Future Face ID could map a user's veins to foil 'evil twin' attack

Posted:
in iPhone edited August 2020
Apple wants to improve the security of Face ID and other visual-based biometric systems to eliminate the so-called "twin problem," by taking advantage of the unique and hard to copy patterns of veins that reside under the skin.

Apple's biometric security systems Face ID and Touch ID
Apple's biometric security systems Face ID and Touch ID


Biometric security systems like Face ID and Touch ID offer protection for user data in a relatively easy to understand package. It is also one that is also simple to use, as the user doesn't need to remember passwords or codes since their face or fingerprint effectively are their account credentials.

While security is good, they are still fallible by a number of areas, such as having a very small false-positive rate, which in the case of Face ID is in the realm of one in a million.

There are also issues with people being able to create highly complex masks to fool Face ID, typically in a fashion far beyond the capabilities of a normal person. Lastly, there's the "twin problem," where facial recognition systems like Face ID could grant access for people who look extremely alike, such as twins or family members.

An example of a vein structure under a person's skin.
An example of a vein structure under a person's skin.


In a patent granted by the US Patent and Trademark Office on Tuesday titled "Vein matching for difficult biometric authentication cases," Apple proposes that the answer is more than skin deep. Specifically, a few millimeters below the skin, as it suggests that veins could be used as an identifier.

While facial features can be easily copied, vein patterns differ wildly between individuals, even twins. As they are also below the skin and occupy 3D space, it is also extremely difficult to create a counterfeit face that takes into account the vein structure without either the extreme cooperation of the subject, or medically invasive maneuvers.

The system consists of creating a 3D map of a user's veins using sub-epidermal imagery techniques, such as an infrared sensor in a camera capturing flood and speckle patterns from infrared illuminators lighting up the user's face. This is somewhat similar to how Face ID currently works, in that infrared light is emitted in patterns on a user's face and read by an imaging device, but Apple's patent is specific about detecting the veins instead of the exterior.

Like other biometric methods, the system has to determine if there is a close-enough match between the scanned data and previously-taken version used to register the user. If the match is close enough, the system effectively confirms the user is authorized, and access is granted.

A flowchart for performing a biometric check on a user's face and veins.
A flowchart for performing a biometric check on a user's face and veins.


Apple files numerous patent applications on a weekly basis, but while the ideas offer areas of interest for Apple's research and development efforts, it does not guarantee that the idea will appear in a future product or service.

The patent lists its inventors as Micah P. Kalscheur and Feng Tang, and was filed in February 2018. The patent application first surfaced in searches in March 2019.

Earlier Work

Apple has looked into many different ways it can take advantage of a person's veins for a variety of purposes. A related patent granted on May 2018 for "Vein imaging using detection of pulsed radiation" reuses the concept of infrared emission and reception to monitor for blood vessel patterns, but adds time-of-flight calculations of pulses to produce a three-dimensional map.

A similar concept has also been mused for the Apple Watch, using a light field camera to detect patterns of veins, arteries, blood perfusion in the skin and tendons, and hair follicle patterns, among other elements, that could uniquely identify a user. Vein scanning in an Apple Watch may also be used to detect no-touch gestures, such as hand or finger movements, that could trigger actions on the wearable device.

Apple is also looking into how a user's palm veins could be analyzed as part of Touch ID-style recognition, except the user presses the entire screen of the device with their hand.

Comments

  • Reply 1 of 16
    gatorguygatorguy Posts: 24,179member
    It's coming despite our personal preferences and intentions, but IMHO these "advances" in positively identifying specific people across a very broad spectrum are not a good thing.  
  • Reply 2 of 16
    Rayz2016Rayz2016 Posts: 6,957member
    gatorguy said:
    IMHO these "advances" in positively identifying specific people across a very broad spectrum are not a good thing.  

    🤣🤣🤣🤣🤣
    cornchipfastasleepchasmBeats
  • Reply 3 of 16
    gatorguy said:
    It's coming despite our personal preferences and intentions, but IMHO these "advances" in positively identifying specific people across a very broad spectrum are not a good thing.  
    It is certainly something to be concerned about. Such advanced technology developed and used for such trivial purposes has the potential to be misused, or copied by others with completely different motives, which is always a concern. The way some people say, "Don't care, give me a better iPhone" is alarming.

    I'd settle for Face ID that works in landscape mode. How about a gyroscopic camera?
    Beats
  • Reply 4 of 16
    XedXed Posts: 2,519member
    gatorguy said:
    It's coming despite our personal preferences and intentions, but IMHO these "advances" in positively identifying specific people across a very broad spectrum are not a good thing.  
    Why not?
    fastasleep
  • Reply 5 of 16
    lojacklojack Posts: 28member
    Wait, I thought 'Evil Twin' detection was simple, just look for the goatee...
    XedBeatscornchipchasmjony0pscooter63Rayz2016
  • Reply 6 of 16
    Fidonet127Fidonet127 Posts: 507member
    So we have had years of how Touch ID and Face ID are bypass-able. Now we have people complaining how this tech use to secure our own phones, can be used to ID people over a broad spectrum? This is Apple inovation to secure our own phones. This is not Apple trying to run surveillance on groups of people. 
    chasm
  • Reply 7 of 16
    nicholfdnicholfd Posts: 824member
    gatorguy said:
    It's coming despite our personal preferences and intentions, but IMHO these "advances" in positively identifying specific people across a very broad spectrum are not a good thing.  
    I'd settle for Face ID that works in landscape mode. How about a gyroscopic camera?
    Face ID does work in landscape mode on the iPad Pros, and amazingly well!
    chasm
  • Reply 8 of 16
    BeatsBeats Posts: 3,073member
    Ah.... "TwinGate" when everyone suddenly had a twin and Apple "failed" once again.

    gatorguy said:
    It's coming despite our personal preferences and intentions, but IMHO these "advances" in positively identifying specific people across a very broad spectrum are not a good thing.  

    Unless Google does it to store our data.
    cornchip
  • Reply 9 of 16
    cornchipcornchip Posts: 1,945member

    Probably with this type tech

    https://www.accuvein.com/





    jony0
  • Reply 10 of 16
    fastasleepfastasleep Posts: 6,409member
    gatorguy said:
    It's coming despite our personal preferences and intentions, but IMHO these "advances" in positively identifying specific people across a very broad spectrum are not a good thing.  
    Yes, it's much better to be misidentified.
  • Reply 11 of 16
    fastasleepfastasleep Posts: 6,409member

    So we have had years of how Touch ID and Face ID are bypass-able. Now we have people complaining how this tech use to secure our own phones, can be used to ID people over a broad spectrum? This is Apple inovation to secure our own phones. This is not Apple trying to run surveillance on groups of people. 
    Not to mention the data is secure and doesn't even leave the device.
    chasmFidonet127mknelson
  • Reply 12 of 16
    chasmchasm Posts: 3,276member
    For the record: developers (including Google) do not have access to the TouchID fingerprint or FaceID face-scan. Indeed, **Apple** doesn’t have access to it.

    Now if you use Google’s face/touch identification programs on a Google or Android product ... that might be a very different story.
  • Reply 13 of 16
    gatorguygatorguy Posts: 24,179member
    chasm said:
    For the record: developers (including Google) do not have access to the TouchID fingerprint or FaceID face-scan. Indeed, **Apple** doesn’t have access to it.

    Now if you use Google’s face/touch identification programs on a Google or Android product ... that might be a very different story.
    It isn't different on a Pixel. That might not extend to all smartphones. 
  • Reply 14 of 16
    gatorguygatorguy Posts: 24,179member
    gatorguy said:
    It's coming despite our personal preferences and intentions, but IMHO these "advances" in positively identifying specific people across a very broad spectrum are not a good thing.  
    Yes, it's much better to be misidentified.
    You've completely missed the point. 

    It's not Apple we should be concerned about, not even Google. It's the fact that if Apple can figure it out so can a thousand other companies and several governments who may not have the same reason to be concerned with privacy. Eventually we'll get to the point that we cannot be in public without a government or perhaps company being able to positively know it is us, not just someone who kinda looks like us. 
  • Reply 15 of 16
    fastasleepfastasleep Posts: 6,409member
    gatorguy said:
    gatorguy said:
    It's coming despite our personal preferences and intentions, but IMHO these "advances" in positively identifying specific people across a very broad spectrum are not a good thing.  
    Yes, it's much better to be misidentified.
    You've completely missed the point. 

    It's not Apple we should be concerned about, not even Google. It's the fact that if Apple can figure it out so can a thousand other companies and several governments who may not have the same reason to be concerned with privacy. Eventually we'll get to the point that we cannot be in public without a government or perhaps company being able to positively know it is us, not just someone who kinda looks like us. 
    And you missed my point. The facial recognition train has left the station, is already substantially advanced and widespread to the point that further advances in preventing false positives might be advantageous in that you might avoid being erroneously identified and say arrested or shot, as an extreme example.
  • Reply 16 of 16
    wonkothesanewonkothesane Posts: 1,717member
    gatorguy said:
    It's coming despite our personal preferences and intentions, but IMHO these "advances" in positively identifying specific people across a very broad spectrum are not a good thing.  
    It is certainly something to be concerned about. Such advanced technology developed and used for such trivial purposes has the potential to be misused, or copied by others with completely different motives, which is always a concern. The way some people say, "Don't care, give me a better iPhone" is alarming.

    I'd settle for Face ID that works in landscape mode. How about a gyroscopic camera?
    Sounds to me a bit like “Damn the one who invented the fire and using it for preparing meat. Now we have all this houses burning down. I’d rather continue to eat like Gollum.”  Yes, technology advancements bear risks and require responsible use. Any advancement. Not just fire, facial recognition, ability to split the atom. Also, it strikes me as impossible to improve fake resistance and at the same time not being more reliable in recognizing faces  ;) In the end I prefer a more reliable facial recognition for the reason of not being arrested because my twin brother/lookalike guy I never met robbed the bank, if we speak about broader use cases.

    Anyway, thumbs up for the request for landscape faceID - I could have used that one more than once.
Sign In or Register to comment.