans by
which the biometric device records the various biometric factors that need to be
authenticated.
Software applications: These are the desktop, laptop or even smartphone application that
processes the scanned data and converts them into standard digitized formats for comparing
or matching areas of the captured data with information stored within the system.

5DERIVATION OF METRICS USED IN BIOMETRICS
Database: The database provides the logical and physical storage solution where the
registered information regarding the authentic individuals are kept. These databases can both
be present in external cloud servers as also in hardware installed on the premises of the
organization.
When individuals get scanned and their biometric data are captured, these are critical
sensitive information regarding those individuals that needs to be kept safe and protected by
the party conducting the biometric scan (Hartová, Hart and Prikner 2018). This is the reason
why the organizations store this information in centralized databases with multilayer security
or partner with third parties who store this information for the organization in their data
centres and make them available through public/private cloud servers (Shakil et al. 2017).
However biometric implementations can also be gathered them locally via hashing methods
through various cryptographic means. This enables the identification and authentication
processes of individuals to be performed without direct contact with the specific individual.
Biometrics Types
There exists two main types of biometric identification and these are physiological
characteristics and behavioural characteristics. The physiological characteristics are those
identifying traits which refer to the composition of the users that need to be authenticated. As
shown in the image below these can include mechanisms like a) Facial Recognition b)
Fingerprints c) Finger Geometry d) Iris Recognition c) Vein Recognition e) Retina Scanning
f) Voice Recognition g) DNA matching

6DERIVATION OF METRICS USED IN BIOMETRICS
On the other hand, the behavioural identifying characteristics can include those specific
ways by means of which every individual acts. This can include typing pattern recognition,
walking gait and can even include continuous authentication mechanisms versus one-off
single authentication.
Metrics used in Biometrics
There can exist various forms of biometric solutions for the purpose of identifying or
authenticating individuals within a company. As a result, it is important to ensure that the
performance of these biometric systems is up to the mark (McKenna and Sarage 2015). For
this purpose, different performance metrics are introduced such that the performance of
biometric solutions can be evaluated with respect to their performance in terms of security,
safety, reliability and consistence (Douglas et al. 2018). The evaluation is especially
important for those businesses that are to serve critical and sensitive services. These different
performance metrics for biometrics can be:
1) False Match Rate (FMR)
2) False No Match Rate (FNMR)

7DERIVATION OF METRICS USED IN BIOMETRICS
3) Failure to Enrol Rate (FTER)
4) Equal Error Rate (EER)
5) Ability to Verify Rate (ATV)
6) Ability to Spoof Rate (ATSR)
FMR: False Match Rate is the empirical estimate regarding probability or percentage of time
the system generates incorrect matches for an individual (Elhoseny et al. 2018). This means
that, in reality the system failure is letting an imposter through. This is used interchangeably
with False Acceptance Rate or FAR.
FNMR: False No Match Rate is the empirical estimate about probability of the system to
reject the claim of an individual incorrectly de (Almeida Junior and Rodriguez 2017). This
means that, in reality the system failure is block the access of an authentic individual. This
gets interchanged often with False Rejection Rate or FRR.
ERR: Equal Error Rate is that rate for which the FMR and FNMR of a particular system is
the same (Friedman Stern and Komogortsev 2019). When the threshold is very low, very few
or no users are to be rejected and hence the FNMR is low and therefore the FMR is going to
be high (Raghavendra and Busch 2016). With the increase of this threshold the FMR
becomes low while the FNMR turns high. At a middle ground the FMR matches the FNMR.
This middle ground value is called thee Equal Error Rate.
ATV: The Ability to Verify rate is the indication of the overall user percentage which is
verified through the biometric systems. As a result, ATV can even be measured as the
combination of FNMR and FTE or Failure to Enrol Rate (Grech, Marchant and Samuel
2016). The ATV is used alongside the FMR for obtaining critical information on three major
biometric system issues which are cost, security and convenience.

8DERIVATION OF METRICS USED IN BIOMETRICS
ATSR: The Ability to Spoof Rate is the chance that biometric systems have the ability to
accept previously recorded sample data of the user. An example can be the use of voice based
unlock features of biometric devices which can be used in order to gain. The attacker can also
mould the fingerprint of the user to access the device. These attempts are considered as spoof
attacks.
Derivation of Metrics
The Biometric authentication systems can derive match scores through comparison of
biometric data of people and trying to authenticate the enrolment data for the identities
claimed by them. This match score is directly proportional to how close a match between the
captured data of the individual and the stored information regarding genuine users is found.
The closest match generates the highest match score. When the match score of an individual
exceeds a particular threshold, the individual is viewed as an authentic user. If this threshold
is set considerably high, even the genuine users will get rejected and if it is set very low,
imposters can break in. In general, the ideal balance would be when the highest score of
imposters is considered to be lower than the lowest score set for the genuine users. For such a
balance the ideal threshold needs to get set midway between the two scores discussed earlier.
FMR, FNMR and EER
Unfortunately that cannot be achieved in reality and the scores of genuine users and
imposters mostly overlap one another. Here the biometric systems generate higher or lower
rate of two types of errors. These are the FMR or FAR and the FNMR or FRR. For
quantifying these error types the FMR and the FNMR of biometric devices can be defined in
the following way:
FMR = (successful authentications of the imposters) / (total authentication attempts of
imposters)

9DERIVATION OF METRICS USED IN BIOMETRICS
FNMR = (failed authentications of genuine users) / (total authentication attempts of genuine
users)
These error rates both rely heavily on the threshold set in the biometric device. Higher
thresholds can bring down FMR errors while shooting up FNMR errors as a consequence
(Ahlawat and Kant 2015). At the ideal balance when the FMR equals FNMR, the value of
these error rates is called Equal Error Rate (EER).
Failure to Enrol Rate (FTE)
During the enrolment process of users to biometric authentication systems, the
number of unique characteristics derived by the system from the users is directly responsible
for the extent at which the system can reliably authenticate users (Bajwa and Kumar 2015). If
the amount of characteristics is not enough, the user will be unable get enrolled into the
system (Mohammed and Hegarty 2017). As a result the failure to enrol rate or FTE can be
deduced as:
FTE = (users failing to enrol to device) / (total users making enrolment attempts)
Common methods that have been derived in order to bring down the FTE errors are –
a) providing improved training to the users, b) providing ergonomic methods of using
biometric device based authentication and c) allowing users to make higher attempts in
enrolling for the biometric authentication.
Ability to Verify Rate (ATV)
To ensure that the biometric authentication system functions properly for all users, the
users need to be able to enrol into the biometric authentication system. The ATV rate
provides an estimate of the proportion of users who can successfully enrol into the system.
Hence the ATV rate can be deduced as:

10DERIVATION OF METRICS USED IN BIOMETRICS
ATV = (1 – FTE) * (1 – FNMR)
Similar to FMR, the ATV helps provide useful information about the biometric
authentication systems. If users cannot be authenticated through the biometric systems, other
alternate mechanisms need to be procured and applied thereby increasing costs.
Low ATV rates suggest less users are able to use the biometric system properly. This
means the alternative security mechanisms installed should be made as secure as biometric
system or the overall security of the office gets to suffer.
Also, the lower the ATV the more difficult users are finding it to enrol into the
biometric authentication system and or failing to use the devices properly. Hence, low ATVs
means that the biometric system is not serving the purpose.
Ability to Spoof Rate (ATSR)
The Ability to Spoof Rate also called Spoof Attack Rate is the measure of chances
that imposters can fake fingerprints and voice recordings of genuine users to gain
authentication. Spoof attacks can be performed against four different modalities (Söllinger,
Trung and Uhl 2018). These being fingerprint, face, voice, iris.
For measuring the performance of spoof attacks on a given biometric system, the
FMR and the FNMR need to be calculated first. This is to be done for the threshold value (t)
so as to find out the Half Total Error Rate or HETR. Thus the HETR can be:
HETR (t, D) = (FMR (t, D) + (FNMR (FNMR (t, D))
Similarly, the minimum Weighted Error Rate (WER) can be created by focussing on
the Ddev.

11DERIVATION OF METRICS USED IN BIOMETRICS
Next for every user input, the biometric system takes two separate components. These
are the expected performance and the spoofability curve. These two components can be
combined together in the fusion.
To determine the feasibility of spoof attacks on the biometric systems three error rates
are used – the FMR, the FNMR and SFAR. The SFAR is the Spoof False Acceptance Rate
and it refers to the spoof attacks that are falsely accepted by the biometric authentication
system.
Windows Login with Digital Persona
Digital Persona is the fingerprint reading application for Microsoft Windows and is
used by several laptops and devices that use both 32 and 64 bit Windows based operating
systems from Windows 7 onwards. The application is responsible for enabling fingerprint
authentication support if appropriate sensors are included in the system. The software
provides the following list of features –
One Touch Logon: Increases security and convenience through adding of fingerprint based
authentication in the Windows logon procedure.
One Touch Lock/Unlock: provides the ability of locking the computer after double clicking
the notification icon and then unlocking the same with fingerprint.
One Touch Internet: Provides the ability of logging into application and internet sites with
the fingerprint. This negates the need of remembering multiple passwords and the steps are
guided by the Fingerprint Creation Logon Wizard.
Fingerprint Logon Manager: This is the one stop command center which lets people create,
edit as well as delete the fingerprint logins and account data.