Biometric Authentication System · Hacking Project

Build a privacy-preserving biometric authentication system with liveness detection and cancelable template protection.

**The problem**
Biometrics promise passwordless convenience but introduce irreversible-credential risk: a leaked template cannot be reset, and naive systems are vulnerable to presentation (spoofing) attacks, replay, and template theft. Many implementations store raw biometrics and lack liveness detection, violating privacy regulations. Engineers rarely learn to build biometrics with template protection and anti-spoofing.

**What you'll build**
Build a biometric authentication system (face and/or fingerprint) with liveness/anti-spoofing detection, cancelable-biometric template protection (biohashing or fuzzy vault), and secure enrollment/verification flows. Store only protected templates, integrate with a standards-based auth flow (FIDO2 as a fallback), and evaluate FAR/FRR and presentation-attack detection rates.

**Objective** — Build a privacy-preserving biometric authentication system with liveness detection and cancelable template protection.

**Expected outcome** — A working biometric auth system with anti-spoofing, protected-template storage, and an evaluation report (FAR/FRR, PAD rate).

**Difficulty** — Advanced — combines ML for recognition/liveness, cryptographic template protection, and privacy-by-design engineering.

**Primary category** — IAM; Secondary = AI/ML Security, AppSec, Privacy Engineering

**Security domains** — Primary = AI Security; Secondary = IAM, AppSec, Cloud Security, GRC

**Technical focus** — Face/fingerprint recognition, presentation-attack detection (liveness), cancelable biometrics, template protection, FAR/FRR evaluation, secure enrollment, adversarial-ML robustness, privacy engineering

**Core technologies** — Languages: Python; Frameworks/Libraries: OpenCV, dlib, PyTorch/TensorFlow, face_recognition, scikit-learn; Security Tools: FIDO2/WebAuthn libs, adversarial testing (ART); Cloud/Infra: Docker, secure enclave/HSM concepts, KMS; AI/Data: CNN models, liveness datasets; Databases: encrypted store for protected templates (PostgreSQL + envelope encryption)

**Where it's valued** — Fintech, mobile/device manufacturers, physical access control, healthcare, border/identity, consumer apps

**Careers it builds toward** — AI Security Engineer, IAM Engineer, ML Security Researcher, Application Security Engineer, Privacy Engineer

**Framework alignment**
• MITRE ATLAS: Evasion via adversarial examples/presentation attacks (spoofing the ML model), ML model theft, data poisoning of enrollment; ATT&CK: Multi-Factor Authentication (T1621 context), Steal Credentials
• NIST CSF 2.0: Protect (PR.AA, PR.DS), Identify (ID.RA), Detect (DE.CM); aligns with NIST 800-63B biometric guidance
• OWASP: A07 Identification & Authentication Failures; OWASP ML Top 10 (ML01 input manipulation, ML02 data poisoning); MASVS-AUTH for mobile
• CIS Controls v8: 6 Access Control Management, 3 Data Protection, 5 Account Management