Vein pattern authentication (静脈パターン認証) is a biometric method that reads the shape of the veins running inside the palm or finger and matches it against the registered shape to confirm identity.
Register: store the vein shape
Scan: capture with near-infrared light
Match: compare with registered data
Decide: accept if above the threshold
If the match reaches the threshold the user is accepted, and if not, rejected.
4 / 4
Biometric authentication (生体認証, also called バイオメトリクス認証) confirms identity from features of the body or of behavior, and it is the third family alongside methods based on something you know and something you have. Veins lie under the skin and are hard to see from outside, so the device shines near-infrared light and uses the shadow shape it captures. The device judges how closely the captured shape matches the registered data and accepts the user when the match meets the threshold.
AnalogyJust as blood vessels show through as shadows when you hold your hand up to a bright light, the device photographs the map of vessels inside your hand and compares it.
How to rememberVeins are vessels beneath the skin, so unlike fingerprints, which leave marks on surfaces, they cannot be lifted from things you touch.
Exam points
ExamBiometric authentication (生体認証) needs neither information to memorize, like a password (パスワード), nor an item to carry, like a card. Instead, it needs a device that reads the feature.
ExamHolding a palm or finger to a sensor and matching the vein shape inside it against registered data is a typical example of biometric authentication.
ExamFingerprint (指紋) and vein information is not the kind of thing that can be stolen by peeking at a screen or at someone's hands.
Iris authentication (虹彩認証) uses a camera to read the fine pattern of the colored ring around the pupil (the iris) to confirm identity.
Iris patterns differ from person to person and barely change once formed in early childhood, so they are used for highly accurate biometric authentication. A camera can read them from a short distance, so users do not have to touch the device.
AnalogyIt is as if everyone were born wearing a one-of-a-kind handwoven pattern around the pupil that no one else shares.
How to rememberThe iris is named after Iris, the Greek goddess of the rainbow, and it is the colored ring around the pupil whose pattern this method reads.
Exam points
ExamBiometric data (生体情報) is the user's own body, so it does not need the regular changes and renewals that a password does.
ExamA setup that lets users switch to entering a password when biometric authentication fails keeps them from being locked out and improves convenience (利便性). Since passing either one is enough, it does not make authentication stronger.
ExamA PIN (暗証番号) is knowledge that the user remembers, which is a different kind of factor from body features such as fingerprints or the iris (虹彩).
Face authentication (顔認証) captures facial features such as the layout of the eyes and nose and the face outline with a camera, and matches them against registered data to confirm identity.
Because users only need to face the camera, it is widely used for unlocking smartphones and controlling passage through entrances. The result can easily change with the lighting, the angle of the face, and whether a mask is worn.
AnalogyThink of a receptionist who knows you and waves you in at a glance, except that a machine does it by measuring where your features sit.
Exam points
ExamBiometric authentication is a mechanism in which a device mechanically matches the features it reads against registered data. A check where a person compares appearances by eye does not count.
ExamAdding a face match (biometric) to password authentication (knowledge) creates two-factor authentication (二要素認証), which combines factors of different kinds.
ExamBiometric readers can be made small and are built into smartphones (スマートフォン) and laptops.
Voiceprint authentication (声紋認証) collects and analyzes features of the voice such as pitch and resonance (the voiceprint) through a microphone to confirm identity.
Since a microphone can serve as the reader, it also suits identity checks over the phone. On the other hand, it is easily affected by voice changes from a cold or by background noise, and it needs protection against impersonation using recorded voices.
AnalogyIt is like knowing a family member from their voice alone on the phone, except that a machine turns the voice features into numbers and compares them.
How to rememberThe name compares the voice to a fingerprint: when a voice is drawn as a chart, a pattern unique to each person appears.
Exam points
ExamThe features used in biometric authentication include not only the shape of the body (physical characteristics, 身体的特徴) but also traits of movement such as signing habits or the way a person walks (behavioral characteristics, 行動的特徴).
Retinal authentication (網膜認証) reads the pattern of blood vessels running across the retina at the back of the eye (the fundus) to confirm identity.
Retinal vessel patterns vary greatly between people and sit where they cannot be seen from outside, which makes them hard to forge. Reading them requires looking into the device while it lights up the back of the eye, which takes more effort from the user.
AnalogyMuch like an eye doctor looking into the back of your eye, the device reads the map of vessels spread across it.
How to rememberThe retina is the thin layer at the back of the eye that plays the role of film in a camera, and this method reads the vessels running across it.
Exam points
ExamFeatures suited to biometric authentication are hard to forge and change little over the years. Retinal (網膜) and vein (静脈) patterns meet these conditions and do not become unusable after a short time.
Mix-upThe iris is the pattern around the pupil visible on the surface of the eye, while the retina carries the vessel pattern at the back of the eye, so they are read in different places.
The false rejection rate (本人拒否率) is the rate at which a registered user who tries to authenticate is wrongly judged "not the user" and rejected.
Biometric authentication calculates how closely the captured features match the registered data and accepts the user when the match is at or above the threshold (しきい値), the match level set as the bar for acceptance. Raising the threshold to make the check stricter means even genuine users whose match drops because of their condition or a slightly off scan are more likely to be rejected. When this rate is high, genuine users have to retry again and again, which makes the system awkward to use.
AnalogyIt is the share of real employees turned away by a gatekeeper who has set the pass mark too high.
How to rememberIn the Japanese name 本人拒否率, the subject is 本人 (the genuine user): read it as the rate at which the real user is rejected, and you will not confuse it with the false acceptance rate.
Exam points
ExamA setting that keeps the false rejection rate (本人拒否率) low lets genuine users through more easily and favors convenience, while one that keeps the false acceptance rate (他人受入率) low favors security (安全性).
Mix-upThe rate at which the device cannot read the biometric data at all is called the failure-to-recognize rate (未対応率), a measure separate from the false rejection rate.
The false acceptance rate (他人受入率) is the rate at which someone other than the registered user is wrongly accepted as that user.
Decision threshold
False rejection rate
False acceptance rate
Raise the threshold (stricter)
Rises
Falls
Lower the threshold (looser)
Falls
Rises
When this rate is high, an impostor can pass by posing as the genuine user, which undermines security. Because biometric authentication decides by how closely the captured features match, there remains a chance of mistaking someone with very similar features for the real user.
AnalogyIt is the share of outsiders let in by a gatekeeper who has set the pass mark too low.
How to rememberIn the Japanese name 他人受入率, the subject is 他人 (someone else): read it as the rate at which an impostor gets accepted.
Exam points
ExamEven with biometric authentication, the chance of mistaking someone else for the genuine user and accepting them never drops to 0.
ExamWidening the matching tolerance lowers the false rejection rate (本人拒否率) but raises the false acceptance rate. Adjusting the threshold (しきい値) alone cannot lower both at once.
FAR stands for False Acceptance Rate, the English counterpart of the Japanese term 他人受入率 (false acceptance rate).
It is the rate at which an impostor is wrongly accepted as the genuine user. The higher the value, the more easily impersonation succeeds, signaling a less secure setting.
How to rememberAccept means to take in, so link it with the error of taking in an impostor.
Biometric authentication confirms identity from features of the body or behavior, so it needs nothing to memorize and nothing to carry, but it does need a device that reads the feature.
The five methods in this unit are told apart by what they read: veins inside the palm or finger, the iris around the pupil, the retina at the back of the eye, the layout of facial features, and the resonance of the voice.
Features that are hard to forge and change little over the years are the best suited to authentication.
The false rejection rate (FRR) is the rate of wrongly rejecting the genuine user, and the false acceptance rate (FAR) is the rate of wrongly accepting an impostor; adjusting the threshold alone cannot lower both at once.