Skip to main content
SpringerLink
Log in
Book cover

Advanced Multimedia and Ubiquitous Engineering pp 71–77Cite as

Vulnerability Analysis on Smartphone Fingerprint Templates

  • Conference paper
  • First Online:

Part of the book series: Lecture Notes in Electrical Engineering ((LNEE,volume 354))

Abstract

Currently, many smartphones are adopting fingerprint verification as a method to authenticate their users. Because fingerprint verification is not only used to unlock these smartphones but also used in financial applications such as online payment, it is crucial to secure the fingerprint verification mechanism for reliable services. In this paper, we identify a few vulnerabilities in one of the currently deployed smartphones equipped with fingerprint verification service by analyzing the service application. We demonstrate actual attacks via a proof-of-concept code that exploits these vulnerabilities. By these attacks, an attacker can extract fingerprint features by decoding a file containing them in encrypted form. We also suggest a few possible countermeasures against these attacks.

This research was supported in part by Basic Science Research Program through the National Research Foundation of Korea (NRF) funded by the Ministry of Education (grant number: 2014R1A1A2058514) and in part by the MSIP, Korea, under the ITRC support program (IITP-2015-H8501-15-1008) supervised by the IITP.

This is a preview of subscription content, log in via an institution.

Chapter
USD   29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD   169.00
Price excludes VAT (USA)
  • Available as EPUB and PDF
  • Read on any device
  • Instant download
  • Own it forever
Hardcover Book
USD   219.99
Price excludes VAT (USA)
  • Durable hardcover edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Learn about institutional subscriptions

Notes

  1. 1.

    The VEGA series is one of the earliest smartphones with fingerprint recognition service, which is prior to recent popular ones such as iPhone 5s and Galaxy S5 [2]. The vulnerability was found on the device with Android 4.2.2 as of April, 2014. We reported this to the vendor. The vulnerability was independently addressed by the vendor through a patch.

References

  1. Paypal. https://www.paypal-pages.com/samsunggalaxys5/us/index.html

  2. Pantech. http://www.pantech.co.kr/en/board/reportBoardView.do?seq=5870&bbsID=report&ulcd=KO

  3. ISO/IEC International Standard 19794-2. Information Technology—biometric data interchange formats—part 2: finger minutiae data (2011)

    Google Scholar 

  4. ANSI INCITS 378-2009: American National Standard for Information Technology—finger minutiae format for data interchange (2009)

    Google Scholar 

  5. NIST special publication 800-38A, recommendation for block cipher modes of operation (2001)

    Google Scholar 

  6. NIST federal information processing standards publication 197. Advanced Encryption Standard (AES) (2001)

    Google Scholar 

  7. OpenSSL. http://www.openssl.org/

  8. Cappelli, R., Maio, D., Lumini, A., Maltoni, D.: Fingerprint image reconstruction from standard templates. IEEE Trans. Pattern Anal. Mach. Intell. 29(9), 1489–1503 (2007)

    Article  Google Scholar 

  9. Feng, J., Jain, A.K.: Fingerprint reconstruction: from minutiae to phase. IEEE Trans. Pattern Anal. Mach. Intell. 33(2), 209–223 (2011)

    Article  Google Scholar 

  10. Ratha, N.K., Chikkerur, S., Connell, J.H., Bolle, R.M.: Generating cancelable fingerprint templates. IEEE Trans. Pattern Anal. Mach. Intell. 29(4), 561–572 (2007)

    Article  Google Scholar 

  11. Moon, D., Yoo, J.-H., Lee, M.-K.: Improved cancelable fingerprint templates using minutiae-based functional transform. Secur. Commun. Networks 7(10), 1543–1551 (2014)

    Google Scholar 

  12. ARM. http://www.arm.com/products/processors/technologies/trustzone/index.php

Download references

Author information

Authors and Affiliations

  1. Department of Computer and Information Engineering, Incheon, 402-751, Korea

    Young-Hoo Jo, Sung-Yun Jeon, Jong-Hyuk Im & Mun-Kyu Lee

Authors
  1. Young-Hoo Jo
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Sung-Yun Jeon
    View author publications

    You can also search for this author in PubMed Google Scholar

  3. Jong-Hyuk Im
    View author publications

    You can also search for this author in PubMed Google Scholar

  4. Mun-Kyu Lee
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Mun-Kyu Lee .

Editor information

Editors and Affiliations

  1. Seoul National University of Science and Technology, Seoul, Korea, Republic of (South Korea)

    James J. (Jong Hyuk) Park

  2. National Ilan University, Yilan City, Taiwan

    Han-Chieh Chao

  3. The University of Georgia, Athens, Georgia, USA

    Hamid Arabnia

  4. The University of Aizu, Aizuwakamatsu, Japan

    Neil Y. Yen

Rights and permissions

Reprints and permissions

Copyright information

© 2016 Springer-Verlag Berlin Heidelberg

About this paper

Cite this paper

Jo, YH., Jeon, SY., Im, JH., Lee, MK. (2016). Vulnerability Analysis on Smartphone Fingerprint Templates. In: Park, J., Chao, HC., Arabnia, H., Yen, N. (eds) Advanced Multimedia and Ubiquitous Engineering. Lecture Notes in Electrical Engineering, vol 354. Springer, Berlin, Heidelberg. https://doi.org/10.1007/978-3-662-47895-0_9

Download citation

  • DOI: https://doi.org/10.1007/978-3-662-47895-0_9

  • Published:

  • Publisher Name: Springer, Berlin, Heidelberg

  • Print ISBN: 978-3-662-47894-3

  • Online ISBN: 978-3-662-47895-0

  • eBook Packages: EngineeringEngineering (R0)

Publish with us

Policies and ethics

Search

Navigation