Development of a Secure Login System Using Biometric Authentication

Development of a Secure Login System Using Biometric Authentication
Abstract
Traditional password-based authentication suffers from well-documented weaknesses including credential theft, password reuse, and susceptibility to phishing attacks. Biometric authentication offers a promising alternative by leveraging unique physiological characteristics—fingerprints, facial features, and iris patterns—that cannot be forgotten, guessed, or easily replicated. However, biometric systems introduce their own security challenges including presentation attacks, template theft, and privacy concerns. This project presents the design and development of a secure login system using biometric authentication that addresses these challenges through a multi-layered security architecture. The system implements the FIDO2/WebAuthn standard for passwordless authentication, ensuring that biometric data never leaves the user's device. A fallback authentication mechanism using OPRF-based protocols provides security even in environments where WebAuthn is unavailable. The implementation includes liveness detection to prevent presentation attacks, cancellable biometric templates to mitigate template theft risks, and comprehensive audit logging for compliance verification. Experimental evaluation demonstrates that the system achieves strong security properties while maintaining usability across desktop and mobile platforms.
Keywords: Biometric Authentication; FIDO2; WebAuthn; Liveness Detection; Cancellable Biometrics; Secure Login
________________________________________
Chapter 1: Introduction
1.1 Background
Authentication serves as the gateway to digital systems, verifying that users are who they claim to be before granting access to protected resources. The vast majority of authentication systems rely on knowledge-based factors (passwords, PINs) or possession-based factors (tokens, smart cards). Both approaches have fundamental limitations: passwords can be forgotten, guessed, or stolen through phishing; tokens can be lost, duplicated, or shared.
Biometric authentication addresses these limitations by using inherent human characteristics for identity verification. Fingerprint scanning, facial recognition, and iris scanning have become ubiquitous on consumer devices, with smartphone manufacturers integrating biometric sensors as primary unlocking mechanisms . The appeal is straightforward: biometric traits are always available, difficult to replicate, and cannot be forgotten or shared.
However, biometric authentication introduces distinct security and privacy challenges. Unlike passwords, biometric traits cannot be changed if compromised. A stolen fingerprint template is permanently compromised. Presentation attacks—using photographs, masks, or synthetic fingerprints—can deceive inadequate biometric systems . Deepfake technology further complicates verification by enabling realistic synthetic media that can fool facial recognition systems .
1.2 Problem Statement
Implementing secure biometric authentication presents several critical challenges:
Template Security: Storing raw biometric templates creates a single point of failure. If compromised, the impact is permanent and irreversible. Cancellable biometrics and template transformation techniques address this by generating non-invertible representations that can be revoked and regenerated .
Presentation Attack Resistance: Biometric systems must distinguish between genuine biometric presentations and spoofing attempts using photos, videos, masks, or synthetic samples. Liveness detection mechanisms are essential to resist these attacks .
Privacy Preservation: Biometric data is sensitive personal information subject to regulatory protection. Systems must minimize data collection and ensure that biometric processing occurs locally when possible .
Usability and Fallback: Not all devices support biometric sensors, and some users may be unable or unwilling to use biometrics. Secure fallback mechanisms are necessary without undermining overall system security.
Standardization: Interoperability across devices and platforms requires adherence to established standards. The FIDO2/WebAuthn standard provides a framework for passwordless authentication using public key cryptography .
1.3 Objectives
This project aims to design and implement a secure login system using biometric authentication that:
1. Implements the FIDO2/WebAuthn standard for passwordless authentication using platform authenticators (fingerprint, facial recognition).
2. Incorporates liveness detection to prevent presentation attacks.
3. Utilizes cancellable biometric templates to protect biometric data at rest.
4. Provides a fallback authentication mechanism using OPRF-based protocols for environments without WebAuthn support.
5. Delivers comprehensive audit logging for security monitoring and compliance verification.
1.4 Scope and Limitations
The system focuses on web-based authentication for desktop and mobile browsers supporting the WebAuthn API. Native mobile applications are not implemented in the current version. The system relies on device-provided biometric sensors; it does not implement custom sensor hardware. Liveness detection is implemented through software algorithms and device attestation; advanced hardware-based liveness detection (such as OCT fingerprint scanning ) is not within scope.
1.5 Thesis Structure
Chapter 2 reviews related work in biometric authentication, liveness detection, and template protection. Chapter 3 presents the system architecture and design. Chapter 4 describes implementation details. Chapter 5 concludes with limitations and future work.
________________________________________
Chapter 2: Literature Review
2.1 Biometric Modalities
Biometric authentication systems leverage anatomical or behavioral characteristics for identity verification. The five leading biometric technologies include fingerprint readers, iris recognition, face recognition, hand geometry scanners, and dynamic signature identification .
Fingerprint Scanning is the most widely deployed biometric modality, found on smartphones, laptops, and access control systems. Fingerprint scanners capture an image of the fingerprint, mathematically encode the pattern (minutiae points where ridges end or bifurcate) into a template, and compare against stored templates . Optical, capacitive, and ultrasonic sensor technologies offer different trade-offs between cost, accuracy, and anti-spoofing capability .