Multimodal Biometric Authentication Algorithm in
BioPKI System
Hoang Xuan Minh, Nguyen Thi Hoang Lan, Tran Quang Duc
Abstract
This paper is a part of the State Key S&T Program on
Information and Communication Technology KC0111-06-
10, Vietnam, which is called “Research and development of
Biometric Based Network Access Control System and
Information Security System using Embedded Technology”.
Today most biometric systems use only one biometric trait
to verify users. These unimodal biometric systems face
many problems such as noise, non-universality, spoof
attacks and high error rates. Some of these drawbacks can
be overcome by using multimodal biometric systems.
In this paper, we propose a multimodal biometric fusion
solution using multiple units of the same biometric trait
which is fingerprint in particular. The idea is to minimize
the sum of false acceptance rate and false reject rate. With
promising experimental result, the algorithm has been
integrated into the BioPKI system deployed in the
aforementioned State Key S&T Program.
Figure 1 Four modules in a generic biometric system
Apart from fusion level, another issue needs to be
considered is choosing fusion scenarios. Arun Ross and
Anil K. Jain [1] listed five scenarios in a multimodal
biometric system: (1) Single biometric trait, multiple
sensors; (2) Single biometric trait, multiple classifiers; (3)
Single biometric trait, multiple units; (4) Single biometric
trait, multiple snapshots; and (5) Multiple biometric traits.
In this paper, the scenario we choose is (3). In particular, we
1. Introduction
Every biometric system consists of 4 important modules:
the sensor module, the feature extraction module, the
matching module and the decision module (Figure 1). As
discussed by Arun Ross and Anil K. Jain [1], when
combining various unimodal biometric systems to create a
multimodal biometric one, fusion can occurs at any of the
four mentioned modules. In addition, fusion at an earlier
stage is considered more effective than that at a later stage
since earlier stages contains richer information. However, it
is difficult to perform fusion at these levels because the first
three modules are often black boxes and even when they are
not hidden, the feature sets of the various modalities may be
incompatible. On the other hand, the decision level provides
too little information. Therefore, in practice, fusion at the
matching score level is usually preferred. In our BioPKI
system, fingerprints are acquired processed and matched
using the library accompanying with Biometrika Device. As
a result, we have access neither to the feature sets nor to the
raw data. Accordingly, we would integrate information at
matching score level.
would integrate information presented by 2 or more fingers
of a single user. In this way, we can make use of the
Biometrika device that has already been deployed in our
BioPKI system and thus, reduce the cost.
In conclusion, in our BioPKI system, we will build a
multimodal biometric solution in which biometric
information of two fingerprints will be integrated at
matching score level.
 2. Multimodal Biometric Solution - fusion at
matching score level
Figure 2 Multimodal Biometric Solution - fusion at matching score level
In this solution, we consider M input biometric traits; each
is processed by a separate matching module. Those
matching modules are black boxes which take user
biometric data as input and produce a matching score Si,
with i denoting the index of the input biometric trait,
presenting the level of likeness between the input biometric
data and the registered biometric data of the same user.
As the output of these matching modules might be in
different scales, the scores are pushed through another
module to standardize them to the same scale. After that, the
standardized scores are combined to create a single fusion
score Sf, which would be compared to a threshold T.
Depending on the comparison result, user would be verified
if S f > T and vice versa.
What needs to be paid attention to here is the calculation of
Sf. Let us assign a weight w[i] for each biometric traits at
the input, where i is the index of the input biometric traits,
0≤ i < M, and
(1)
Based on these weights, the fusion score would be
calculated as follow:
(2)
The next question is how to choose the value of w[i] and
threshold T. In the next section, we would discuss our
proposed solution which is one of the answers to that
question.
Figure 2 illustrates the multimodal biometric solution
integrating at matching score level.
3. Multimodal Biometric Solution based on
multiple units of the same biometric trait in
BioPKI System
Before going into more details about our proposed solution,
let us have a glance at the accuracy in biometric system. The
key performance metrics in biometrics are false acceptance
rate and false reject rate. [2]
False acceptance rate (FAR) is the probability that a user’s
template will be incorrectly judged to be a match for a
different user’s template. False reject rate (FRR), on the
other hand, is the probability that a user’s template will be
incorrectly judged to not match his or her enrollment
template.
In general, the smaller those rates are, the more secure the
biometric system is considered. However, tradeoff between
FAR and FRR must be taken into account when building a
biometric system since decreasing FAR is equivalent to
increasing FRR and vice versa.
On the basis of the solution in section 2, we proposed a
solution in which weights of different biometrics traits and
threshold T are decided in order for the sum (FAR+FRR) to
be minimized. This approach of course depends on the
fingerprint sample sets which are used for calculating FAR
and FRR. In our solution, these metrics are calculated on the
following sample sets:
 For FAR, we collected a number of fingerprints from
lecturers and students of Hanoi University of
Technology to form a database call FA set. During
enrollment, a user’s fingerprint will be matched against
 the fingerprints in this FA set in order to extract FAR. For each finger, call q i the quality of the snapshot number i,
The more typical FA set is, the more accurate FAR we 0 ≤ i <N. We use the following algorithm to match every
get. pair of fingerprint snapshots:
 For FRR, on enrolling, a user will be asked to provide a
number of different snapshots of his fingers. These For i=0 to N-1
F[i]=0;
snapshots will form another sample set, say FR set. FR
End for
set will be used for calculating FRR. Just like FA set,
the more typical and the bigger FR set is, the more For i=0 to N-2
accurate FRR we get. For j=i+1 to N-1
Match snapshots number i and j, with
At the present, our solution has just been tested with two predefined threshold T
fingerprints captured with Biometrika device. That being If matching successes
said, the scores at the output are on the same scale, says F[i]=F[i]+1;
0<Si<1. Hence, there is no need for a matching score F[j]=F[j]+1;
End if
standardization module in the solution.
End for
End for
Another thing to be kept in mind is that in our solution,
instead of M biometric traits at the input, we use M units of max=0;
a single biometric trait - fingerprint in particular. imax=0;
qmax=0;
Next, we will discuss in details the algorithm used in the
proposed solution, including algorithm that chooses the best For i=0 to N-1
biometric sample of a user in enrollment phase and If (F[i]>max) and (q[i]>qmax)
algorithm that chooses the appropriate value for w and T. max=F[i];
imax=i;
qmax=q[i];
End if
3.1 Biometric Snapshot Choosing Algorithm in End for
enrollment phase
In the above algorithm, F is an array which contains the
When a user enrolls, he is asked to provide the fingerprints
number of successful matching of each snapshots when
of two of his fingers. With each finger, the system will
matched again all other snapshots. The best snapshot is
capture N snapshots of its fingerprint. From these N
chosen as the snapshot number i where F[i] is the greatest
snapshots, we will select the best one to use for enrolling
value in the array. If there are more than one snapshot with
user; the rest will be used to calculate FRR in later stages of
the same F, the chosen snapshot is one that has the greatest
the solution. So how do we find out the best fingerprint?
quality.
With the library that comes together with Biometrika device,
After choosing the best snapshot for each fingerprint, we use
we can extract a value q that presents the quality of a
these two snapshots to enroll user. The rest, as mentioned
fingerprint image. However, depending on q alone to decide
above, are used for calculating FRR.
the best fingerprint image is not enough. Because the way a
user press his finger on the scanner might distort the image
3.2 Fusion Parameters Choosing Algorithm
captured. These distorted images, while do not represent a
good fingerprint image, might still have a high quality. If This section discusses about the algorithm used for choosing
taken as enrolled fingerprints, these fingerprint images w and T in order to minimize (FAR+FRR).
could affect negatively the accuracy of our biometric
system. Thus, we propose an algorithm to choose the best 3.2.1 Brute Force Algorithm
fingerprint image among the images taken when a user
enroll. As mentioned, let say there are M biometrics units of a
single biometric trait (M fingerprints of M fingers in our
 solution) and w is weight vector, where w[j] is the weight of
biometric unit number j, 0 ≤ j < M, ∑w[j]=1.
a) Brute Force Algorithm
With brute force approach, we will check every value of
w[j] (0<=j<M) and T in their domain with a step of b.
1) Let T run from 0.0 to 1.0
2) With each value T i of T, let w varies in the
following manner:
 W[0] runs from 0.0 to 1.0
 W[1] runs from 0.0 to (1.0 – w[0])
 ...
 W[j] runs from 0.0 to ( ) 
 ...
 algorithm is.
3) With each value wk of w from step 2, calculate FAR
and FRR using the FA and FR sets discussed above.
Assign E i[wk]=FAR+FRR.
4) Through statistics, find the value w k which
minimizes E i[wk]. Let say the minimized value is
Emini and the value of w at that point is w mini
(Figure 3a). Choose this wmini as the chosen value of
w for threshold T i. In case, there is not only one
value of wk that minimizes E i[wk] but there is a
whole value domain D wk of wk where E i[wk]=Emini
(Figure 3c), choose the center of D wk as the wmini.
After this step, for each value T i of threshold T in
the range [0,1] (with a step of b), there is one
corresponding weight vector wi and the minimized
error Emini.
5) Through statistics, find the value T i of threshold T where
Emini is minimized (Figure 3b). Say the minimized value is
Emin and the corresponding threshold is Tmin. Like weight
vector, in case Emin i has the minimized value in a value
domain D T instead of a single value of threshold, choose the
center of D T as Tmin.
With brute force algorithm, we can choose the desired
threshold Tmin and weight vector w min. These two values
that minimized (FAR+FRR) will be used for user
verification later on.
Figure 3 Choosing w and T (with M=2)
a) T is constant. FAR+FRR depends on w[0]
b) FAR+FRR depends on T (with chosen w[0])
c) FAR+FRR is minimized on a value domain of w[0]
b) Complexity of Brute Force Algorithm
The complexity of Brute Force Algorithm depends on:
Varying step of w[i] and T: the greater the varying step
b is, the lower the cost is but the less accurate the
 The number of biometric units (M) that are integrated:
the greater M is, the higher the cost is.
 Size of FA and FR sets: the bigger those sets are, the
higher the cost is but the more accurate FAR and FRR
are.
The complexity of brute force algorithm is n*mM*(k+l).
Where:
 n: the number of division points of T, n=1/b
 m: the number of division points of w[i] (0<=i<M),
m=1/b
 M: number of biometric units integrated
 k: FA set size
 l: FR set size
3.2.2 Improve Brute Force Algorithm
Note: The improvement discussed below has only been
tested with the case of two fingerprints (M=2). Extension for
M>2 would be tested in the near future.
In the case M=2, vector w consists of two elements and
w[0]+w[1]=1. (FAR+FRR), then, becomes a function of
w[0] instead of w.
The problem now is to find the value domain D wk of w[0]
where (FAR+FRR) reaches its minimum, with a specified
value of threshold T.
a) Improved Brute Force Algorithm to choose w with
a specified T
In order to improve Brute Force Algorithm to choose w for a
specified T, let’s have a look at the graphs of function err,
where err(w[0])= FAR(w[0])+FRR(w[0]), with a specified T
(Figure 4). As it is shown in Figure 4, there are only four
cases:
the chosen w[0] and then assign w[1]=1.0-w[0]. To
this point, we have chosen an appropriate value for
weight vector w that minimizes (FAR+FRR) at a
specified threshold T.

 Figure 4a: Monotonically non-increasing function,

err reaches its minimum at the right-most point of
the graph.
 Figure 4b: Monotonically non-decreasing function,
err reaches its minimum at the left-most point of the
graph.
 Figure 4c: Convex upward function, err reaches its
minimum at either its left-most or right-most point
of the graph.
 Figure 4d: Concave upward function, err reaches its
minimum at either its left-most or right-most point
of the graph.

Based on the above observation and the idea of binary

search algorithm, we proposed the improved brute force
algorithm as follow:
Figure 4 FAR+FRR varies according to w[0] (M=2)
(1) Start with a value domain K of w[0]. At the
beginning K=[0,1].
(2) Pick five values of w[0] in K and store in the
weight value net wNet, which is actually an array
(Figure 5). Enumerate these values 0 to 4.
 wNet[0]=w1
 wNet[4]=w2
 wNet[2]=(w1+w2)/2
 wNet[1]=(wNet[0]+wNet[2])/2
 wNet[3]=(wNet[2]+wNet[4])/2
(3) Calculate err=FAR+FRR at the above five values of
w[0]. Accordingly, we get 5 points on the graph of
function err(w[0]).
(4) By judging the relative position of those five points,
we can narrow domain K down to domain K’ and
still be sure that K’ contains the values of w[0] that
Figure 5 Weight net - wNet
minimize err. Details on how to narrow down K
will be discussed below, on section b.
(5) Repeat step 1, 2, 3, 4 until K is narrowed down to
Dwk, where err doesn’t change throughout domain
Dwk.
(6) Finally, we acquire a value domain D wk of w[0]
where err is minimized. Pick the center of D wk as
 Figure 6 Narrow K down to D wk
b) Algorithm to narrow down K to D wk
At step four of the improved algorithm, we have got the
value of (FAR+FRR) at five points of the value net wNet.
Based on the observation about the graph of function
err(w[0]), we can narrow K down as follow (Figure 6):
(4a) Find out the smallest value min_err of err among those
above five points.
(4b) Let’s call nCount the number of points among those
five points where err=min_err (0<nCount<=5) and call iStart
and iEnd the index of left-most and right-most points of the
range where err=min_err respectively. (0<=iStart,iEnd<=4)
(4c) Narrow K down depending on the value of nCount
 nCount=1 (Figure 6a): iStart=iEnd
o Assign:
 i = iStart>0 ? iStart - 1 : 0
 j = iStart<4 ? iStart +1 : 4
o K’=(wNet[i],wNet[j]).
o Narrow K down to K’. Back to step (1)
 nCount=2 (Figure 6b):
o K’=(wNet[iStart],wNet[iEnd]).
o Expand two ends of domain K’ with a step of b
as long as err<=min_err and two ends of K’ still
belong to K.
o Narrow K down to K’. Back to step (1)
 nCount >=3 (Figure 6c,d,e):
o K’=(wNet[iStart],wNet[iEnd]).
o Expand two ends of domain K’ with a step of b
as long as err<=min_err and two ends of K’ still
belong to K.
o Assign D wk = K’ and stop.
In case nCount>=3, the algorithm terminates and we get the
desired domain D wk (step 5) and the desired w[0] (step 6).
The improved algorithm has much lower complexity in
comparison with the brute force algorithm.
4. Algorithm Implementation and Experimental
Result
The algorithm was implemented on Microsoft Visual C++
with the following parameters:
 M=2
 b=0.01
 Value domain of both T and w[0] is [0,1]
Fingerprint images are captured, processed and matched
using Biometrika device and its programming library. The
fingerprint database used for the test contains 142
fingerprints captured from fingers of lecturers and students
of Hanoi University of Science and Technology, each
fingerprint is captured 30 times. Thus, the size of the
database is 142*30=4260 fingerprint snapshots.
Among 30 snapshots of each fingerprint, only the first 5
snapshots are used by the algorithm. In other words, the FR
set of each fingerprint mentioned in previous sections is
formed by the first 5 fingerprint snapshots. But all 30
snapshots will be used when assessing the result produced
by the algorithm.

For FAR, the FA set of each fingerprint is formed by

gathering the first 5 snapshots of all other fingerprints in the
database.

In our experiment, we pick the best fingerprint snapshot

from the first five snapshots as the enrolled fingerprint. The
test will check every pair of fingerprints taken from 142
fingerprints of the database. Thus, the number of fingerprint
pairs tested is 142*141/2=11011.

We will compare the following scenarios:

Figure 8 ROC Curve
 Using one fingerprint
Figure 8 illustrates ROC curve. From this graph, we can
 Using two fingerprints
easily spot that with the same FAR, FRR in the case we use
o Weight of every biometric units are equal and
our proposed algorithm is much smaller than that in other
equals 1/M
cases. This also means that the accuracy of our proposed
o Weight of biometric units is proportional to the
system is improved significantly.
quality of the enrolled fingerprints.
o Weight of biometric units is chosen by using 5. Integration into BioPKI System
the improved brute force algorithm we propose.
With promising results as shown in section 4, our proposed
Following are the experimental result: multibiometric solution has been integrated into the BioPKI
system of the State Key S&T Program KC.01.11-06/10.
ERR Before discussing in details how the solution has been
(Equal ZeroFAR ZeroFRR
Error (%) (%)
integrated, let’s have a look at the BioPKI system
Rate) (%) architecture:

One Fingerprint 2.57 40.75 90.46

Two Fingerprints
0.35 19.21 82.79
(quality based)

Two Fingerprints
0.21 18.10 90.35
(w[0]=w[1]=0.5)

Two Fingerprints
0.17 1.63 86.81
(proposed algorithm)

Figure 7 Experimental Result: EER. ZeroFAR, ZeroFRR

Figure 7 shows that when combining two fingerprints, the

accuracy of the system, in terms of EER, ZeroFAR and
ZeroFRR, are improved remarkably in comparison to using
only one fingerprint. In particular, the proposed algorithm
produces better results in comparison to other two- Figure 9 BioPKI System Architecture
fingerprint scenarios.
The PKI architecture that was chosen for BioPKI system is
Single CA Architecture, including:
- CA: consists of two parts
o OpenCA: provides core services of PKI
o CA Operator: is a management tool for CA
administrator
- RA: consists of two parts
o Registration Center: provides Bio-Etoken
services, such as issue, revoke, reissue
certificate.
o Certificate Service Center: provides certificate
services such as digital signature, certificate
verification...
- LRA: directly communicate with users to issue, reissue,
and revoke certificates.
- User applications: allow users to connect to Certificate
Service Center to use certificate services.
The multibiometric solution has been integrated into the
following three phases:
 User enrollment at Local Registration Authority (LRA)
 Bio-Etoken creation at CA-Operator
 User Authentication when reading Bio-Etoken at user
applications
a) Integration into user enrollment phase at LRA
At LRA, users’ biometric data would be captured together
with other private information. A user will be asked to
provide the fingerprints of two of his fingers. By default,
those two fingers are his left and right index fingers. With
each finger, a supervisor will check by naked eye if the first
fingerprint captured is acceptable. If not, user will be asked
to either capture fingerprint again or change to another
finger. Otherwise, user will be asked to provide four more
snapshots of the same fingerprint.
In total, there are five snapshots of each fingerprint. From
these snapshots, the best ones will be chosen as enrolled
fingerprints using the algorithm introduced in 3.1. After
that, for each finger, the matching scores between the
chosen fingerprint and the rest of the captured fingerprints
will be calculated to prepare for FRR calculation later on.
Finally, biometric information of the two fingers of each
user will be stored by LRA, including:
- Index of the two chosen fingers
- Biometric templates of the two chosen fingerprints
- Matching scores for FRR calculation
This information will be sent to RA together with certificate
requests.
b) Integration into Bio-Etoken creating process at
CA-Operator
At CA-Operator, users’ information will be written to Bio-
Etoken. Along with users’ private key and certificate, their
biometric data will also be written.
Firstly, CA-Operator receives a user’s biometric data from
RA, including
- Index of the two chosen fingers
- Biometric templates of the two chosen fingerprints
- Matching scores for FRR calculation
Next, matching scores used for FAR calculation will be
calculated using the FA set. After that, weight vector w and
Threshold T will be chosen using the proposed improved
brute force algorithm. Finally, CA-Operator will get all the
biometric data it needs and write to Bio-Etoken. The
biometric data consists of:
- Index of the two chosen fingers
- Biometric templates of the two chosen fingerprints
- Weight vector w and threshold T.
c) Integration into user authentication process when
reading Bio-Etoken at user applications
Whenever a user needs to read his private key from Bio-
Etoken he needs to be verified biometrically. More
specifically, his fingerprints will be matched again the
fingerprints stored in Bio-Etoken. If he is verified
successfully, he will be able to read the token; otherwise he
cannot. The biometric verifying process is carried out as
follow:
- User’s enrolled biometric data will be read from Bio-
Etoken, including:
o Index of the two chosen fingers
o Biometric templates of the two chosen
fingerprints
o Weight vector w and threshold T.
- User is required to put his two fingers that have been
chosen on the scanner.
- User’s fingerprints are verified with w and T read from
token.
- Verification result is returned to main program.
Based on the verification result, user application will decide
if user can read information from Bio-Etoken or not.

6. Conclusion

In this paper, we have proposed a multimodal biometric

solution at matching score level together with an algorithm
to choose weight vector and threshold. Experimental results
prove that error rates of the biometric system when using
multimodal biometrics are significantly smaller than that
when using unimodal biometrics.

With promising results, the solution proposed has been

integrated into the BioPKI system of the State Key S&T
Program KC.01.11-06/10.

In the near future, we would expand the solution for the case
of multiple biometric traits instead of multiple units of a
single biometric trait at the moment.

7. References

[1] Anil K. Jain and Arun Ross, “Multibiometric Systems”,

Journal Communications of the ACM”, Vol. 47, No. 1 2004.

[2] Anil Jail, Ruud Bolle, Sharath Pankanti, “Biometrics –

Personal Identification in Networked Society”, Kluwer
Academic Publishers, 2002.

[3] Paul Reid, “Biometrics for Network Security”,Prentice

Hall, 2003.

[4] Yoshifumi Ueshige, “A Study on Biometrics

Authentication in BioPKI”, Institute of Systems & Information
Technologies, KYUSHU, 2005

[5] Samir Nanavati, Michael Thieme, Raj Nanavati,

“Biometrics Identity Verification in a Networked World - A
Wiley Tech Brief”, John Wiley & Sons, Inc, 2002.

[6] Uludag, Anil K. Jain et al “Biometric Cryptosystems:

Issues and Challenges”, Proceedings of the IEEE, Vol.92, No.
6, pp. 948-960, June 2004.

[7] FX3 SDK User Guide.