Vulnerability

The aliveness detection in biometric technologies became a serious and disturbing issue after publishing in 2002 the experiment results done (much earlier) in the Fraunhofer Research Institute (Darmstadt, Germany) in collaboration with the Federal Office for Information Security BSI (Germany) [1] with well-established face, fingerprint and iris recognition systems. The experiments highlighted an alarming lack of anti-spoofing mechanisms in devices already protecting many sensitive areas all over the world.

The situation became more serious, where the first systematic experiment of iris spoofing was carried out by Tsutomu Matsumoto of Yokohama National University, Japan, and presented in London in 2004 [2]. Three cameras were used in the experiment, namely OKI IrisPass-h, Panasonic Authenticam ET100 and OKI IrisPass-WG. The fake printouts were made with color laser printer, and the images were captured twofold: by way of Panasonic ET100 camera, which produces iris images of relatively poor quality, and using a digital microscope equipped with an infrared illuminator. Both the enrollment and the verification stages were tested. Only IrisPass-WG did not enroll fake irises. All three tested cameras accepted the fake printouts at the verification stage. This enforced the need for aliveness detection methodology to be quickly introduced to the commercial equipment, stressed the need for the research on fake resistive iris recognition.

NASK Biometric Laboratories team had repeated the Matsumoto experiments with ET100 (purchased in 2003) camera, confirming the claim that ET100 is relatively easy to be fooled by simple printouts of at least 600 dpi resolution. Additionally, testing of Panasonic ET300 camera (purchased in 2004) was performed, which depicted that also this camera accepts fake irises.

Databases

Presently, there is no publicly available databases of images (or other measurements) of iris counterfeits. Such databases are, however, essential for developing anti-spoofing methods. To prepare such a base, the printouts of eye images using different printing color depth and printout carriers (matt and glossy paper as well as a transparent foil) were prepared for 29 volunteers. Figure 1 presents examples of iris printouts collected in our database (full resolution version).

Figure 1. Example printouts on different carriers (from left to right: matt paper, glossy paper and transparent foil) which were used to test the commercial equipment and anti-spoofing methods.

All the volunteers contributed to the development database, while six of them, randomly chosen, were asked for the second session of iris measurements to finally form the evaluation database. The base was used to test and compare the results of aliveness detection implemented in commercial equipment and those proposed in the Labs. In all printouts prepared, a small hole is made in place of the pupil, as such a trick is typically sufficient for fake iris capture by commercial systems.

From Eye Image to Actual Eye

The eye printouts make a quite straightforward iris forgery. As revealed in our tests, the leading iris biometric cameras have difficulties in differentiating between the fake and alive eyes even if a low cost printout of low resolution is used as an eye imitation. We found out that eye images using other carriers like mobile phone or laptop LCD displays of sufficient resolution, were rejected due to low matching score. To complement the list of possible eye printouts, one may imagine a special holographic image imitating spatial eyeball features.

Next step in iris forgery would be a preparation of an eye movie, which simulates the real eye behavior (like blinks, pupil dynamics, eyeball movements, etc.). Naturally, such a movie with a fixed scenario is relatively easy to eliminate, e.g., by requesting and measuring a particular eye behavior. On the other hand, the attacker may be able to react on-line to certain requests; hence additional anti-spoofing methods must be applied.

Going further into counterfeit complexity, we may consider an artificial eye presented behind the camera lens. The iris pattern may be printed on a plastic or rubber eye model, whose constrictions and dilations may additionally imitate pupil diameter changes and a natural behavior of the iris meshwork during accommodation. Finally, the living eyemay be the carrier for artificial contact lens with the iris pattern printed.

One of the most sophisticated ‘forgery’ of the iris camera is simply the use of a real eye. Although the use of non-living organ may have a bit drastic tinge, this cannot be excluded with the iris biometrics increase of its strength and position in automatic authentication.

At the end we reach the last possibility, namely a forced use of one’s eye against owner’s will. While this is very difficult to detect, we propose a pupil dynamics approach, which is hoped to also react to a level of stress while authenticating the iris. However, additional research towards a link between the pupil dynamics and our psychological state is unavoidable.

Countermeasures Against Iris Forgery

There is a need for the iris counterfeit classification as well as for a systematic approach to the subterfuge prevention. Some issues regarding the iris aliveness were already addressed by Daugman [5,6]. Here we classify a few variants of iris counterfeits detection into several groups, characterized by the increasing level of the method sophistication.

The first group of anti-spoofing methods employs the external eye features. This may be realized either in a passive or in an active way. The first subgroup – passive measurements – relies on characteristics of the living eye as opposed to artificial objects. These may include a smoothness of the frequency spectrum typically obtained for images of live organ. The same frequency analysis reveals dominating frequencies, which may indicate that the iris image was altered in a regular way, e.g., by printing using a raster device. Increasing the measurement dimensionality, one may check the 3D eye structure, like its spherical shape. The human eyeball has a fixed and stable shape, and knowing its parameters one may employ simple reflection mechanisms to assert the 3D shape of the measured object. In turn, the active measurements bring a possibility to check certain eye characteristics in real time, with a limited possibility to be guessed by the attacker. This, as an example, includes the analysis of inflicted infrared light reflections from the moist cornea.

The second group of countermeasures to iris spoofing includes the methods examining the internal eye structure. Two Daugman’s propositions may be classified into this countermeasure class, namely the analysis of the eye tissue at different wavelengths and analysis of the so called Purkinje reflections [6]. Since the melanin pigment responsible for the eye color has a specific infrared light absorption profile, this may be used to distinguish between a live tissue enriched with melanin and e.g., the glassy eye imitation free from organic elements. On the other hand, the Purkinje reflections are difficult to be observed, and typically only two out of four are clearly visible, Fig. 2. To robustly observe all four, the high quality of images, partially guaranteed by an adequate depth-of-field of the optical system, is required. All four Purkinje reflections are clearly visible on a few percent of images observed in various publicly available databases, as well as in our local database of iris images. This may prevent the method from the expected reliability.

Figure 2. Example of two pairs of Purkinje reflections (image captured with IrisCUBE device as developed in the Labs).

Finally, yet importantly, the third group of possible anti-spoofing mechanisms is based on dynamic (i.e. behavioral) eye features. Again, similarly to the previous group, one can perform the measurement passively or actively. It was suggested in literature [5,6] that the human pupil oscillates constantly with the approximate frequency of 0.5 Hz, even in a uniform lighting conditions. This phenomenon, called the hippus, is relatively easy to be passively measured if it is observed for an eye, Fig. 3. However, our tests disclosed that not all eyes reveal a sufficient hippus signal that might be unmistakably distinguished from the noise using the same measuring equipment as that used for iris recognition.

Figure 3. Example of spontaneous pupil diameter oscillation (top line) and the typical pupil diameter reaction to light changes (bottom line) [3,4]. Both measurements were obtained using IrisCUBE device. Frames were collected every 125 ms.

It seems that the dynamic features of the eye observed within certain time horizon should be a result of a certain interaction between the user and the machine. This makes the measurement active. The human-machine interaction may be twofold. The first, command driven reaction, is the consequence of the system request to perform some action by the user requesting to be authenticated. This may include blinks or eye movement forced by an object tracking. However, this kind of interaction may be uncomfortable to the user, since a supplementary training is required besides the one offered prior to the iris biometrics usage. Moreover, this kind of anti-spoofing mechanism is difficult to implement in negative identification systems, i.e. systems aiming at recognizing criminals.

Almost ideal situation is to actively measure those stimulus driven eye dynamic features which are independent of our consciousness, and are not interfering with typical iris recognition process. One of such features is the pupil dynamics. Primarily, the pupil constriction and dilation partially influences the human eye accommodation process, and is classified in psychology as the conditional response. There was a lot of research referring to this phenomenon. It is also widely used in diagnostics of certain neurological disorders. Since early 60’s, there is a research aiming at modeling the pupil reflex as a control system. In 1967 Clynes and Cohn proposed [7] a model of human pupil response to step luminescence changes. The model is different for positive and negative luminescence steps, hence nonlinear. This type of models is employed in this paper even for more general light signals to develop a new automatic method of eye aliveness detection.

Aliveness Detection Methods

Frequency spectrum analysis (FS)

Frequency spectrum seems to be a straightforward source of information concerning the existence of regular artifacts within the image, Fig. 4. The concept of artificial frequencies localization prior to the iris recognition was already suggested in the literature [5,6], however no automatic methodology was proposed to materialize the ideas existed for years.

Figure 4. Image and amplitude spectrum of the living iris (top) and the iris printout (bottom). The latter one reveals “artificial frequencies” as a consequence of the printer abilities.

Frequency spectrum methodology has an important advantage, namely, it requires no additional hardware, since the same static image as used in the iris recognition may be analyzed. On the other hand, the method has a serious drawback, originating from Shanon’s theory. Namely, the method fails once the resolution of the printing device, used for counterfeit preparation is more than twice the resolution of the camera employed in the test.

To assess the level of artificial frequencies, which are the consequence of a limited printer resolution, the frequency ranges which discriminate between the printed area and the live tissue must be defined. The intuition gives a few straightforward solutions:

1. Find such a range of frequencies, starting from, and not including, the DC component, which gives the best differentiation between spectra for fake and alive irises, in terms of the percentage of spectrum contained within the defined range.
2. Just the reverse of 1), fix the amount of spectrum and find such a range of frequencies (starting from the DC component) which maximally differ for alive and fake iris spectra.
3. Apply the approach 1) but for a selected frequency window that does not start from the DC component.

The routine 3) has one degree of freedom more when compared to 1) and 2). Nevertheless, it is more selective in frequency domain and it revealed in the experiments a higher accuracy than the methods 1) and 2).

Controlled light reflection analysis (CLR)

The idea of stimulated light reflection analysis is derived from the assumption of the eyeball spherical shape and the cornea moistness. To implement the method, IrisCUBE has two supplementary NIR diodes embedded, placed horizontally and equidistantly to the camera lens. Although the number of diodes is arbitrary, the position of reflections should be chosen carefully. Note that the commercial devices accept fake images with a hole in place of the pupil, thus reflections within the pupil do not improve the aliveness detection accuracy. Moreover, to stimulate the reflections, one should select the eyeball regions that are unlikely to be covered by eyelids and eyelashes, since only then the reflections can be observed.

For two supplementing diodes we obtain four possible reflection states, which may be observed when the iris is captured, Fig. 5 (additional central reflection is clearly visible as an effect of already existed infrared illuminator implemented for iris recognition purposes). One, however, can imagine rather arbitrary number N of supplementary diodes, set on and off randomly, thus generating 2^N possible states.

Figure 5. Four possible states of infrared stimulated reflections observed for the developed setup.

Laplacian of Gaussian filtering is employed in the procedure of reflection localization. The histogram of the filtered image is normalized and the image is transformed into the binary form. The binarization threshold is set at the middle between the average and maximum values, independently for each normalized image. This directly gives the positions of the reflections.

The detected state, identically as the desired states of reflections, is coded by way of three bits. The codes corresponding to the desired and the detected states are then compared using XOR operation. To classify the iris as a live object, the minimum number of corresponding states within the detected and the desired sequences of states was experimentally set to 50%.

Pupil dynamics analysis (PD)

Dynamics modeling

Model of the pupil response to a step light changes is proposed in [7] and consists of two independent channels, defined by transfer functions, whose sum gives the final response, Fig. 6.

Figure 6. A dynamic model of human pupil response to step light changes by Manfred Clynes and Michael Kohn [7]; 'x' denotes the light changes, 'd' denotes the model output (the pupil diameter changes).

The bottom channel contains first order inertia with a lag element. This channel represents long-term, persistent response to luminescence changes. After the step stimuli occurs, this channel answers by setting a new size of pupil diameter with speed according to time constant T₃. The upper channel contains second order inertia with differentiation and a lag element, and is active only for positive luminescence changes (from dark to light). This channel represents the transient response of the pupil. After the positive stimuli has occurred, the answer of this channel increases and then decreases to the zero-level with respect to T₁ and T₂ time constants. The constants K_r and K_i are negative to force the negative response for positive input.

This model explains observed phenomena like asymmetry of the pupil constriction and dilation processes. Figure 7 shows the example response of the model fitted to the actual pupil diameter measurement. The dashed line is the response of the transient part of the model (the upper channel), the dotted line is the response of the persistent part (the bottom channel), while the ragged line is the sum of both channels, i.e. the model output.

Figure 7. Example of model output ('d') fitted to the experimental data. Dotted lines represent responses of the corresponding channels, while the solid line is the model output. Ragged line represents the actual measurement of the pupil diameter.

Feature extraction

Each volunteer contributing to the development database looked into the camera lens, identically as during the iris enrollment or verification procedures. The system waits for 4 seconds to guarantee a stabilization of pupil just after the accommodation process. The LED (emitting visible light) is then lighten-up and the acquisition starts. We recorded 25 frames per second (i.e., a frame comes every 40 ms) and the acquisition time was set experimentally to 4 seconds. This is sufficient to observe the entire pupil reaction to light changes. The experiments were carried out in a real environment, i.e., we admitted a variety of external light intensity as it is typical within the office conditions.

The measurements result in a time series representing changes in the pupil diameter. To differentiate between the alive and fake objects, we define the aliveness features as a collection of the model parameters, namely T₁, T₂, T₃, , , K_r and K_i. Features are extracted by finding the best fitting of the model output to each experimental data series. Well known methodology of model fitting may be applied here.

Classification

For our data, the most distinguishable features are K_r and K_i which correspond to the gain of the channels. This is related to the fact that for counterfeit images, only noise values were registered. This observation suggests to employ two-stages classification mechanism. In the first stage we check whether the observed objects reacts (at all) to light changes. It may be done as simply as verifying box constraints for aliveness features. The second stage aims at verifying whether the observed objects reacts as a human pupil to light changes, and typically it requires nonlinear classification (a two-layer nonlinear perceptron with tangent activation functions in both the hidden and output layers is used in this work with a success).

Results

To test the proposed methods, we used the testing protocol identical as for commercial devices, namely the same office conditions and the same number of attack trials. All parameters of the commercial systems were set to the default values, recommended by the manufacturer. Our tests show (Tab. 1) that for frequency spectrum method (FS), controlled light reflection (CLR), and pupil dynamics (PD) no fake irises were accepted. Also, CLR and PD showed null rejection rate for alive irises. This very favorable compares to commercial equipment: Camera A accepted 73% of fake irises, and Camera B more than 15% fake irises.

Patent application had been submitted on September 7, 2006 for PD aliveness detection method (Polish patent application No. P380581, international patent application No. PCT/PL2007/000063).

Conclusions

The proposed iris aliveness detection methods showed their high potential. We investigated three methods based on analysis of frequency spectrum (FS), controlled light reflection (CLR), and pupil dynamics (PD), using a body of various fake (printed) eye images. The limited accuracy of the FS method may be compensated by their important advantage of no additional hardware requirements, since it shares the same iris image with authentication. On the other hand, implementation of the two remaining methods within the existing equipment is neither complicated nor costly. We suggest also a procedure that joins all three proposed methods, especially for more sophisticated forms of iris counterfeit, e.g., non-living real eye.

Detailed description of the proposed aliveness detection methodologies can be found in [8].

References