Analysis of Master Vein Attacks on Finger Vein Recognition Systems

TL;DR

This paper introduces novel master vein attack methods on finger vein recognition systems, demonstrating high false acceptance rates and raising concerns about their security robustness.

Contribution

It is the first to propose master vein attacks using generative models and adversarial machine learning, significantly advancing attack techniques on FVR systems.

Findings

Achieved false acceptance rates up to 88.79% with combined methods.

Demonstrated vulnerability of FVR systems to non-vein-looking samples.

Highlighted the need for improved security measures against master vein attacks.

Abstract

Finger vein recognition (FVR) systems have been commercially used, especially in ATMs, for customer verification. Thus, it is essential to measure their robustness against various attack methods, especially when a hand-crafted FVR system is used without any countermeasure methods. In this paper, we are the first in the literature to introduce master vein attacks in which we craft a vein-looking image so that it can falsely match with as many identities as possible by the FVR systems. We present two methods for generating master veins for use in attacking these systems. The first uses an adaptation of the latent variable evolution algorithm with a proposed generative model (a multi-stage combination of beta-VAE and WGAN-GP models). The second uses an adversarial machine learning attack method to attack a strong surrogate CNN-based recognition system. The two methods can be easily combined to boost their attack ability. Experimental results demonstrated that the proposed methods alone and together achieved false acceptance rates up to 73.29% and 88.79%, respectively, against Miura's hand-crafted FVR system. We also point out that Miura's system is easily compromised by non-vein-looking samples generated by a WGAN-GP model with false acceptance rates up to 94.21%. The results raise the alarm about the robustness of such systems and suggest that master vein attacks should be considered an important security measure.