Background

In the age of increasing digitalisation, capturing biometric features is a popular method of authentication. Authentication using biometrics offers many advantages over conventional passwords: it is not only more convenient and faster, but also more difficult to forge. Biometric features can also not be forgotten or stolen. But how secure are such biometric systems?

To answer this question, biometric systems (e.g. fingerprint scanners, automatic border control systems, smartphones, 3D cameras) are regularly evaluated at the BEZ in terms of performance (recognition accuracy), security and usability.

To investigate performance and usability, the BEZ began conducting long-term test series in summer 2022. Registered test persons can evaluate the biometric systems on site three times a week in the BEZ's two test rooms. The process only takes a few minutes and is always anonymised. As a cooperation partner and expert advisor on IT security issues, the BSI guarantees the secure collection, storage and processing of data in accordance with the GDPR.

Long-term test series: huge success and unique in Germany

Since the start of the evaluations, over 400 volunteers have already registered as test subjects at the BEZ. Every week, around 100 to 150 test persons come by to test the biometric systems.The BEZ is currently the only institution in Germany where biometric systems can be tested using real test subjects over a period of several months to years, to this extent and in compliance with the GDPR.

Further research focal points:PAD and synthetic characters
In addition to evaluating performance and usability, biometric systems are also analysed in terms of their security, which is referred to as presentation attack detection (PAD). The focus here is on optimising special near-infrared technologies for distinguishing human skin from other materials and researching the use of 3D cameras for forgery detection in facial biometrics.

A relatively new and promising approach in biometrics is the generation of synthetic characters with character generators from the gaming environment. The aim is to use synthetic data as an equivalent replacement for real biometric data. Research in this area is still in its infancy.