Biometric Authentication Explained — GCSE Computer Science

What types of biometric authentication exist?

How does fingerprint recognition work?

When you enrol your fingerprint, the sensor captures a high-resolution image of your fingertip and the system extracts minutiae points — the positions of ridge endings, bifurcations (where a ridge splits), and other unique features. This map of ~70–100 points is converted to a digital template and stored securely.

To authenticate, the sensor captures a new image. The algorithm extracts its minutiae map and compares it with the stored template. An exact pixel-by-pixel match is not required — the system checks whether enough minutiae align within acceptable tolerances. The threshold determines the balance between False Accept Rate (FAR) and False Reject Rate (FRR):

• Too lenient: impostors are accepted (high FAR).
• Too strict: legitimate users are rejected (high FRR).

How is biometric data stored and protected?

Biometric data is never stored as an image in secure implementations. The raw fingerprint or facial scan is discarded after enrolment; only the extracted template (a mathematical representation) is kept. On modern smartphones this template is stored in a dedicated secure chip called the Trusted Execution Environment (TEE) or Secure Enclave — isolated hardware that the main OS cannot access directly.

Templates are also irreversible: you cannot reconstruct the original biometric from the template alone. This is critical because — unlike a password — you cannot change your fingerprint if the template is stolen.

How does biometrics compare with other authentication methods?

Biometrics are strongest when combined with another factor — this is multi-factor authentication (MFA). For example, a phone that requires both a fingerprint (something you are) and a PIN (something you know) is far more secure than either alone.

What are the advantages and disadvantages of biometric authentication?

Advantages:

• Convenient — no need to remember complex passwords.
• Difficult to duplicate or transfer to another person.
• Fast — authentication typically takes under a second.
• Reduces risk of weak passwords (e.g. password123).

Disadvantages:

• Biometric data is permanent — if a fingerprint template is breached, it cannot be reissued.
• Sensors can be fooled by high-quality fakes in some implementations (spoofing).
• False rejection can lock out legitimate users (e.g. injured fingers, changed appearance).
• Raises privacy concerns — biometric data is sensitive personal data under GDPR.
• May not work well for all users: some people have faint fingerprints; facial recognition accuracy has been shown to vary across demographic groups.

What are the legal and ethical issues around biometrics?

Under the UK GDPR and Data Protection Act 2018, biometric data is classified as special category data — the most sensitive type — requiring explicit consent and strict controls on how it is collected, stored, and used. Organisations using facial recognition in public spaces face significant legal scrutiny. The use of biometrics in schools for cashless canteen payments or register-taking has been challenged on the grounds that children cannot give fully informed consent.

At GCSE you are expected to evaluate these trade-offs: greater convenience and security come at the cost of privacy and permanence of risk.

Frequently asked questions

Can a fingerprint sensor be fooled?

Cheaper optical sensors have been tricked using a high-resolution printed photograph of a fingerprint. Modern ultrasonic sensors (used in flagship smartphones) are far more resistant — they measure the 3-D topography of the finger and detect pulse, making flat photographs ineffective. No security system is perfect, which is why biometrics are best combined with another authentication factor.

Why is the False Accept Rate important in high-security systems?

The False Accept Rate (FAR) is the percentage of unauthorised users who are incorrectly granted access. In a consumer smartphone, a small FAR is acceptable because the risk of a single attacker with a fabricated fingerprint is low. In a nuclear facility or a financial vault, even a tiny FAR is unacceptable. High-security systems therefore use multiple biometric factors simultaneously (fingerprint AND iris) and set very strict matching thresholds, accepting a higher False Reject Rate in exchange.

What is liveness detection?

Liveness detection is a technique used to distinguish a real, living person from a photograph, video, or model of that person. Methods include asking the user to blink, turn their head, or smile; using infrared depth sensors that detect 3-D structure; or detecting blood flow under the skin using near-infrared light. Without liveness detection, facial recognition systems can be defeated by holding up a photograph.

Is biometric data covered by the Data Protection Act?

Yes. Biometric data used to uniquely identify a person is special category data under both GDPR and the UK Data Protection Act 2018. Processing it requires an explicit lawful basis (typically explicit consent or a specific exemption), a Data Protection Impact Assessment (DPIA) in most cases, and strict technical and organisational security measures. Organisations that breach these rules face substantial fines from the Information Commissioner's Office (ICO).

---

For Socratic GCSE tutoring and free Computer Science flashcards, see aitutors.me.