1.2.
3 BIOMETRIC FUNCTIONALITIES
A biometric system provides two types of identity management functionalities, namely,
verification and identification.
a) Verification
In verification, the user claims an identity and the system verifies whether the claim is genuine,
i.e., the system answers the question “Are you who you say you are?. In this scenario, the query is
compared only to the template corresponding to the claimed identity (a one–to–one match). The
identity claim is usually made through the use of a Personal Identification Number (PIN), a user
name, or a token (e.g., smart card). If the user’s input and the template of the claimed identity have
a high degree of similarity, then the claim is accepted as “genuine” (authentic, client). Otherwise,
the claim is rejected and the user is considered an “impostor”. Verification is typically used in
applications where the goal is to prevent unauthorized persons from using the services.
Verification is considered as a two–category classification problem:
Given a claimed identity I and a query feature set 𝑿𝑨 ,
we need to decide if (I, 𝑿𝑨 ) belongs to “genuine” or “impostor” class.
Let 𝑿𝑬𝑰 be the stored template corresponding to identity I.
Typically, 𝑿𝑨 is compared with 𝑿𝑬𝑰 and a match score s, which measures the similarity between
𝑿𝑨 and 𝑿𝑬𝑰 , is computed.
The decision rule is given by
where η is a pre–defined threshold.
If a distance score is used in place of the similarity or match score, the inequalities in the decision
rule shown in equation should be reversed.
When the identity claim is deemed to be “genuine”, the user is allowed to access the services
provided by the system.
Figure 1.1 shows the enrollment and recognition phases of a biometric system operating in the
verification and identification modes.
1
Figure 1.1 Enrollment and recognition stages of a biometric system operating
in the verification and identification modes. The dotted line in the verification module
is an optional operation to update a specific user’s template.
2
b) Identification
In the identification mode, the system recognizes an individual by searching the templates of all
the users in the database for a match. Therefore, the system conducts a one–to–many comparison
to establish an individual’s identity (or fails if the subject is not enrolled in the system database)
without
the subject having to claim an identity (e.g., “Whose biometric data is this?”).
Identification functionality can be further classified into positive and negative identification.
In positive identification, the user attempts to positively identify himself to the system without
explicitly claiming an identity. A positive identification system answers the question “Are you
someone who is known to the system?” by determining the identity of the user from a known set
of identities.
In contrast, the user in a negative identification application is considered to be concealing his true
identity (either explicitly or implicitly) from the system. Negative identification is also known as
screening and the objective of such systems is to find out “Are you who you say you are not?”.
The purpose of negative identification is to prevent a single person from using multiple identities.
Hence, screening can be used to prevent the issue of multiple credential records (e.g., driver’s
licence, passport) assigned to the same person or to prevent a person from claiming multiple
benefits under different names. Screening is also often used at airports to verify whether a
passenger’s identity matches with any person on a “watch-list”.
In both positive and negative identification, the user’s biometric input is compared with the
templates of all the persons enrolled in the database and the system outputs either the identity of
the person whose template has the highest degree of similarity with the user’s input or a decision
indicating that the user presenting the input is not an enrolled user.
Formally, the problem of identification can be stated as follows:
Given a query feature set 𝑿𝑨 , we need to decide the identity I of the user,
where
I ∈ {I1, I2, · · · , IN, IN+1}.
I1, I2, · · · , IN correspond to the identities of the N users enrolled in the system
IN+1 indicates the case where no suitable identity can be determined for the given
query.
If 𝑿𝑬𝑰𝒏 is the stored template corresponding to identity In and sn is the match score between
𝑿𝑨 , and 𝑿𝑬𝑰𝒏 for n = 1,2, · · · ,N,
3
The decision rule for identification is,
where η is a pre-defined threshold.
The above decision rule is commonly known as open set identification, because it is possible to
return a result indicating that the user presenting his biometric trait is not among the N enrolled
users.
Almost all practical biometric identification systems (including screening systems) use open set
identification. It is also possible to force the system to return one among the N enrolled identities,
irrespective of the value of sno . Such a scenario is called closed set identification.
In some practical biometric identification systems (e.g., latent fingerprint matching), identification
is semi–automated. A semi–automated biometric system outputs the identities of the top t matches
(1 < t ≤ N) and a human expert manually determines the identity (among the t selected identities)
that best matches the given query. The value of t could be determined based on the availability and
throughput of the human expert(s).