I527-290 ESRIF Final Report (WEB).indd - European Commission

Tuning of biometric systems
The decision errors of a biometric verifi cation system are measured in terms of:
False Acceptance Rate (FAR): the expected proportion of transactions with wrongful claims of identity that are incorrectly
confi rmed. A transaction may consist of one or more wrongful attempts dependent upon the decision policy.
False Rejection Rate (FRR): the expected proportion of transactions with truthful claims of identity that are incorrectly
denied. A transaction may consist of one or more wrongful attempts dependent upon the decision policy.
There is inevitably a trade-off as attempts to minimize the false matches of a system tend to decrease the frequency of true
matches. System designers often have to adjust threshold values to get the best combination of true and false performance
measures, and sometimes these adjustments are also available to customers who want to fi ne-tune their own biometric
deployments.
Other performance indicators such as Failure To Enrol (FTE, percentage of people not able to enrol in the system) or Failure To
Acquire (FTA, percentage of people not able to have their biometrics captured for matching) can also be measured and tuned
in each system. If the requirements in terms of quality of the samples captured are too high, the FTE and FTA will be extremely
high. But on the other hand if these requirements are too low the system will not be secure.
While it is important to be able to adapt a system’s performance specifi cally to a given application and environment, this
can also be dangerous, especially in Border Control scenarios. In Europe for instance, we can imagine that diff erent countries
deploy systems with diff erent performance in terms of any of the indicators mentioned above. For this reason, and to maintain
a good level of trust for the overall European system, it is important to have a mean to uniformly assess this performance.
Certifi cation of the systems is one of the solutions to achieve this goal.
Certifi cation of systems
It is challenging to defi ne and compare security levels of diff erent biometric identity management systems. As we just
mentioned, diff erent attacks can be carried out against biometric systems and by design the systems can achieve diff erent
performance levels. One possible approach could be to introduce a certifi cation mechanism or a conformance mechanism.
This would allow interoperability and trustworthiness through connected service providers. It is also important to defi ne
quality requirements targeted to diff erent applications where biometric systems are required. This is of particular concern as
these systems interact with people’s privacy and can lead to judicial penalties.
A good example of this can be found in large-scale applications where the choice of the acquisition devices is one of the most
critical issues. For example, the 10-print (4-4-2) fi ngerprint capture devices that will be used for the European Visa Information
System (VIS) project require implementing the ISO/IEC 19794 series standard. This provides a common level of quality and
mutual trust between all the participants in the project.
8.2.1.3 Trusting assets
The opportunities and challenges mentioned above equally apply to assets. With better performing technologies, but also
an increased complexity of the exchanges of assets, establishing trust of physical assets is at the same time becoming more
feasible but also more complex.
The best example of the challenges that have to be faced can certainly be found in multimodal freight transportation, which
is a complex, distributed and unbounded network linking geographically-scattered nodes through broad and diverse fl ows
and infrastructures covering direct air/sea/road/inland/waterway/railway connections. In such a scenario, as in any complex
networked system, the weakest point always determines its overall resilience and exposure to risks.
Here are some of the challenges to be addressed to enhance trust in this context:
Authentication, authorisation and organisational/institutional control/ruling providing guarantees for all actors involved.
Customs control and procedures addressing inspection requirements and technological solutions for monitoring, tracking
and automatic control of freight and carrier at the crossing points, during transport and the eff ective interaction of the
authorities with the stakeholders towards a greater effi ciency.
175