9
$\begingroup$

RIDGEFIELD PARK, NJ – April 2, 2019 – Samsung Electronics America, Inc. announced that the new, award-winning Galaxy S11 and Galaxy S11+, which have been recognized by smartphone reviewers worldwide for their best-in-class display, design and camera, are now available for purchase at U.S. wireless network providers and retail stores....

The only problem is, they released a camera with combined visible light and thermal imaging capable of taking an accurate picture of a person's retina. You see, I convinced my company to let me buy one for App testing, just to see what it could do. I stopped Dr. Hayworth in the hall and asked if I could take her picture for an upcoming online marketing campaign, and she happily complied.

Then I told her there wasn't a campaign and that I really wanted to test the company's security. She was angry, but not as angry as when we walked to her secure lab and I showed the biometric scanner the image I took of her eyes. Heaven forgive me, but the shade of angry red she turned when the door unlocked was actually really pretty....

At least she backed me up when we went to the executive staff and told them any idiot with one of these phones could walk into every secured part of the building. They were pretty straight-faced when they applauded my initiative — and then they ordered me to contact BioSmart and ask them what we should do about the millions of dollars we spent buying and installing their retina scanners last month.

Ladies and gentlemen, you're the lead engineer at BioSmart Retina Scanners, Inc. The company has scanners installed world-wide, but the world doesn't know (yet) that they can now be beaten by a mischievous 9-year-old.

After getting off the phone with the client and quickly changing his underwear, your CEO invited you to think very quickly about how to deal with a smartphone that can outsmart your 2018 retina scanner. You have 24 hours to come up with a viable idea for salvaging the scanners before he shares his bathroom plumbing frustrations with the whole company.

Question: What ideas do you have to modify 2018 retina scanners to compensate for smartphones that can take pictures of people's retinas and display them with enough precision to fool the scanners?

Non-Narrative Background

  • We're on a near-future Earth.

  • BioSmart's scanning technology exists or is licensed around the world. A failure to find a fix will not only destroy BioSmart Inc., but will have global security ramifications.

  • Existing and near-future technology is allowed. No Clarkean Magic, though. If you can't credibly convince me/us that your solution is viable in, say, less than 10 years, then it's not an answer. (Yes, my storyline says 2019, but that's likely too limiting for useful answers.)

  • We'll skip the economics of fixing the problem, so replacing the old units with new units that solve the problem is OK (even assumed). Yes, this is a bit of fanciful magic, but I'm only interested in the nature of the fix, not how to roll it out.

$\endgroup$
  • 1
    $\begingroup$ We've already been there with iris imaging $\endgroup$ – Alexander Apr 10 '18 at 23:21
  • $\begingroup$ @Alexander, HAH! It's always nice to predict the past. Let's assume that I'm worried about more accurate/capable scanners than can be found in today's smartphones. $\endgroup$ – JBH Apr 10 '18 at 23:41
  • $\begingroup$ Iris scanner was fooled because the hacker was able to simulate the curvature of the eye. Simple imaging (even on a futuristic phone screen) can not do that. $\endgroup$ – Alexander Apr 10 '18 at 23:58
11
$\begingroup$

First of all, let's clear up a myth.

Retina scanning is NOT the most useful form of biometric comparison technique out there; iris scanning is. It's a small point, but from the literature I've read on the subject (primarily while studying biometrics as part of my Masters (I'll admit that's a while back now) iris scanning has two primary advantages over other forms of scanning.

1) The data signature is very small (around 2k of data) - so small it can be almost encoded into one of those smartphone 2D barcode grids

2) VERY tight DET (Detection Error Tradeoff) curve which just means it's highly accurate.

Because irises are effectively muscles that tear as the eye grows through life, you even solve the 'identical twin' problem with DNA scanning. The tears are random. Also, the Iris is sensitve to NIR (Near Infrared) light, meaning that you add a NIR pulse to your flash and it not only contracts the pupil (dilates the iris to make it bigger for the scan) but it doubles as a liveness test. You can't just pluck out someone's eye and put it to a scanner; the NIR pulse wouldn't make the eye react so it would fail the test.

THIS is essentially your answer; take your retinal scanners and convert them with a similar NIR pulse that tests for liveness. This is not done on retinal scanners today because you don't actually want to contract the pupil; you really want it as dilated as possible so you can see through it to the retina. So, take your picture of the retina, and then trigger the flash and test for the iris dilation. Personally, I think you're better off not having bought them in the first place and going with iris scanners instead but admittedly this is a personal preference.

Of course, the next thing that will happen is that smartphones will now come with daylight strength screens. They'll have a lux meter on the front which will test for ambient light levels, and they'll increase screen contrast somehow when you're trying to look at it in broad daylight. When THAT happens, someone will write a little program that will automatically morph your image of an iris into a dilated pupil configuration when the lux meter detects an NIR pulse.

But that, Sir, is a problem for the next generation.

$\endgroup$
  • 3
    $\begingroup$ "Of course, the next thing that will happen is that smartphones will now come with daylight strength screens. They'll have a lux meter on the front which will test for ambient light levels..." I'm pretty sure my 6 year old mid-range smartphone already has that. Screen does seem to adjust to ambient light. Considering it has (rather low quality) forward camera, I really see no reason why it wouldn't. $\endgroup$ – M i ech Apr 10 '18 at 23:52
  • $\begingroup$ Question about iris scanning - if it develops tears over time, does that mean your irises gradually fall out of sync with your stored data? Would you have to re-register them periodically, or does this happen over a long enough timeframe not to bother? $\endgroup$ – Cadence Jun 8 '18 at 6:24
  • 1
    $\begingroup$ @Cadence this is more of an issue when you're growing up; the tears seem to be related to growth of the eye in relation to a child's normal growth pattern so yes; one can assume regular re-registration would be required as the child grows. After growth stops, I understand (but don't have the supporting references) that the tears also stop (for the most part at least) but it would be interesting to make a study out of this before implementing such a biometric technique on a large scale. I don't think there's enough longitudinal data available on this topic yet for verification. $\endgroup$ – Tim B II Jun 8 '18 at 7:16
  • 1
    $\begingroup$ Also, screens emit light, eyeballs reflect it. If you can isolate outside light sources, you can test that by having your scanner run the scan with a combination of specific frequencies of light, and use a spectrograph to determine if the light coming back is the same or a glowing screen. $\endgroup$ – Chronocidal Jun 8 '18 at 12:16
  • $\begingroup$ The scanner could even send random pulses too brief for the screen to change the image, in order to check if it is an actual eye (that would reflect the pulses) or a fake image (who wouldn't have time to adapt to the pulse). Then, you would need something much more elaborate than a simple screen, which would make it out of range of normal smartphone users - until 3D-printing becomes fine enough to print a fake iris with sensors and motors to contract it, but at this point we will probably have something better than iris scan for ID anyway. $\endgroup$ – Eth Jun 11 '18 at 17:58
7
$\begingroup$

Use two cameras on the retina scanners. Phone screens are flat and retinas are not.

Aside from that, phone screens don't display the infrared data in the infrared spectrum, else humans couldn't see it. So, by using infrared cameras in the scanners, the phone screen will appear a uniform temperature, with none of the thermal detail of a retina.

$\endgroup$
  • $\begingroup$ Dang... I didn't think through the fact that the displays aren't infrared. Duh. Let's ignore that and see what improvements we can make nonetheless. $\endgroup$ – JBH Apr 11 '18 at 0:08
  • $\begingroup$ Combine this with (Tim B II's answer)[worldbuilding.stackexchange.com/a/109161/47510] - Two images (retina and iris) each from two cameras, then use the parallax difference to work out the depth of the eyeball? $\endgroup$ – Chronocidal Jun 8 '18 at 12:06
1
$\begingroup$

Biometry such as the one you propose is based on pattern recognition. It doesn't take a genius developer to make the machine recognize what is around an iris is a handheld device, not a human head. The system may just as easily be programmed by the manager's nephew to sound an alarm and call security if you try to be a smartass.

If someone tried to pull that move, they would just be showcasing how foolish they are. If however they try it and succeed, all it does is revealling that some coder who has just learned about biometrics was being paid by line of code written, not by productivity. Next patch will certainly fix this asinine bug, and the company who did this will receive a homage at TheDailyWTF.com, an older creation from the same minds behind this very site here, whose only purpose is to record and mock the work of incompetent coders.

You would have an easier time trying to trick fingerprint scanners, which usually cannot look around the mark they have to scan. But I doubt you would find one that you could fool with a cell phone.

$\endgroup$
1
$\begingroup$

Today's images as ones being publicized in a press release (which means: publicly available!) already have a resolution high enough to fool iris scans. Retina scans might be a bit more difficult since it actually requires to shine some (infrared) light into the eye to get a clear picture, but a "nightshot" mode on tomorrow's smartphones may actually provide it.

So we're not just talking about a "what if", but a distinct possibility for near future hardware.

Thing is, the problem is quite the same as it had been with touchless fingerprint detection. These devices use high-resolution cameras to get an image of the ridges and valleys of the fingertip, but first-generation devices were easily fooled with photos or fingers being cut off for a more grisly choice.

To counter that, device makers introduced a "life finger detection" where temperature and even pulse in the capillaries are checked to see if it's an actual live finger rather than a dead one, possibly even warmed back up to body temperature.

Same would go with retina scanning. A second camera could try to take in the whole face to see if it belongs to a living person, or a series of images of the retina is taken to decide whether the device is looking at a still image or the capillaries of a living eye.

While these methods may not be foolproof themselves, they do actually raise the bar from 'just the casual intruder showing a snapshot to the sensor' to 'a determined attempt at bypassing security'.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.