I'm a beginner to security, and I had a question about biometric match thresholds. Does a higher threshold signify that the system follows a strict(er) policy? Also, suppose I have a threshold of 0.5; does it mean that the sample must be at least a 50% match of the reference template?
How exactly is a threshold calculated?
The match threshold is specific to both the type of biometric and the individual implementation. In academic terminology, the match threshold is generally measured as a percentage of features matched, although each feature does not necessarily contribute an equal value, nor does each feature necessarily contribute to a single global score. It is fairly common to find that biometric systems produce several different properties during comparison, each with their own separate algorithm and threshold. Common units for scores are a percentage, a ratio of matched to unmatched features, or a dimensionless number.
As an example, fingerprints have three main characteristic patterns: arches, loops, and whorls. One can trace each ridge on the print sample, vectorise it, and categorise it as part of one of the three pattern types. While absolute locations are generally not useful, the inter-ridge distances and relative positions of features (e.g. the peak of an arch or the extents of a whorl) are much more reliable for comparison. In a single fingerprint, one can match the presence of features, the weighted average inter-ridge distances across the sample, and the extents of the features. Each of these scores is produced by its own algorithm to perform the comparison, which outputs its own convenient type of result (e.g. a percentage), and is generally configured with an individual threshold based on the accuracy and security requirements of the system.
Threshold values are generally developed through trial and error, influenced by statistics such as False Acceptance Rate (FAR) and False Rejection Rate (FRR). You can read more about computing FAR and FFR here.
