Griaule Biometrics

Maybe my question goes into the same direction as Lins:
I actually start to evaluate the free SDK. My question is, if I can assure my clients, that the stored fingerprint (=template) data cannot be re-engineered by others.

The use-case is that we have to store the fp-info in a central repository in order to be able to perform sample checks in future, if a person indeed is identical to the one who delivered the fingerprint once ago.
Anyway, it is not appropriate to tell my clients that I store something like a bitmap of their personal fingerprints, which could be used for several unauthorized manipulations in future.

For this usecase it would be sufficient if we only stored something like a checksum that assures by a certain probability (1:10000 would be enough) that no other individuals fingerprint was used to produce this checksum.

The main objective would be to assure any user that he can savely deliver his personal biometric data for the aimed purpose.

Thank you for answering in advance.

Matthias

I'm testing this feature, to replace the old application for a new linux App.
(Replacing ASP for PHP + JAVA).
My old app stores the FP data, not the image and I'm having problems trying
to use the MatchingContext Object.

The app structure is like this:

1) A HTML page with the Secugen Hamster III object captures the fingerprint data and sends this alogn with the identifier.

2) A PHP Web page recieves this information and get the data fo the ID used in the HTML page from my oracle database.

3) I create the reference template and the template with these two FP data.

4) I compare this using:
prepareForIdentification (template) and
identify (referenceTamplate)

What I get is Unknown error.

The templates created are not Images, but the FP data. Is there any problem?

I need to know these to convence my Gov Institution to buy it!

Thanks beforehands!

Hello folks.

Lin:
Our SDK does not compare fingerprint images directly. They're are used only during the capture.

Given an image, grExtract() finds it's minutiae (the "key components") and creates a template with them, which is what you will actually store in your DB

That is, you do not store raw fingerprint images.

Matthias:
About re-engineering: Yes, it's possible, and you have tools available for that.
Fingerprint images are not as straightforward to compare as strings, numbers, etc, and, therefore, can't be sorted, indexed or checksummed, and you do need to store, at least, it's most important features (minutiaes), which might be used for re-engineering.

Yet, I don't really think this should be viewed as a major security concern. When you have to store sensible information, all you need to do is to secure your database.
That's what banks do, and people are not afraid of giving their money. :)

Virnemi:
I'm not sure I've fully understood your application, but I can guess a little:

You're using "Secugen Hamster III object" for capturing.
What you mean by that? You're using our SDK with a Hamster III, or you're using Secugen's SDK?
It sounds to me that you're using Secugen's SDK.
If that is the case, their templates (FP data) are not compatible with ours, and are likely to cause weird (unknown) errors.
You have 3 options to fix that:
a) Send the fingerprint image to your server, and let it create a template in our format.
This is likely to take too much bandwidth and to overload your server, but is a option.
b) Use their SDK on the server (I deslike this option for obvious reasons)
c) Use our SDK on client for capturing. It will support many more fingerprint readers,
and will produce the templates in the right format. This is my favorite choice.

If this is not what you mean't, that means you're missing some step, but it's unclear to me which one.
The steps are:
* Fingerprint Image is captured.
* You use it to create a template (fp data) with grExtract. No Errors yet, right?
* You send that template over your HTTP Connection.
* The server receives the template. No data corruption? It must be transmitted in binary mode!
* The server uses the template on prepareForIdentification() and identify().

Regards
Paulo Costa
Griaule Biometrics

:lol: Paulo, thanks for your explanation and yes, you get it right.

My legacy application uses Secugen SDK for identification and matching context. It stores some string in my database.

So, I'll throw it away and start from ZERO mark.

Thanks a lot!

Virgílio Nemi