← VCE Data Analytics U4O2

Biometric authentication

Proves who you are using a physical or behavioural trait, such as a fingerprint, face or voice, that is matched against stored data. It can wrongly accept or reject users.

Part of: VCE Data Analytics - U4O2 - Cyber Security: Data Security — Module 43, IGCSE Computer Science 0478 — 5.3 Cyber Security — Module 28, ACARA Digital Technologies Years 9–10 — Networked Systems and Access Control — Module 109

Understanding Biometric authentication in VCE Data Analytics U4O2

What it does: If the matching threshold is too low, the system may grant access to the wrong person, which is a false accept. Unlike a password, a face or fingerprint cannot be changed if stolen, so protecting biometric data through encryption supports privacy. Biometrics use a physical or behavioural trait of the person. A PIN is something you know, not something you are. Biometric systems match a live scan against stored biometric data. A secret phrase would be a knowledge factor. A false reject locks out a genuine user. It is frustrating and can disrupt work, but it is not a security breach.

Common mistakes: The new scan is compared with itself, so it would always match. It must be compared with the stored template: match(scan, template). Face recognition needs a picture of the face. The program should call captureFace(), not record a voice.

Class: _____________________ · Name: _____________________ · Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Biometric authentication to a class →

This module's key terms are also in a printable crossword (Modules 26–43) and word search (Modules 1–43).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning

Duo

Which of these is an example of biometric authentication?

Unlocking a phone with a fingerprint scanUnlocking a phone with a 4-digit PIN

Matches

biometric_data = "face_scan.jpg" # stored as plain text, unprotected

↓

Biometric data is stored as an unencrypted raw image. If the database is breached, the traits cannot be reset like a password, creating a serious privacy risk.

Applying

Meanings

Term

biometric authentication

Meaning

Proves who you are using a physical or behavioural trait, such as a fingerprint, face or voice, that is matched against stored data. It can wrongly accept or reject users.

Practice

scan ← CaptureFingerprint()

Testing

Gaps

matchscore >= 80 THEN grantaccess()

Check Answer

Spots

2template ← getTemplate(user)

3score ← match(scan, scan)

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy

Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games

Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print

Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. Which of these is an example of biometric authentication?

A. Unlocking a phone with a fingerprint scan ✓

B. Unlocking a phone with a 4-digit PIN

Biometrics use a physical or behavioural trait of the person. A PIN is something you know, not something you are.

2. What does a face recognition system do to check who you are?

A. Compares your face to a stored template ✓

B. Asks you to recall a secret phrase

Biometric systems match a live scan against stored biometric data. A secret phrase would be a knowledge factor.

3. A false accept happens when a biometric system...

A. Blocks a person who is authorised

B. Lets in a person who is not authorised ✓

A false accept wrongly lets the wrong person in, which is a security risk. Blocking a real user is a false reject.

4. A false reject happens when a biometric system...

A. Blocks the real, authorised user ✓

B. Lets an attacker in by mistake

A false reject locks out a genuine user. It is frustrating and can disrupt work, but it is not a security breach.

5. Which trait is a behavioural biometric?

A. Fingerprint ridges

B. Voice pattern or typing rhythm ✓

Voice and typing patterns describe how a person acts. Fingerprints are a physical trait.

Match the Pairs

method = "fingerprint scan" → A physical biometric trait: the unique pattern of ridges on a finger is matched against a stored template to prove identity.

result = "false reject" → The system wrongly refuses a genuine, authorised user because their biometric does not match closely enough.

A false accept is a serious security risk because an impostor's biometric is wrongly matched to a real user. → if match_score >= threshold: grant_access()

Biometric data is sensitive personal information, so templates should be stored encrypted rather than as raw images. → store(encrypt(face_template))

biometric_data = "face_scan.jpg" # stored as plain text, unprotected → Biometric data is stored as an unencrypted raw image. If the database is breached, the traits cannot be reset like a password, creating a serious privacy risk.

authentication = "voice recognition uses something you know" → Voice recognition is a biometric, so it is something you are, not something you know. Passwords and PINs are the something you know factor.

Key Term

biometric authentication

Proves who you are using a physical or behavioural trait, such as a fingerprint, face or voice, that is matched against stored data. It can wrongly accept or reject users.

Fill in the Blanks

1. IF match_score >= 80 THEN grant_access()

Hint: Type the pseudocode keyword that starts a decision based on the match score

2. A false accept lets an impostor in

Hint: Type the word for wrongly letting the wrong person in, the error that lets an impostor through

3. A false reject blocks the real user

Hint: Type the word for wrongly denying a genuine user, the opposite of letting them in

4. Biometric data is sensitive information

Hint: Type the privacy law category that biometric data falls into and needs extra protection

5. match ← compare(scan, template)

Hint: Type the variable holding the stored biometric data that the new scan is compared against

Spot the Error

Question 1

A scan ← captureFingerprint()

B template ← getTemplate(user)

C score ← match(scan, scan)

D IF score >= threshold THEN

E grant access

Line C — The new scan is compared with itself, so it would always match. It must be compared with the stored template: match(scan, template).

Question 2

A image ← captureVoice()

B features ← extract(image)

C score ← match(features, saved)

D IF score >= threshold THEN

E unlock phone

Line A — Face recognition needs a picture of the face. The program should call captureFace(), not record a voice.

Question 3

A threshold ← 0.95

B IF score <= threshold THEN

C DISPLAY 'Access granted'

D ELSE

E DISPLAY 'Access denied'

Line B — The check is reversed. It would grant access to poor matches and reject good ones. It should be score >= threshold.

Question 4

A accepted ← 3

B imposters ← 100

C FAR ← accepted * imposters

D DISPLAY FAR

Line C — The false accept rate is a proportion. It is the number of imposters wrongly accepted divided by the number of imposter attempts, so it needs / not *.

Question 5

A rejected ← 0

B IF owner AND score >= min THEN

C rejected ← rejected + 1

D ENDIF

Line B — A false reject is when the real owner is turned away. That happens when the score is below the minimum (score < min), not at or above it.

Student with a class code? Join your class →