Biometric Authentication
1. Overview
Definition: Biometric authentication probabilistically decides that "this person is indeed who they claim to be" by capturing an individual's unique physiological traits (biometric data) — fingerprint, face, iris, vein — or behavioral traits such as signature, gait, or typing rhythm with a sensor, characterizing them, and comparing them against a pre-enrolled reference template.
User authentication is traditionally classified into three factors: "something you know (knowledge — passwords, PINs)," "something you have (possession — OTP tokens, smart cards)," and "something you are (inherence — biometrics)." The first two share a fundamental limitation: they can be handed to others (transferable), lost or leaked, and forgotten. Passwords are stolen through phishing, tokens are misplaced, and users pay endless reset costs. Biometric authentication emerged to make the person "themselves" the key, providing authentication that need neither be carried nor memorized.
The direct driver behind the explosive spread of biometrics was the expansion of the mobile, fintech, and contactless economy. As fingerprint and face unlock reached billions of devices, biometrics moved beyond specialized security domains to become an everyday means of authentication, taking root as the core mechanism for identity verification (eKYC) in non-face-to-face account opening, simple payments, and electronic signatures. Yet one property differs decisively from passwords: a password can be changed when leaked, but a fingerprint or iris cannot. This "non-revocability" makes biometrics a double-edged sword — convenient yet dangerous. From a Professional Engineer's perspective, biometrics is therefore not a mere "convenient unlock" but a subject whose design must jointly address three axes: the nature of probabilistic decisions (the error-rate trade-off), defense against presentation attacks, and the protection of non-revocable biometric data.
Background and necessity
As fatigue with password-based authentication accumulated, the commercialization of smartphone fingerprint sensors in 2013 and the popularization of face authentication in 2017 created a mass turning point toward "authentication without possession or knowledge." At the same time, growing demand in finance and the public sector to verify identity without visiting a counter institutionalized eKYC, which combines photographing a physical ID with biometric matching. Biometrics is thus a product of an environment that demands frictionless user experience (UX) and strong identity proofing simultaneously.
What biometric authentication requires of a trait
For a physiological or behavioral trait to serve authentication, it must satisfy several requirements. Everyone must possess it (universality), it must differ sufficiently between people (uniqueness), it must remain unchanged over time (permanence), and it must be measurable by a sensor (collectability). For real operation, performance, acceptability, and resistance to circumvention are also considered. Fingerprints and irises are widely used because they satisfy these requirements evenly, while behavioral traits such as gait and typing remain supplementary because their permanence and uniqueness are relatively weak. In other words, a modality's fate is a function of how well it meets these requirements.
Defining the problem from a Professional Engineer's view
In an essay answer, describing biometrics merely as "logging in with a fingerprint or face" is a failure. The essence lies in integrating into a single architecture: ① that biometrics is a probabilistic decision in which acceptance/rejection hinges on a threshold (the fundamental difference from deterministic password comparison), ② the necessity of presentation attack detection (PAD/liveness) that filters out forged samples, and ③ template protection and privacy for data that cannot be reissued when leaked.
2. Authentication principle and system architecture
A biometric system is broadly divided into an Enrollment stage and an Authentication (Verification/Identification) stage. In enrollment, a biometric sample is captured, features are extracted, a reference template is created, and it is stored in a secure store; in authentication, a newly presented sample is characterized the same way and its similarity to the stored template is computed. The overall diagram below shows the two stages and their core components.
flowchart TD
subgraph ENR["Enrollment"]
S1["Biometric sensor capture"] --> Q1["Quality check + preprocessing"]
Q1 --> F1["Feature extraction"]
F1 --> T1["Reference template creation"]
T1 --> DB["Protected store (TEE/HSM, encrypted)"]
end
subgraph AUT["Authentication (Verification/Identification)"]
S2["Biometric sensor capture"] --> PAD["Presentation attack detection (PAD/Liveness)"]
PAD --> Q2["Quality check + preprocessing"]
Q2 --> F2["Feature extraction"]
F2 --> M["Matching (similarity score)"]
DB --> M
M --> D{"Threshold comparison"}
D -->|"score >= threshold"| OK["Accept"]
D -->|"score < threshold"| NO["Reject"]
end
Here, authentication splits into two operating modes. Verification (1:1) decides "are you the ID you claimed?" and compares against only one stored template; phone unlock and login belong here. Identification (1:N) decides "who are you?" by comparing against many templates to find a match; criminal-investigation fingerprint matching and airport border face recognition are representative. Because 1:N multiplies the number of comparisons by N, errors accumulate, so even with the same sensor it requires a far more conservative threshold and tighter quality control than 1:1. For instance, even if each individual FAR is one in a million in a one-million-person database, the expected number of false matches in a single query approaches one — the crux of 1:N design.
The core components are the sensor (capture), signal processing (preprocessing/quality assessment), feature extractor, matcher, decision (threshold), and store. Among these, feature extraction converts the raw biometric image — rather than storing it as is — into a feature vector that is hard to reverse (e.g., fingerprint minutiae, a face embedding vector), reducing storage while forming a first line of defense that makes original-image reconstruction difficult. Still, since research has reported partial reconstruction of originals from embeddings, one must not conclude that feature extraction alone guarantees privacy.
The location and protection level of the store govern overall security as a design variable. Massing templates on a central server, as in the past, makes a single point of failure where one breach leaks every user's biometric data, so modern mobile devices confine templates and matching computation inside a Trusted Execution Environment (TEE)/Secure Enclave isolated from the main OS, so that even a compromised app or OS cannot reach the biometric data. For example, a smartphone's fingerprint or face data is not passed to the application processor but compared only inside a dedicated security chip, which returns outward only a "match/no-match" result. Thus the safety of biometrics depends heavily not only on algorithmic accuracy but on the architectural decision of "where the biometric data resides and where it is compared."
3. Performance metrics and the error-rate trade-off
The most essential property separating biometrics from passwords is that decisions are not deterministic but probabilistic. Because even the same finger produces a different image each time depending on sweat, angle, and pressure, the system judges not "exact match" but "sufficiently similar?" by a threshold. As a result, two kinds of error inevitably arise, quantified by the metrics below. The following process diagram shows how an input sample is scored and split into the two error distributions.
flowchart LR
IN["Presented sample"] --> SC["Compute matching-score distribution"]
SC --> GEN["Genuine score distribution"]
SC --> IMP["Impostor score distribution"]
GEN --> TH{"Set threshold T"}
IMP --> TH
TH -->|"raise threshold"| SEC["Stronger security: FAR down, FRR up"]
TH -->|"lower threshold"| USA["Stronger convenience: FRR down, FAR up"]
SEC --> EER["Point where the two errors meet = EER"]
USA --> EER
A. FAR and FRR — the tension between security and convenience
The False Acceptance Rate (FAR) is the rate of wrongly accepting a stranger as the genuine user, a critical error directly tied to security incidents. The False Rejection Rate (FRR) is the rate of wrongly rejecting the genuine user as a stranger, inconveniencing users and driving service abandonment. The two errors are bound by a single threshold and stand in a trade-off: reducing one enlarges the other. Raising the threshold judges more strictly, so FAR falls but FRR rises; lowering it does the reverse.
This tension implies that the optimum differs by application. Places where security is paramount — national border control, financial transfers — drive FAR extremely low and tolerate some FRR (retries), while places where convenience matters — annual-pass entry at an amusement park — lower FRR to shorten queues. In other words, a "good biometric system" is not one with zero error but one that lets you choose an operating point suited to that task's risk and UX.
B. EER and the DET curve, plus enrollment/acquisition failure rates
Plotting FAR and FRR as the threshold varies, there is a crossing point whose error rate is called the Equal Error Rate (EER), used as the representative single metric for comparing the accuracy of the algorithm itself; a lower EER is better. Overall performance is expressed by the Detection Error Tradeoff (DET) curve, which plots FAR against FRR on log axes and grounds the choice of operating point.
In the field, these two metrics alone are insufficient. The Failure to Enroll (FTE) rate refers to the proportion who cannot be enrolled at all — a worker with worn fingerprints or a cataract patient — while the Failure to Acquire (FTA) rate refers to the proportion whose sample capture itself fails for insufficient quality at authentication time. If FTE/FTA are high, no matter how good FAR/FRR are, an inclusion problem arises where "some users simply cannot use it." In fact, in some occupations where skin roughens, fingerprint FTE is reported to reach several percent, in which case a fingerprint-only design structurally excludes that group. The table below summarizes the key metrics and their design implications.
| Metric | Meaning | Problem when high | Design implication |
|---|---|---|---|
| FAR | Accept stranger as genuine | Security breach (unauthorized access) | The higher the security, the smaller the required value |
| FRR | Reject the genuine user | User inconvenience/abandonment | An alternative (fallback) authentication path is essential |
| EER | FAR=FRR crossing error rate | Low algorithm accuracy | Metric for comparing modalities/vendors |
| FTE | Enrollment itself fails | Exclusion of marginalized groups | Complement with multiple modalities |
| FTA | Sample acquisition fails | Retry surge/UX degradation | Quality feedback/sensor improvement |
C. Operating-point selection in practice and threshold governance
Even with a good theoretical EER, many services do not operate at the EER point. Finance logins, where security matters, fix FAR far below EER (e.g., FAR 0.001%) and absorb the resulting FRR rise with retries and fallback authentication. Conversely, airport automated border control, where mass throughput is vital, chooses an operating point with lowered FRR to shorten queues while complementing security with PAD and downstream human inspection. Thus the operating point is not a constant set once and done, but an operational parameter re-tuned as attack trends, user complaints, and regulations change.
Accordingly, mature organizations do not hard-code thresholds but separate them as policy and manage their change history. Combined with risk-based authentication, one can implement an adaptive threshold that uses a relaxed operating point in normal times and raises the threshold or demands additional authentication only when risk signals — a large transfer, a new device, an anomalous location — are detected. This is a realistic way to resolve the security-UX tension "differently by situation."
4. Types of biometric data and modality comparison
Biometric data is divided into several modalities by the measured target, each differing in accuracy, cost, acceptability, and forgery difficulty. Fingerprint, based on minutiae, has a good balance of accuracy and cost and is the most widely used, but is vulnerable to latent-print copying and silicone forgery. Face has high contactless, long-range, mass acceptability, suiting border control and CCTV, but is sensitive to lighting, angle, masks, and aging and exposed to photo, video, and deepfake attacks. Iris is a high-precision modality with extremely low error rates thanks to its large pattern information, but needs dedicated infrared equipment and user cooperation. Vein (palm/finger), an internal vascular pattern, is hard to forge and hygienic, so it is used in financial ATMs and access control. Voice enables remote authentication over the phone channel but is weak against recording replay and synthesized-voice attacks. The table below summarizes the reasons and practical implications together.
| Modality | Accuracy | Forgery difficulty | Acceptability/convenience | Main use and practical implication |
|---|---|---|---|---|
| Fingerprint | High | Medium | High (contact) | General first choice; PAD essential against latent/silicone forgery |
| Face | Medium-high | Low | Very high (contactless) | Mass authentication/surveillance; deepfake/photo-attack defense is key |
| Iris | Very high | High | Medium (needs cooperation) | High-security access/national ID; equipment cost burden |
| Vein | High | Very high | Medium | Finance/medical; internal pattern hard to copy |
| Voice | Medium | Low | High (remote) | Call center/phone banking; needs synthesized-voice detection |
| Behavioral (gait/typing) | Low-medium | Medium | Very high (unobtrusive) | Supports continuous authentication/anomaly detection; unfit as sole auth |
Concrete figures vividly show this trade-off. Apple's Face ID, a representative case of smartphone face authentication, has published the probability that a random stranger unlocks the device at about one in a million (1/1,000,000), and the prior-generation fingerprint authentication (Touch ID) at about one in fifty thousand (1/50,000). However, these are the manufacturer's stated false-acceptance (FAR) figures only, with false rejection (FRR) being separate, and the caveat was given that accuracy drops for twins and children under 13. Thus one should not judge superiority by a single figure but read FAR, FRR, and FTE together with the operating environment.
Simplifying modality choice to "the most accurate is best" misguides the design. Iris is accurate but, due to cost and cooperation burden, unfit for mass smartphone devices, while face is weak against forgery but its contactless UX is overwhelming, so it is adopted in airport automated border control (e.g., Korea's Smartpass) and mobile. In other words, a modality must be chosen as a function of the task's risk level, operating environment, user inclusion, and cost. For this reason, designs that combine multiple modalities and multiple factors — fingerprint + face, biometric + PIN — to mutually complement a single modality's weaknesses (FTE, forgery, environmental sensitivity) are becoming the norm.
Presentation attacks and presentation attack detection (PAD)
The threat unique to biometrics is the presentation attack. It is an attempt in which an attacker presents an artefact — a silicone finger, a high-resolution photo, a 3D mask, a recorded or synthesized voice, a deepfake video — to the sensor to be authenticated as someone else. The technology that filters these out is Presentation Attack Detection (PAD) or liveness detection, which detects signals of a "live, real body" such as blood flow, body temperature, pupil response, micro-movement, skin texture, and 3D depth. PAD is divided into active (instructing the user to blink or turn the head) and passive (analyzing texture and reflection in the background). The international standard ISO/IEC 30107 series defines PAD terminology, measurement, and reporting, quantifying attack-sample detection performance with APCER (rate of misclassifying an attack as genuine) and BPCER (rate of misclassifying a genuine as an attack). In finance and electronic signature, biometrics without PAD must effectively be regarded as defenseless.
The risk of presentation attacks is asymmetric by modality. Biometric data easily captured on public channels, such as face and voice, poses a large threat because attack samples can be readily obtained from social-media photos, public videos, and call recordings, whereas information such as palm vein that is inside the body and cannot be captured contactlessly makes the very fabrication of an attack sample difficult. This asymmetry explains why financial ATMs choose vein and mass devices choose face while varying PAD strength. Ultimately PAD design must start from a threat model of "how easily can an attacker obtain that biometric data."
5. Deep dive: template-protection standards and responses in the FIDO and deepfake era
The latest issue around biometrics converges on "how to protect non-revocable biometric data." A password can be reset if leaked, but if a fingerprint template leaks, that person can never safely use that fingerprint again. The core concepts addressing this are Cancelable Biometrics and Biometric Template Protection. By applying a different non-invertible transform per user and service (e.g., Bloom filter, random projection) to the original features before storage, one can "reissue" a new template by replacing only the transform parameters when leaked, and a leak at one service does not propagate to another (unlinkability). Fuzzy Vault/Fuzzy Extractor derive a stable key from a noisy biometric value and combine it with a cryptographic key. This area is defined by the international standard ISO/IEC 24745 (biometric information protection), which presents irreversibility, unlinkability, and renewability as core properties.
The second axis is the "no-biometric-transmission" architecture based on FIDO2/WebAuthn. The past approach of massing biometric templates on a central server was a single point of failure for mass leaks. The FIDO camp performs biometric matching locally only inside the device's secure region (TEE/Secure Enclave) and registers only a public key — not biometric data — on the server. Because biometric data never leaves the network, a server breach does not translate into a biometric leak. Authenticating a passkey with a smartphone fingerprint or face follows this structure, a representative case where biometrics and public-key cryptography combine to secure phishing resistance and privacy simultaneously (see related topics [[passkey-fido2]], [[decentralized-identity]]).
A representative industrial case combining these two axes is airport automated border control and non-face-to-face finance. Korea's Incheon Airport Smartpass and automated border gates compare passport information against the on-site face 1:1 while filtering photo/mask attacks with PAD, leaving final responsibility to a human inspector to disperse false-match risk. In non-face-to-face account opening (eKYC), the authenticity of the photographed ID, the match between the ID photo and the selfie, and liveness detection of the selfie (blinking, 3D depth) are combined in multiple stages so that a single-metric failure does not become a total failure. Thus practice builds trust not through "perfect single authentication" but through the overlapping of several imperfect defenses.
The third axis is the sophistication of forgery attacks triggered by generative AI. As deepfake faces, synthesized voices, and AI-generated ID photos threaten eKYC and remote authentication, PAD too is evolving into an AI-versus-AI arms race. The U.S. NIST FRVT/FATE benchmark continuously evaluates face and PAD algorithms, providing an objective basis for vendor selection. At the same time, behavioral biometrics — typing rhythm, mouse trajectory, device-holding posture — are continuously measured in the background to verify "is the same person using it throughout the session," and such continuous authentication is spreading in combination with zero trust and anomaly detection (see related topics [[ueba]], [[zero-trust]]). That said, behavioral biometrics are realistically used as an auxiliary signal for risk-based authentication rather than as sole authentication.
6. Considerations and implications
Operating-point (FAR/FRR) design is a matter of risk management, not just security: The success of biometric adoption hinges less on algorithmic accuracy than on "where to set the threshold to match the task's risk." High-value transactions choose a low FAR, mass entry a low FRR, but an alternative authentication path (PIN/OTP) for legitimate users rejected by FRR must be designed together. Sole reliance on biometrics excludes marginalized groups with FTE/FTA, which is risky from an inclusion standpoint as well.
Template protection and distributed storage premised on non-revocability: Since biometric data is unrecoverable once leaked, storing raw images must be prohibited, cancelable transforms and template protection (ISO/IEC 24745) applied, and, where possible, biometric data separated from the server through on-device matching like FIDO. Central storage is both a single point of failure and a regulatory risk.
Continuous investment in PAD and deepfake response: Biometrics without PAD is powerless against photos, masks, and synthesized voices. PAD per ISO/IEC 30107 must be made mandatory, and an operational process to periodically retrain and update detection models in step with generative-AI advances must be codified in governance. Non-face-to-face eKYC in particular is the front line of deepfake attacks.
Privacy/legal compliance and trade-offs: Biometric data is sensitive information under the Personal Information Protection Act, requiring separate consent and strengthened safeguards for collection and use, and EU GDPR and some regional laws are stricter. The trade-off between convenient mass collection and privacy/discrimination (accuracy gaps by race and age in face recognition) must be controlled at the design stage with Privacy by Design (see related topic [[privacy-by-design]]) principles, with clear purpose limitation, retention periods, and destruction procedures.
Outlook on expansion to multi-factor and linked technologies: The limits of a single biometric modality (forgery, environmental sensitivity, FTE) head toward complement by multi-factor combinations of biometric + possession + knowledge and multi-modality fusion. Furthermore, combined with behavioral-biometric continuous authentication, zero trust, and decentralized identity (DID), the paradigm is shifting from "log in once" to "verify throughout the session," and a Professional Engineer should be able to present the architectural integration with these linked technologies as a mid-term roadmap.
References
- ISO/IEC 30107-3:2023, Information technology — Biometric presentation attack detection — Part 3: Testing and reporting, https://www.iso.org/standard/79520.html
- ISO/IEC 24745:2022, Information security, cybersecurity and privacy protection — Biometric information protection, https://www.iso.org/standard/75302.html
- ISO/IEC 19795-1, Biometric performance testing and reporting — Part 1: Principles and framework, https://www.iso.org/standard/73515.html
- NIST, Face Recognition Vendor Test (FRVT) / FATE, https://www.nist.gov/programs-projects/face-recognition-vendor-test-frvt
- FIDO Alliance, Biometrics and FIDO Authentication, https://fidoalliance.org/
- Apple Platform Security, About Face ID & Touch ID advanced technology, https://support.apple.com/en-us/102381
In one line: Biometric authentication is probabilistic identity proofing that captures non-revocable physiological/behavioral traits and compares them against a template; it must design FAR/FRR/EER operating points to match task risk, defend against forgery and leakage with presentation attack detection (PAD, ISO/IEC 30107), template protection (ISO/IEC 24745), and FIDO local matching, and combine with multi-factor, continuous authentication, and zero trust — a core authentication technology of the contactless era.