FUNDAMENTALS OF BIOMETRIC SECURITY Module 2

What does PAI stand for in the context of biometric systems?

• Presentation Attack Instrument

• Personal Authentication Identifier

• Physical Authentication Indicator

• Public Access Interface

What is the role of PAD in biometric systems?

• To verify the identity of an individual based on biometric data

• To detect and prevent deceptive attempts to spoof biometric systems

• To improve the quality of biometric samples

• To enhance the storage capabilities of biometric data

What does liveness detection aim to determine in biometric systems?

• The security of stored biometric data.

• The efficiency of biometric data storage and retrieval.

• The interface between biometric hardware and software.

• Whether the biometric sample is from a live person or a static image/model.

Answer explanation

Note:

 

a)      The security of stored biometric data (Incorrect: This relates to data security, not liveness detection)

b)     The efficiency of biometric data storage and retrieval (Incorrect: This pertains to data management, not liveness detection)

c)      The interface between biometric hardware and software (Incorrect: This concerns system integration, not liveness detection)

d)     Whether the biometric sample is from a live person or a static image/model (Correct: Liveness detection is specifically focused on verifying that the biometric sample is from a live person rather than a static image or model.)

 

What is the role of PAD in biometric systems?

• To ensure the biometric data is stored securely

• To handle multiple user enrollments simultaneously

• To detect and counteract attempts to deceive biometric systems using fake or altered biometric samples

• To manage the interface between biometric hardware and software

Answer explanation

Note:

 

a)      To ensure the biometric data is stored securely (Incorrect: This pertains to data security, not PAD)

b)     To handle multiple user enrollments simultaneously (Incorrect: This relates to system capability, not PAD)

c)      To detect and counteract attempts to deceive biometric systems using fake or altered biometric samples (Correct: PAD stands for "Presentation Attack Detection" and is designed to detect and counteract attempts to spoof biometric systems with fake or altered samples.)

d)     To manage the interface between biometric hardware and software (Incorrect: This concerns system integration, not PAD)

 

What does Presentation Attack Detection (PAD) help to identify in biometric systems? (Select all that apply)

• Fake biometric samples used to spoof the system

• Data quality during the verification process

• Encryption of biometric data during transmission

• Presentation attacks like photographs or masks

• Anonymization of biometric data

Answer explanation

Note:

 

a)      Fake biometric samples used to spoof the system (Correct: PAD is designed to detect and reject fake biometric samples)

b)     Data quality during the verification process (Incorrect: PAD focuses on detecting spoofing, not data quality).

c)      Encryption of biometric data during transmission (Incorrect: PAD does not handle encryption).

d)     Presentation attacks like photographs or masks (Correct: PAD identifies and mitigates presentation attacks such as using photographs, masks, or videos.)

e)      Anonymization of biometric data (Incorrect: PAD does not deal with anonymization.)

 

How does a high false match rate (FMR) affect zero-effort attacks in an iris biometric system? (Select one.)

• A high FMR makes the system more secure by preventing unauthorized irises from being accepted.

• A high FMR makes it easier for hackers to use their own iris to be accepted as authorized.

• A high FMR causes frequent rejections, making zero-effort attacks ineffective.

• A high FMR increases encryption, stopping hackers from using their own iris.

• A high FMR improves accuracy by reducing false acceptances of unauthorized irises.

Answer explanation

Note:

b) A high FMR makes it easier for hackers to use their own iris to be accepted as authorized. (Correct: A high FMR means the system is more likely to mistakenly accept unauthorized irises, making zero-effort attacks more successful.)

How do challenge-response methods work for Presentation Attack Detection (PAD) in iris biometric systems? (Select all that apply.)

• Asking the user to blink or move the eye to verify liveness; may need extra hardware.

• Comparing a static iris image to a stored template without user interaction; less effective against advanced attacks.

• Asking for a verbal response to verify the iris; not effective for detecting presentation attacks.

• Matching a fixed set of iris images against the live sample; depends on image quality.

• Using light patterns or stimuli on the eye to confirm liveness; can be complex.

Answer explanation

Note:

a)      Asking the user to blink or move the eye to verify liveness; may need extra hardware. (Correct: This describes how challenge-response methods verify liveness through user actions.)

b)     Comparing a static iris image to a stored template without user interaction; less effective against advanced attacks. (Incorrect: This is not a true challenge-response method.)

c)      Asking for a verbal response to verify the iris; not effective for detecting presentation attacks. (Incorrect: Verbal responses are not used in challenge-response for iris PAD.)

d)     Matching a fixed set of iris images against the live sample; depends on image quality. (Incorrect: This is not a typical challenge-response method.)

e)      Using light patterns or stimuli on the eye to confirm liveness; can be complex. (Correct: This describes how light patterns are used in some challenge-response methods for detecting liveness.)

What is a key advantage of using a hardware-based PAD as an independent parallel module in an iris biometric system?

• It simplifies the system design and reduces hardware but may lower detection accuracy.

• It reduces the need for extra hardware but may cause more false rejections if not calibrated well.

• It makes the system look better but does not impact security or functionality.

• It cuts system costs by sharing resources but can slow down performance.

• It improves security with an extra detection layer but can increase cost and complexity.

Answer explanation

Note:

e) It improves security with an extra detection layer but can increase cost and complexity. (Correct: Using a separate PAD module enhances security by providing an additional detection layer, though it can lead to increased cost and complexity.)

Which methods can hackers use to attack a face biometric system? (Select three correct answers.)

• Using high-resolution photos of the target's face to spoof the system.

• Using a 3D mask or lifelike silicone mask to mimic the target's face.

• Hacking the system's software to bypass authentication checks.

• Playing a prerecorded video of the target's face to trick the sensor.

• Physically damaging the biometric device to make it inoperable.

Answer explanation

Note:

 

a) Using high-resolution photos of the target’s face to spoof the system. (Correct: High-resolution photos can be used to trick systems that don’t account for depth or texture.)

b) Using a 3D mask or lifelike silicone mask to mimic the target’s face. (Correct: 3D masks can deceive systems by replicating facial features in three dimensions.)

c) Hacking the system’s software to bypass authentication checks. (Incorrect: This approach targets the software's security rather than the biometric data itself.)

d) Playing a prerecorded video of the target’s face to trick the sensor. (Correct: Prerecorded videos can deceive systems that lack liveness detection.)

e) Physically damaging the biometric device to make it inoperable. (Incorrect: This targets hardware rather than manipulating biometric data.)

 

How do static and dynamic approaches differ in PAD for biometric systems? (Select all that apply.)

• Static PAD analyzes fixed features and is simpler but may miss advanced attacks.

• Dynamic PAD looks at changes over time and provides better security but may need extra hardware.

• Static PAD handles simple spoofing well but struggles with complex attacks.

• Dynamic PAD checks color changes, making it less effective and not real-time suitable.

• Static PAD evaluates system performance instead of the biometric sample and is less sensitive to data changes.

Answer explanation

NOTE:

a)      Static PAD analyzes fixed features and is simpler but may miss advanced attacks. (Correct: Static PAD focuses on fixed features and is simpler but may not detect sophisticated attacks.)

b)     Dynamic PAD looks at changes over time and provides better security but may need extra hardware. (Correct: Dynamic PAD detects changes over time for better security but may require more resources.)

c)      Static PAD handles simple spoofing well but struggles with complex attacks. (Correct: Static PAD is better for simple spoofing but less effective against complex attacks.)

d)     Dynamic PAD checks color changes, making it less effective and not real-time suitable. (Incorrect: Dynamic PAD is not limited to color changes and is suitable for real-time applications.)

e)      e) Static PAD evaluates system performance instead of the biometric sample and is less sensitive to data changes. (Incorrect: Static PAD focuses on the biometric sample, not overall system performance.)