Using Windows Biometric Framework (WBF) and Your Fingerprint to Log into Windows 7/8/8.1/10

Biometrics technology is a widely used technology for identification and verification. It provides convenient access to systems, services and resources. Biometric technology is based on measuring the unchanging physical characteristics of an individual to uniquely identify that person. Fingerprint recognition is the oldest and the most deployed biometric recognition technique. It is one of the most economical biometric PC user authentication techniques and has a very high accuracy rate. Millions of fingerprint biometric devices are now embedded in personal computers and peripherals.

The Windows Biometric Framework (WBF) comprises of a set of services and interfaces which support the consistent development and management of biometric devices such as fingerprint readers. It also enhances the reliability and compatibility with biometric services and drivers and allows device developers to interact with the client side of the framework that supports each biometric solution.

The Windows Biometric Service is a part of the WBF and enables client applications to capture, compare, manipulate, and store biometric data without having direct access to the biometric hardware or samples. The Windows Biometric Service runs in the security context of Local System and is hosted in a privileged SVCHOST process.

In order to use fingerprint recognition technology in devices having versions earlier than Windows 7, fingerprint device vendors were required to provide their own USB drivers, SDKs and applications. This resulted in a variety of proprietary solutions lacking a homogeneous user experience and a common management platform for all fingerprint biometric devices which complicated the process of applying fingerprint recognition products in Windows.

The solution to this was the Windows Biometric Framework introduced in Windows 7. This framework supports fingerprint recognition products through a new set of components and provides a common management platform for different fingerprint recognition products thus enhancing the quality, reliability and consistency of the customers’ user experience while using fingerprint recognition products.

Some of the practical applications of WBF are listed below:

• A biometric device item on the control panel – It allows users to manage device settings.
• Device Manager – It allows users to troubleshoot biometric fingerprint devices and manage biometric device drivers.
• Credential support – Allows to log on to a local computer or domain using biometric data and then elevate the privileges through User Account Control (UAC)

It also provides Group Policy Settings for enabling, disabling or limiting the biometric data usage for a local computer or domain.

• Supported Devices: Hamster Plus, Hamster IV, Hamster, Hamster Pro, Hamster Pro 20 etc.
• Supported OS: Windows 10, 8.1, 8, 7, Windows Server 2012 & Windows Server 2008 R2

In the guide below we show how to Setup fingerprint Login using a Secugen fingerprint Scanner. This works with Hamster Plus, Hamster IV, Hamster, Hamster Pro, Hamster Pro 20 etc.

Pre-requisite: Your computer must be connected to the internet during installation.

Steps:

• Plug in the fingerprint reader to your computer. When the fingerprint reader is plugged in the first time, the WBF driver will be automatically downloaded from the Microsoft Windows Update Website and installed by Windows. Otherwise, you can also download it from the fingerprint reader’s website.

• If the above message is displayed, click Install this driver software anyway to go ahead with the installation.
• If any other non-WBF device drivers were installed on your PC previously, you must install those device drivers before installing the WBF driver. Go to Control Panel and open Device Manager. Go to Biometric Devices and right-click the non-WBF device to select it. Then click Uninstall. Make sure that the option Delete the driver software for this device is selected during uninstallation. After the uninstallation finishes, unplug the fingerprint reader and then plug it again into the PC. At this point, the WBF driver and installation should start automatically.

For Windows 8.1 Users:

Windows 8.1 users are not required to install the FMA software as it is already built into Windows 8.1 OS. Proceed directly to the section – HOW TO ENROLL FINGERPRINTS AND LOGIN TO WINDOWS 8.1

For other windows OS Users:

All other Windows users need to install the Fingerprint Management Application software which allows them to register and manage fingerprints.

Double-click the FMA software installation file. This will start the installation.

After successful installation of the FMA software, you will be able to see your fingerprint device reader in the Biometric Devices Control Panel as shown below.

• On Windows 7 and 8, you can use the Fingerprint Management Application to enrol and delete fingers associated with your Windows account and it can be accessed from the Biometric Devices Control Panel. Go to Hardware and Sound and click on Biometric Devices. Then click Use your fingerprint with Windows.

On the following window shown below, click Continue.

• In the FMA window, click on the white tip of a finger to select the finger for enrollment.

• Then place your selected finger on the reader. When asked by the FMA, release and then press your finger again. This should be done for a total of three scans to ensure proper enrollment of your finger.

• After successful enrollment, close the FMA window or select another finger to enroll.

Note: A successful enrollment is indicated by the green colored tip of the enrolled finger. You can also delete an already-enrolled finger by clicking on the green tip. It is also possible to re-enroll a finger after deleting it.

• You can open the FMA window again by clicking on Manage your fingerprint data from the Biometric Devices Control Panel as shown below.

• Biometrics should be turned ON in order to use fingerprint login. If the WBF driver has been properly installed, biometrics should be turned on by default. You can change biometric settings from the Biometric Devices Control Panel as shown in the above figure.

• You can control fingerprint login to Windows by selecting Biometrics on or Biometrics off from the Change Biometric Settings window. After selecting Biometrics on, make sure that you have checked the box Allow users to log on to Windows using their fingerprints. Click on Save Changes.

• When you try to login to Windows for the first time using your fingerprint, you will be required to enter your current password. This allows Windows to verify your account information before enabling fingerprint login. For successive logins, you don’t need to enter your password and you can login simply with your fingerprint.

• In Windows 8.1, you can enroll and manage fingerprints through Account Settings. Move your mouse pointer all the way to the upper-right or the lower-right corner of the screen until the Charms bar appears. Then click on Settings at the lower-right corner of the screen.

• Click on Change PC settings at the bottom of the Settings bar.

Alternatively, you can also search for PC settings using the Search function from the Charms bar.

• Select Accounts from the PC settings screen.

• Select Sign-in options from the Accounts screen. Fingerprint should be listed in the options. To add fingerprint to your account, click on Add under Fingerprint.

• Before accepting your fingerprint, Windows will ask for your password.

• Place your finger on the fingerprint reader. The same finger will be scanned several times to ensure proper enrollment. Proceed as per the prompts on the screen.

• After successful fingerprint scanning of one finger, click on Finish to save the scanned fingerprint to your account.

• You can add more fingerprints by clicking on Add another under Fingerprint.

• You will need to verify your account using your fingerprint. Alternatively, you can verify by clicking on Choose another option.

• Repeat steps 6 and 7 to add another fingerprint.

• To avoid duplication, Windows compares any newly added fingerprint to all registered fingerprints on your PC. An error will be displayed if you try to add a previously-registered finger.

• You can now use any of your registered fingerprints to login to Windows or access the Windows app store.

• You can remove registered fingers by clicking Remove all from the Sign-in options screen. You need to be careful with this option as it will delete all registered fingerprints at one time.

Windows fingerprint login is implemented in PCs using the WBF and is a remarkable evolution in biometrics security. Fingerprint biometrics solution is the most real-time authentication available and its integration within Windows OS is helping enterprises deploy fingerprint authentication technology on a larger scale.

The WBF was initially implemented on Windows 7 and Windows Server 2008 R2 and now it’s available on all Windows OS. WBF provides a common-management platform for all fingerprint readers thus creating a mass-market opportunity and making biometrics solution quite easily available to consumers.

Prior to the implementation of integrated Windows fingerprint login using WBF, different fingerprint readers had its own set of proprietary solutions leading to increased cost, incompatibility issues and reduced user satisfaction. Windows integrated fingerprint login through WBF has been able to overcome all these disadvantages by providing a standard platform for fingerprint readers leading to a consistent user experience. This has also improved the scalability and availability of this biometric technology.

In Windows 8.1 fingerprint authentication is better integrated into the OS enabling users to easily set up fingerprint-scanning devices and take advantage of fingerprint-based authentication. Users can now access Windows store and purchase apps using fingerprint authentication. The only requirement for this is the Microsoft account authorizing the transaction should be associated with the Windows user on the PC where the transaction is being performed.

Windows 8.1 users can also establish a remote desktop connection using fingerprint-based authentication.

Privacy concerns have also been taken care of in Windows fingerprint login. When a fingerprint is scanned, only the distinct features of the fingerprint are identified, processed and stored as a template. This template does not contain enough data to reproduce the fingerprint image. Thus it provides an extremely secure user authentication method.

Windows fingerprint login provides the ability to enroll multiple fingers. If there is a problem with one finger, still there are 9 fingers with which the fingerprint technology can be used.

It is a proven fact that fingerprint recognition technology has a high level of accuracy and can reach nearly 100% recognition rate in good quality images.

It is difficult but not impossible to steal a fingerprint. That being said, it is quite possible that criminals might find a way to steal fingerprints and deceive the fingerprint scanner. An intruder can acquire the fingerprint impressions lifted from some other surface like a drinking glass and use these prints to login to the device. Criminals can even cut off someone’s finger for the print and then access the device.

If intruder gains access to the user’s device using the above methods, there could a serious loss of data and the intruder can steal the user’s identity and commit frauds with the stolen identity.

The fingerprint reader needed for fingerprint capture is not yet present on desktops unlike embedded microphones for voice recognition.

The fingerprint scanner might not be able to enroll some users due to poor quality of fingerprints, mostly encountered in the elderly and manual workers.

In this article, we discussed the features of Windows Biometric Framework and its many advantages. We also looked at the step-by-step procedures on how to set up Windows fingerprint login.