How Can This Biometric Be Spoofed?

The iris is an extremely difficult trait to spoof, yet there have been attempts at spoofing. There is little doubt that others will try and, given enough time, money, and energy, they may be successful. Attacks on the iris biometric fall into the following categories:

• Attacking the physical iris

• Using artifacts

• Attacking the communications (see Chapter 5)

• Compromising the template (see Chapter 5)

• Attacking the fallback system (see Chapter 5)

Attacking the Physical Iris

One attempt at spoofing was made by C'T of Germany. In its spoof, the company printed a high-quality digital image of an iris onto paper. The pupil area was then cut out so the spoofer could present his/her pupils along with the faked iris image. C'T succeeded in getting the system to capture an image and successfully authenticate. ^[4] This spoof was possible due to the robustness of the iris algorithm. The algorithm was designed to image an iris of any size .

^[4] This section is based on the work from C'T ( www.heise.de/ct/english/02/11/114/ ), Nov. 2002, p. 114.

Mitigating this attack

To mitigate against this particular attack, a check was added to the algorithm to look for a telltale signature created by the printing process and observed during the two-dimensional Fourier power spectrum analysis.

Using Artifacts

The artifacts used for iris biometrics are not of the same type as those used for other biometrics. Since there is no residual contact left from the templating, the artifact (the iris) needs to be recorded. The only recorded artifact, that is, the user 's iris, must be used as the basis for an attack. Once this is done, the artifact, in effect, is used as described in "Attacking the Physical Iris."