Technology Review - Published By MIT
Log in to My.TechnologyReview.com | Register
Advertisement

December 2005

Changeable Fingerprint

If someone steals your fingerprint, "cancelable biometrics" software from IBM can issue a new one.

By David Talbot
smaller text tool iconmedium text tool iconlarger text tool icon

Your fingerprints are yours and yours alone, and that makes them a useful tool for confirming the identity of people doing things like conducting secure banking transactions or passing through corporate security checkpoints.

Trouble is, it's theoretically possible for a hacker to break into the software of, say, an employer, steal a copy of your stored fingerprint, and later use it to gain entrance.

So researchers at IBM have come up with "cancelable biometrics": if someone steals your fingerprint, you're just issued a new one, like a replacement credit card number.

The IBM algorithm takes biometric data and runs it through one of an infinite number of "transform" programs. The features of a fingerprint, for example, might get squeezed or twisted. A bank could take a fingerprint scan when it enrolls a customer, run the print through the algorithm, and then use only the transformed biometric data for future verification.

If that data is stolen, the bank simply cancels the transformed biometric and issues a new transformation. And since different transformations can be used in different contexts -- one at a bank, one at an employer -- cross-matching becomes nearly impossible, protecting the privacy of the user.

Finally, the software makes sure that the original image can't be reconstituted from the transformed versions. IBM hopes to offer the software package as a commercial product within three years.

December/January 2005

Would you like to read more articles from the December/January 2005 issue?

This article is from the December/January 2005 Issue of Technology Review. To read other articles from this issue simply register for My.TechnologyReview.com. It's free.

Subscribe today and save up to 41% »

Comments

  • Reengineering
    Guest (Dr. Madan M Aingh Aulakh) on 01/04/2006 at 2:35 AM
    Posts:
    1
    This technology would go a long way in protecting besides the person, the corporate world by preventing unwanted access to data whose theft today amounts to a sizable chunk of resources going down the drain
    Rate this comment: 12345
  • Reengineering
    Guest (Dr. Madan M Aingh Aulakh) on 01/04/2006 at 2:35 AM
    Posts:
    1
    This technology would go a long way in protecting besides the person, the corporate world by preventing unwanted access to data whose theft today amounts to a sizable chunk of resources going down the drain
    Rate this comment: 12345
  • Hacked Finger Prints.
    Guest (tony) on 01/04/2006 at 10:21 AM
    Posts:
    1
    But what can they do if someone hacks (as in cuts off) your finger and keeps it warm and soft and just brings it with them wherever they go to gain access / entry..? www.SecondChanceCritic.com
    Rate this comment: 12345
    • hacked finger prints
      Guest (bil) on 01/04/2006 at 11:10 AM
      Posts:
      1
      most biometric sensors require &quotnatural capacitance&quot to be present in the biometric subject...the finger must be living. Optic sensors could be fooled with thin slip-on fingerprints (like a ridged condom in the pattern of a authorized users fingerprint)but Sub-dermal sensors would prevent this.
      Rate this comment: 12345
    • hacked finger prints
      Guest (bil) on 01/04/2006 at 11:10 AM
      Posts:
      1
      most biometric sensors require &quotnatural capacitance&quot to be present in the biometric subject...the finger must be living. Optic sensors could be fooled with thin slip-on fingerprints (like a ridged condom in the pattern of a authorized users fingerprint)but Sub-dermal sensors would prevent this.
      Rate this comment: 12345
    • Hacked Finger prints
      Guest (Ed) on 01/04/2006 at 1:58 PM
      Posts:
      1
      Technology exists to sense a pulse in fingers.  Therefore, a bloody stubby finger piece would not register a pulse and not aunthenticate. 

      However, nothing is to say that you couldnt be drugged with ruffies and dragged to the nearest biometric ATM for cash.
      Rate this comment: 12345
    • Hacked Finger prints
      Guest (Ed) on 01/04/2006 at 1:58 PM
      Posts:
      1
      Technology exists to sense a pulse in fingers.  Therefore, a bloody stubby finger piece would not register a pulse and not aunthenticate. 

      However, nothing is to say that you couldnt be drugged with ruffies and dragged to the nearest biometric ATM for cash.
      Rate this comment: 12345
  • Hacked Finger Prints.
    Guest (tony) on 01/04/2006 at 10:21 AM
    Posts:
    1
    But what can they do if someone hacks (as in cuts off) your finger and keeps it warm and soft and just brings it with them wherever they go to gain access / entry..? www.SecondChanceCritic.com
    Rate this comment: 12345
  • Transformed fingerprints
    Guest (Maxine Mark) on 01/04/2006 at 12:27 PM
    Posts:
    1
    If a fingerprint is &quottransformed&quot biometrically, then it is not ones individual, &quotactual&quot fingerprint, but a different one? How then will the traffic in fingerprints be any superior to issuing #s and new cards?
    Rate this comment: 12345
    • Re: Transformed fingerprints
      Guest (Chris) on 01/04/2006 at 4:52 PM
      Posts:
      1
      If a fingerprint can be transformed biometrically, then we can have an &quotid&quot stored in a system like #s and cards, but now we dont have to bring those with us, in order to use the technology, making it superior.  We are not likely to leave our fingers behind on a subway, or have our fingers taken from us without our knowledge.  Someone with a good memory cant just look at our finger and then type it into some internet site later.  Changing the way the print is registered with different systems makes it so that someone working for one system cant steal the key associated with the finger and use that on another system programmatically.  For these reasons and others, it is superior
      Rate this comment: 12345
    • Re: Transformed fingerprints
      Guest (Chris) on 01/04/2006 at 4:52 PM
      Posts:
      1
      If a fingerprint can be transformed biometrically, then we can have an &quotid&quot stored in a system like #s and cards, but now we dont have to bring those with us, in order to use the technology, making it superior.  We are not likely to leave our fingers behind on a subway, or have our fingers taken from us without our knowledge.  Someone with a good memory cant just look at our finger and then type it into some internet site later.  Changing the way the print is registered with different systems makes it so that someone working for one system cant steal the key associated with the finger and use that on another system programmatically.  For these reasons and others, it is superior
      Rate this comment: 12345
  • Transformed fingerprints
    Guest (Maxine Mark) on 01/04/2006 at 12:27 PM
    Posts:
    1
    If a fingerprint is &quottransformed&quot biometrically, then it is not ones individual, &quotactual&quot fingerprint, but a different one? How then will the traffic in fingerprints be any superior to issuing #s and new cards?
    Rate this comment: 12345
  • Biometrics
    Guest (edwinang@ncs.com.sg) on 01/25/2006 at 12:00 AM
    Posts:
    1
    Interesting development
    Rate this comment: 12345
Add New Thread

Related Articles
Advertisement

Current Issue

Technology Review September/October 2008
How Obama Really Did It
Social technology helped bring him to the brink of the presidency.
•  Subscribe
Save 41%
•  Table of Contents
•  MIT News

Magazine Services

•  Gift Subscription
•  Digital Subscription
•  Reprints, Back Issues, Customer Service

Career Resources

Visit the Job Board and Resource Center to move your career to the next level.

MIT Technology Insider

Stories and breaking news from inside MIT about the latest research, innovations, and startups--in a convenient monthly e-newsletter. Subscribe today

Follow us on Twitter

Twitter

Get Technology Review updates via the web, cellphone, or Instant Messager – Follow techreview on Twitter!
Advertisement

More Technology News from Forbes

Wire Stories

Advertisement
Advertisement
Advertisement
TECHNOLOGY RESOURCES
Advertisement
MIT Massachusetts Institute of Technology