Google Outlines the Minimum Requirements for OEMs to Integrate Fingerprint Scanners on Android 6.0

One of the coolest things about the new Nexus phones: Nexus 6P and Nexus 5X are the new fingerprint sensors that come with the device. Not only are they really well placed but electrically fast. In fact, several videos online have compared the performance of Nexus Imprint to the Touch ID and concluded that the Google lead product outperforms the iPhone by a fair bit.

While this is great news for those who are going to pick one of the two Nexus phones, how will the same fair for other OEMs given that Android has official support for fingerprint scanners starting from Marshmellow? If you are pondering on the same, then Google has made things a little easier and laid out a framework wherein they have laid the basic requirements that all OEMs should fulfill before integrating fingerprint scanner. They are as follows:

7.3.10. Fingerprint Sensor
Device implementations with a secure lock screen SHOULD include a fingerprint sensor. If a device implementation includes a fingerprint sensor and has a corresponding API for third-party developers, it:

MUST declare support for the android.hardware.fingerprint feature.
MUST fully implement the corresponding API as described in the Android SDK documentation [Resources, 95].
MUST have a false acceptance rate not higher than 0.002%.
Is STRONGLY RECOMMENDED to have a false rejection rate not higher than 10%, and a latency from when the fingerprint sensor is touched until the screen is unlocked below 1 second, for 1 enrolled finger.
MUST rate limit attempts for at least 30 seconds after 5 false trials for fingerprint verification.
MUST have a hardware-backed keystore implementation, and perform the fingerprint matching in a Trusted Execution Environment (TEE) or on a chip with a secure channel to the TEE.
MUST have all identifiable fingerprint data encrypted and cryptographically authenticated such that they cannot be acquired, read or altered outside of the Trusted Execution Environment (TEE) as documented in the implementation guidelines on the Android Open Source Project site [Resources, 96].
MUST prevent adding a fingerprint without first establishing a chain of trust by having the user confirm existing or add a new device credential (PIN/pattern/password) using the TEE as implemented in the Android Open Source project.
MUST NOT enable 3rd-party applications to distinguish between individual fingerprints.
MUST honor the DevicePolicyManager.KEYGUARD_DISABLE_FINGERPRINT flag.
MUST, when upgraded from a version earlier than Android 6.0, have the fingerprint data securely migrated to meet the above requirements or removed.
SHOULD use the Android Fingerprint icon provided in the Android Open Source Project.

The above listed are guidelines that Google has published in its Marshmellow CDD or Compatibility Definition Document. While it is not compulsory to follow these guidelines, it is better for the OEMs to follow them for a better experience of their users.

Leave a Reply

Your email address will not be published. Required fields are marked *