Vein recognition instead of PIN code

Vascular biometrics is an important aspect of the security research conducted by Andreas Uhl, Deputy Head of the Computer Science Department and Director of the Multimedia Signal Processing and Security Lab at the University of Salzburg. Alongside his team and more than 12 partner institutions from the United Kingdom, Germany, Poland, and France, he is working on biometric modalities in border control as part of the EU project PROTECT. Uhl leads the area of vein and security technology, contributing to the field of iris biometrics.

ATMs with Vein Recognition

Unlike fingerprints, vein-based biometric traits are less susceptible to environmental influences, making them more robust and less easily forged. Tests have shown that common smartphone fingerprint sensors can be cracked within two weeks. Even the traditional ATM PIN is considered insecure. “Credit card institutions accept the low level of security as long as the damage is not too high,” says Uhl. In Japan, vein-based biometric authentication is already used in ATMs, and the bank Barclays in the UK uses it for home banking. However, biometric security technology is still in its infancy. “We don’t know much yet. There are few independent studies on the robustness in cold and other challenging recording conditions,” says Uhl. The computer scientist is researching how such technology would fare in the Austrian banking environment in a project with social scientists. “We are examining how a biometric security feature would be received by the population instead of a PIN code,” says the expert.

ATMs would need to be equipped with corresponding modules, and bank customers would have to store their personal traits. One important aspect is the protection of biometric traits against theft because “if a database containing biometric traits is stolen, legitimate users cannot prevent their traits from being used.” In case of loss, the trait would be lost and cannot be changed like a password. However, there are technologies that can store altered traits. “In these systems, the traits are combined with a key in the form of a PIN code. In the event of data loss, the keys used are changed, rendering the lost data worthless. For me, this is the key to secure biometric usage.”