Fingerprint Image Reconstruction from Standard Templates

1492 IEEE TRANSACTIONS ON PATTERN ANALYSIS AND MACHINE INTELLIGENCE, VOL. 29, NO. 9, SEPTEMBER 2007Fig. 5. (a) A termination minutia, where ðx; yÞ are the minutia coordinates, is defined as the mean direction of the tangents to the two valleysenclosing the termination and is measured increasingly counterclockwise from the horizontal axis to the right. (b) A bifurcation minutia, where isdefined as the mean direction of the tangents to the two ridgelines enclosing the ending valley and is measured increasingly counterclockwise fromthe horizontal axis to the right. (c) Terminations (white) and bifurcations (gray) in a sample fingerprint.TABLE 1The ISO/IEC 19794-2:2005 Fingerprint Minutiae Record Formatautomated fingerprint recognition is involved. The standarddefines the relevant terms, describes how to determineminutiae type, position, and orientation, and specifies theformats to be adopted for storing the data. In particular,three different data formats are defined: A record-basedformat, which is named Fingerprint Minutiae Record Formatfor general fingerprint template usage and interoperability,and two formats (normal and compact) for smart cards orother tokens. In this work, only the record-based format hasbeen considered for all the tests since it is the most generaltemplate representation available in the standard; anyway,the proposed reconstruction approach may be applied tothe other formats without any significant modification.The Fingerprint Minutiae Record Format defines thefundamental data elements used for minutiae-based representationof a fingerprint and optional extended data formatsfor including additional data such as ridge counts andsingularities location. Table 1 summarizes the structure of therecords and the main fields (including all those relevant to thereconstruction approach introduced in this work). A FingerprintMinutiae Record contains a Record Header that includesgeneral information (for example, the image size) and thenumber of fingerprints (Finger Views) represented. For eachFinger View, the corresponding Single Finger Record containsminutiae data (mandatory) and extended data (optional).For each minutia, the corresponding Finger MinutiaRecord (6 bytes) contains. the minutia type (termination, bifurcation, or other),where “other” is defined as a minutia type thatmay be matched with all the types (hence, it maydenote both an unknown type or a type other thantermination/bifurcation),Authorized licensed use limited to: IEEE Xplore. Downloaded on February 24, 2009 at 07:13 from IEEE Xplore. Restrictions apply.

CAPPELLI ET AL.: FINGERPRINT IMAGE RECONSTRUCTION FROM STANDARD TEMPLATES 1493Fig. 6. A functional schema of the proposed reconstruction approach.. the minutia x and y position expressed in pixels withrespect to the coordinate system in Fig. 5,. the minutia direction measured as explained inFig. 5 and recorded as a single byte in units of1.40625 (360/256) degrees, and. the minutia quality in the range 1 (minimum quality)to 100 (maximum quality), or 0 if no qualityinformation is provided.The Extended Data is designed for containing additionalinformation that may be used by the matching algorithm.More than one Extended Data Record may be present for eachFinger View. For each record, the Extended Data Area TypeCode denotes whether the data is in a vendor internal formator in one of the following formats defined in the standard:. Ridge Count Data Format—optional informationabout the number of fingerprint ridges betweenpairs of minutiae,. Core and Delta Data Format—optional informationabout the placement and characteristics of the loop/whorl 1 and delta singularities (see Section 3.1) on theoriginal fingerprint image, and. Zonal Quality Data—optional information about thequality of the fingerprint image within each cell in agrid defined on the original fingerprint image.The approach proposed in this work is able to reconstruct afingerprint image starting from the minutiae templateobtained from a single fingerprint; therefore, for simplicity,Fingerprint Minutiae Records containing only one Finger1. The standard does not distinguish between loop and whorlsingularities and simply names them as “cores.”View will be considered, but the approach could be easilyapplied to templates containing more Finger Views.The following record fields are used to reconstruct thefingerprint image:. Image Horizontal and Vertical Size,. Image Resolution (for a typical fingerprint scanner, itis reasonable to assume the same horizontal andvertical resolution),. Number of Minutiae n,. Type, Position x; y, and Direction of each minutia,and. Core and Delta positions (if provided in the ExtendedData).4 THE RECONSTRUCTION APPROACHLet W and H be the horizontal and vertical sizeof the image, asspecified in the template, respectively, let R be the resolutionof the image (in pixel per cm), and let M ¼fm 1 ; m 2 ; ...; m n gbe the set of n minutiae in the template, where each minutia isdefined as a quadruple m i ¼ft i ;x i ;y i ; i g that indicates itstype ðt i 2ftermination; bifurcation; othergÞ, position x i , y i (inpixels), and direction i (0 i < 2, converted in radiansfrom the discrete byte value in the template).The reconstruction approach is based on a sequence ofsteps that, starting from the information available in thetemplate, attempt to estimate various aspects of the originalunknown fingerprint (Fig. 6): the fingerprint area, theorientation image, and the ridge pattern. A final renderingstep is executed to make the reconstructed fingerprintimage more realistic. The following sections describe thereconstruction steps and the related mathematical models.Authorized licensed use limited to: IEEE Xplore. Downloaded on February 24, 2009 at 07:13 from IEEE Xplore. Restrictions apply.

1494 IEEE TRANSACTIONS ON PATTERN ANALYSIS AND MACHINE INTELLIGENCE, VOL. 29, NO. 9, SEPTEMBER 2007Fig. 7. The fingerprint area model.4.1 Fingerprint AreaDepending on the finger size, position, and pressure againstthe acquisition sensor, acquired fingerprint images havedifferent sizes and external shapes; this obviously affects thenumber and position of the minutiae reported in thetemplate. A simple but effective mathematical model forthe fingerprint area has been introduced in [7]: The model,based on four elliptical arcs and a rectangle, is controlled byfive parameters ða 1 ;a 2 ;b 1 ;b 2 ;cÞ to define the external shapeof the area and by two parameters ðx o ;y o Þ defining thecenter (see Fig. 7).In order to estimate the minimal area enclosing all theminutiae in the template, a greedy heuristic algorithm hasbeen adopted to find reasonable values for the modelparameters (Fig. 8). The algorithm chooses the center as thecentroid of the minutiae set and fixes the value of parameter cto R=6, which makes the initial shape slightly elongated in thevertical direction, then, starting from an area containing mostof the minutiae, iteratively enlarges it until all the minutiaeare enclosed. Finally, the shape is slightly enlarged on all thesides (adding a fixed offset of R=60) to guarantee a minimumborder around the most external minutiae.The experimental results (see Fig. 9 for some examples)showed that the area model is appropriate, its degrees offreedom allow the typical fingerprint area shapes to becovered, and the optimization approach is effective. Thealgorithm is also very fast, being the number of iterationscomparable to the number of minutiae. It is worth notingthat the model assumes no significant rotation of thefingerprint with respect to the vertical axis; since templatesobtained during enrollment have usually a proper positioning,it has not been considered convenient adding thisfurther degree of freedom.Fig. 8. Pseudocode of the greedy algorithm used to derive appropriate parameters for the model. Function F indMinArcðÞ finds the semiaxes of theelliptical arc with a minimum area that contains m j : Since minutiae positions and semiaxes are discretized in pixels, a simple exhaustive search isperformed.Fig. 9. Fingerprint area as estimated for some minutiae sets.Authorized licensed use limited to: IEEE Xplore. Downloaded on February 24, 2009 at 07:13 from IEEE Xplore. Restrictions apply.

1496 IEEE TRANSACTIONS ON PATTERN ANALYSIS AND MACHINE INTELLIGENCE, VOL. 29, NO. 9, SEPTEMBER 2007TABLE 2Control Points ^g s ðqÞ as Functions of u s and v sfor the Different Types of Singularities sTABLE 3Ranges of Variation for the Model ParametersThe set P of unknown parameters that have to be estimateddepends on the number of singularities, in particular,8< fk arch g if n s ¼ 0P ¼ fl 1 ; d 1 ;u l1 ;v l1 ;u d1 ;v d1 g if n s ¼ 1:fl 1 ; l 2 ; d 1 ; d 2 ;u l1 ;v l1 ;u l2 ;v l2 ;u d1 ;v d1 ;u d2 ;v d2 g if n s ¼ 2:To reduce the model complexity, for each piecewiselinear function g s ðÞ, P contains just two parameters u s andv s : In fact, the eight control points ^g s ðqÞ for each singularitys are derived from u s and v s according to Table 2.Table 3 reports the ranges of variations for the modelparameters.To make explicit the dependency of the orientationimage on the parameters in P, the orientation at a givenpoint ½x; yŠ T will be denoted here as xy ðPÞ.The estimation of optimal values for the parameters isthen carried out through an optimization process byminimizing the cost function f cost ðPÞf cost ðPÞ ¼ 1 nX ni¼1orientDiff i mod ; xi y iðPÞ ;where i is the direction of the ith minutia in thetemplate, xiy iðPÞ is the orientation given by the orientationmodel at the coordinates ½x i ;y i Š T of the ith minutia,and orientDiffð’ 1 ;’ 2 Þ2 0; 2 evaluates the absolute differencebetween two orientations:orientDiffð’ 1 ;’ 2 Þ¼minfj’ 1 ’ 2 j; j’ 1 ’ 2 jg;’ 1 ;’ 2 2½0;Þ:Three independent minimizations are performed (one foreach value of n s 2f0; 1; 2g) by using a direct searchalgorithm: The Nelder-Mead simplex [26]. This particularalgorithm has been chosen since it employs only functionevaluations and does not rely on derivative information,which would be difficult to calculate due to the complexity ofthe cost function. The overall minimum among the threen s values is chosen and the corresponding orientation imageis finally postprocessed in order to better fit the minutiaeorientations. For each minutia i, the postprocessing consistsof replacing xiy iwith the original minutiae orientationð i mod Þ and then locally averaging the orientations in asmall neighborhood to produce a smooth result.Fig. 12 compares some reconstructed orientation imageswith the orientation images calculated from the originalfingerprints using the approach proposed in [10].In case the ISO template contains information about theposition of the singularities in the Extended Data (seeSection 3.2), the above optimization is simpler; in fact, it iscarried out with a fixed value for n s and with a reduced set ofparameters, because estimating the singularity positions l jand d j is no longer necessary.4.3 Ridge PatternThe global characteristics of the ridge pattern may bedescribed by the orientation image and the frequency image(see Section 3.1). Unfortunately, local frequency informationis not among the mandatory data required by the ISOtemplate; in case the template contains ridge count informationin the Extended Data, an effective technique may bebased on the interpolation of the ridge count values betweendifferent pairs of minutiae; however, such an additionalinvestigation is outside the aims of this work. On the otherhand, reconstructing a frequency image from the minutiaeinformation seems to be almost impracticable: under somesimplifying hypothesis, one may try to infer something fromthe relative position of minutiae pairs and the singularitypositions, but usually, the number of minutiae is too low tocome to any robust conclusion. For this reason, the approachhere proposed simply assumes a constant frequency forthe whole fingerprint and, instead of attempting to estimateit, reconstructs four fingerprint images with differentfrequency values in a range determined according to theimage resolution R: ¼ 2:54500 R T 1, with period T ¼ 6,7,8,9 pixels. 2 This range of variation allows to cover typicalridgeline frequencies in nature [22]; adding intermediatevalues did not lead to better results in our preliminary testson 500 dpi images.Given the minutiae set M, the estimated orientationimage ½ xy Š, and the frequency , the ridge patternreconstruction involves the following steps:1. minutiae prototype positioning and2. iterative pattern growing.Step 1 starts from an empty image and, for each minutiam i ¼ft i ;x i ;y i ; i g in M, places at position ðx i ;y i Þ a smallprototype (that is, a small raster image resembling thecharacteristics of a minutia) corresponding to minutia typet i , scaled according to and rotated according to~ i ¼ x iy iif min j xiy i xiy iþ otherwise; i j; 2 j xiy i i j

CAPPELLI ET AL.: FINGERPRINT IMAGE RECONSTRUCTION FROM STANDARD TEMPLATES 1497Fig. 12. Four examples of reconstructed orientation images: for each of them, the original orientation image is shown on the left and thereconstructed one on the right; the minutiae orientations are superimposed to both. The orientation images have been obtained starting only fromminutiae positions and orientations.Fig. 13. From left to right: A set of minutiae, the two prototypes (bifurcation and termination), and the four results of Step 1 for different frequencies ðT ¼ 6; 7; 8; 9Þ.where angle ~ i has the estimated orientation xi y iand thedirection closer to the minutia direction i .Fig. 13 shows the two prototypes (bifurcation andtermination) and some examples of the result of Step 1 fordifferent frequencies . In case t i ¼ other (minutiae typeunknown or not reported), the bifurcation prototype is used.Step 2 iteratively grows the minutiae prototypes byapplying at each pixel ðx; yÞ a Gabor filter adjustedaccording to the frequency and the local orientation xy :gaborðr; s : xy ;Þ¼e ðrþsÞ22 2 cos 2ðr sin xy þ s cos xy Þ :The parameter , which determines the bandwidth of thefilter, is adjusted according to the frequency so that the filterdoes not contain more than three effective peaks (see Fig. 14).This pattern growing technique is analogous to theapproach proposed in [7] for the generation of syntheticridgeline patterns: At each iteration, the application of theGabor filters makes the nonempty regions in the imagegrow (Fig. 15) until they merge generating a uniformridgeline pattern; the process terminates when the wholeimage has been covered. An efficient implementation of thefiltering can be achieved by using separable Gabor filters,which can be precomputed according to a discretized set offrequencies (4) and orientations (256).4.4 RenderingThe output of the previous step is a “perfect” pattern withblack ridges and white valleys; the noising and renderingstep proposed in [7] is finally applied in order toFig. 14. An example of the Gabor filter used in Step 2: Note that thebandwidth is adjusted so that the filter does not contain more than threepeaks.Authorized licensed use limited to: IEEE Xplore. Downloaded on February 24, 2009 at 07:13 from IEEE Xplore. Restrictions apply.

1500 IEEE TRANSACTIONS ON PATTERN ANALYSIS AND MACHINE INTELLIGENCE, VOL. 29, NO. 9, SEPTEMBER 2007Fig. 20. The comparison of an original and a reconstructed image: Minutiae in the core region have been manually marked (circles and squaresdenote matching and nonmatching minutiae, respectively).original fingerprint and 14 in the reconstructed one); inFig. 20, the number of matching minutiae is three (over fourin the original fingerprint and 13 in the reconstructed one).The worse result of Fig. 20 is probably due to the lownumber of minutiae in the ISO template, which caused awrong estimation of the orientation image in the core regionand, as a consequence, a quite different ridgeline patterngenerated. However, it should be noted that, even in thiscase, most of the original minutiae find a good match in thereconstructed image.In spite of the high similarity of the reconstructedfingerprint patterns with respect to the original images, ata fine level of detail, several differences exist between thepatterns: this is due not only to the extra minutiae inserted inthe reconstructed images but also to some details like thelocal shape of the minutiae, the presence of evident pores,the presence of scratches or other imperfections, thestructure around the core region (which is very characteristic),and so forth.5.2 Attacking Automatic Fingerprint RecognitionSystemsThis section reports the results of experiments aimed atexploring the feasibility of a masquerade attack against eightstate-of-the-art commercial fingerprint recognition algorithms3 (referred to in the following as A1; A2; ...; A8) andagainst the algorithm available in the National Institute ofStandards and Technology (NIST) Fingerprint Image Software2 (NFIS2) [35] (referred to in the following as NIST). Tothe best of our knowledge, all the eight commercialalgorithms (whose implementation details are industrialsecrets) use minutiae as the main feature; on the other hand, itis likely that they also exploit other features to improve theperformance [9].For each algorithm:. Three operating thresholds have been selected toforce the algorithm to operate at different securitylevels, corresponding to False Match Rate ðFMRÞ ¼1percent, FMR ¼ 0:1 percent, and FMR ¼ 0 percent; tothis purpose, the above error rates have been a prioricomputed over the whole FVC2002 DB1 according tothe FVC2002 protocol [11].3. The names of the commercial systems tested are not disclosed here toavoid any form of undesired publicity.. The 120 templates corresponding to the originalfingerprint images in the data set have been created(the internal template format of the algorithm hasbeen used, which does not necessarily correspond tothe ISO template and may contain additional data).. The four fingerprint images, reconstructed from eachISO template with different frequency values, havebeen matched against the corresponding templatecreated by the algorithm: The attack has beenconsidered successful if at least one of the fourreconstructed images obtained a matching scorehigher than .. The percentage of successful attacks over the 120 fingerprintshas been reported for the three securitylevels (FMR ¼ 1 percent, FMR ¼ 0:1 percent, andFMR ¼ 0 percent).The attacks have been simulated under the followinghypotheses:. BASE. Only mandatory fields are present in the ISOtemplate, and no minutiae type information isavailable ðt i ¼ other for each iÞ.. MINTYPE. Only mandatory fields are present in theISO template, but minutiae type information isavailable (t i 2fbifurcation; terminationg for each i).. SINGPOS. Same as BASE, but with additionalinformation about Core and Delta positions in theExtended Data.. ORIMG. Same as BASE, but with the whole orientationimage stored in the Extended Data using avendor internal format; in this case, the orientationimage estimation described in Section 4.2 is notperformed, and the original orientations are used toguide the ridge pattern generation (Section 4.3).Tables 4, 5, 6, and 7 report the results obtained under thefour above hypotheses; Fig. 21 highlights the worst/average/best performance at each security level.The percentage of successful attacks from fingerprintsreconstructed with the proposed approach is surprising andbeyond all expectations. From the analysis of the results inthe four different hypotheses, the following observationsmay be made:. With the sole knowledge of the minutiae position andorientation (BASE hypothesis) at a security level ofAuthorized licensed use limited to: IEEE Xplore. Downloaded on February 24, 2009 at 07:13 from IEEE Xplore. Restrictions apply.

CAPPELLI ET AL.: FINGERPRINT IMAGE RECONSTRUCTION FROM STANDARD TEMPLATES 1501TABLE 4Percentage of Successful Attacks under the BASE HypothesisTABLE 5Percentage of Successful Attacks under the MINTYPE HypothesisTABLE 6Percentage of Successful Attacks under the SINGPOS HypothesisTABLE 7Percentage of Successful Attacks under the ORIMG HypothesisFig. 21. A bar graph for each security level: each graph shows the minimum, average, and maximum result obtained by the nine matching algorithmsfor each of the four hypotheses.0.1 percent FMR (typical of medium-security applications),the average percentage of successful attacks ishigher than 90 percent, and each algorithm testedaccepts at least 75 percent of the reconstructedfingerprints. At a much higher security level (correspondingto 0 percent FMR measured on FVC2002DB1), the average percentage of successful attacks ishigher than 80 percent.. Contrary to what one may expect, knowing minutiaetype information (MINTYPE hypothesis) seems not toimprove the chance of a successful attack: in fact,although in some cases the percentage of successgrows, for most of the algorithms, it drops. This maybe explained by considering that, on one hand, thisinformation does not add any benefit against thosealgorithms (probably, the vast majority) that do notAuthorized licensed use limited to: IEEE Xplore. Downloaded on February 24, 2009 at 07:13 from IEEE Xplore. Restrictions apply.