Mobile Biometric Security: Face ID, Touch ID and In-Display Authentication

Your phone's unlock is a hardware root-of-trust problem disguised as UX. Behind a 300ms tap or glance lies a pipeline of silicon, photonics, and isolated cryptography that must fail closed — every time.

Biometrics won mobile authentication not because they are perfectly secure, but because they are meaningfully more secure than the PIN they replaced — and invisible enough that users actually enable them. The engineering challenge is brutal: authenticate in <400ms, on <80mW, through glass, sweat, and low light, while storing nothing an attacker can replay.

This analysis dissects the three dominant stacks — Apple's Face ID, capacitive Touch ID, and modern in-display fingerprint — at the sensor, signal, and silicon level.

1. The Metrics That Actually Matter: FAR, FRR, and Presentation Attacks

Consumer marketing quotes unlock speed. Security engineers quote two error rates:

The third dimension is Presentation Attack Detection (PAD) — ISO 30107-3 compliance. Can the system distinguish a live finger/face from a silicone mold, printed photo, or 3D mask? PAD is where optical in-display sensors historically lost to capacitive and structured-light systems.

All matching is probabilistic. A template is not an image; it's a 256- to 1024-dimensional embedding vector hashed and encrypted. On enrollment, 5-15 samples are fused into a template protected by a hardware-bound key that never leaves the enclave. The matcher computes cosine distance against the live embedding — threshold determines FAR/FRR balance.

2. Face ID: Structured Light + Neural Engine

Face ID remains the only mass-produced 3D face authentication in phones. Its TrueDepth module is a photonic system, not just a camera.

Hardware stack: Flood illuminator (940nm IR), dot projector (~30,000 invisible dots via VCSEL + DOE), and an IR camera paired with the RGB front camera. The dot projector creates a speckle pattern; the IR camera measures distortion to compute a depth map with ~1mm precision at 30-50cm. A front-facing image sensor pipeline tuned for IR sensitivity is critical here — visible-light ISP tricks are disabled for this path.

That depth map is fused with a 2D IR image into a neural embedding on the Secure Enclave's Neural Engine. Apple’s SEP (Secure Enclave Processor) runs its own microkernel (sepOS), with dedicated SRAM and a hardware AES engine. The A17 Pro / A18 generation performs on-enclave inference in ~90ms using a quantized FaceNet-style model trained to be illumination-invariant.

Liveness is layered: (1) depth — flat print yields zero disparity; (2) IR texture — silicone and paper reflect 940nm differently than skin; (3) attention — gaze detection requires eyes open and directed at device (configurable). If attention fails, unlock is blocked even if depth matches.

// iOS LocalAuthentication — only Boolean leaves SEP
import LocalAuthentication

let context = LAContext()
context.evaluatePolicy(.deviceOwnerAuthenticationWithBiometrics,
                       localizedReason: "Unlock secure vault") { success, error in
  // success == true ? SEP returned signed token : .biometryLockout
  guard success else { // fallback to passcode, rate-limited by SEP counter ; return }
  vault.decrypt(with: context.evaluatedPolicyDomainState)
}

Power matters. TrueDepth fires only after the raise-to-wake + gaze trigger. Standby leakage is negligible — the VCSEL driver is power-gated. Total unlock energy is ~35-45mJ, dominated by Neural Engine inference. For comparison, video codec blocks consume 2-3x more during 4K capture.

3. Touch ID: Capacitive Sensing Done Right

Touch ID (2nd gen, as in iPhone SE and iPad Air) is a 500 ppi capacitive array — 88×88 pixels at ~50µm pitch etched into sapphire. Each pixel is a micro-capacitor: ridge (skin contacting sensor) = higher capacitance (~0.8fF), valley (air gap) = lower (~0.2fF). The ASIC measures delta in ~10µs per scan.

Why capacitive still matters: sub-dermal RF sensing. Modern sensors drive an RF field (2-10 MHz) that images the live layer beneath the epidermis, improving spoof resistance and wet performance vs first-gen optical swipe sensors. Sapphire cover lens prevents abrasion-induced SNR loss — critical for maintaining <2% FRR over 2-year lifespan.

Templates are 2.5× smaller than face embeddings, so matching is faster (~30ms) and lower power (~12mJ). The top-assembly Touch ID variant (power button) uses a narrower 1D strip with swipe reconstruction — slightly higher FRR but identical SEP isolation.

Weakness: capacitive fails with wet fingers and thin gloves. Water bridges the air gap, collapsing ridge-valley contrast. Vendors mitigate with adaptive gain and multi-frame voting, but FRR spikes 4-6× on wet hands.

4. In-Display Fingerprint: Optical vs Ultrasonic

Android flagships now hide the sensor under OLED. Two physics compete:

Optical (Goodix, Synaptics) — CMOS Under Display

OLED pixels double as light source. On touch, display illuminates finger, light reflects through gaps in OLED (12-15% transmission via transparent cathode) onto a CIS (CMOS Image Sensor) bonded beneath. Effectively a tiny camera looking up through the screen.

Pros: thin (≤0.4mm), cheap, fast (~280ms with DDR-accelerated template fetch). Cons: requires bright illumination (visible flash), struggles with screen protectors (added glass = diffraction + lower SNR), and PAD is weaker — a high-contrast print on paper can mimic reflected texture without 3D depth. Vendors add software liveness (heart-rate via PPG leakage, ridge-pore detection), but it remains 2D.

Ultrasonic (Qualcomm 3D Sonic Gen 2) — Acoustic Imaging

A piezoelectric transducer emits 12-15 MHz ultrasound pulses; ridges (contact) absorb more energy, valleys (air) reflect strongly. The reflected pressure field is captured by the same transducer array. Because it measures acoustic impedance, it images the dermis — not just surface — and sees through water, lotion, and thin protectors.

Acoustic stack: ~0.3mm transducer + ~0.15mm OLED gap. No visible light, no flash, and works with wet fingers (water is acoustically similar to skin, so contrast persists). Scan area is ~30×20mm vs ~6×6mm for optical — lower placement precision required. Power is higher (~25mJ) due to piezo drive, and cost is 2.5× optical.

Both types now route through a TEE — Qualcomm SPU or Arm TrustZone with MTE. The key architectural shift is encrypted LPDDR5X carve-outs for biometric templates: the application processor never sees raw images; DMA is blocked by the IOMMU when the secure world locks the sensor.

5. Comparison: Choosing Your Biometric Stack

Numbers hide nuance. Optical's 1:50k assumes no lifted-print attack; with an enrolled latent print reactivated via PVA glue, lab FAR climbs 10-20×. Ultrasonic closes that gap. Face ID's advantage is compounded by passive liveness — no user action needed — while fingerprint PAD often needs active challenge (press harder, lift).

For WebAuthn and passkey flows, the OS abstracts this away: the browser calls navigator.credentials.get(), the platform authenticator routes to the enclave, and the site receives a FIDO2 assertion. The web layer never knows if it was face or finger — by design.

6. Silicon Isolation: Where Security Is Won or Lost

The sensor is untrusted. The bus is untrusted. Only the enclave is trusted. Modern SoCs enforce this with:

1. Physically isolated enclave: Apple SEP, Google Titan M2, Qualcomm SPU — separate CPU, ROM, TRNG, and SRAM on a different power domain. It boots from immutable ROM and verifies its own firmware before the AP boots. Memory encryption (AES-XTS with hardware-bound 256-bit UID) protects data at rest; even a cold-boot RAM dump yields ciphertext.

2. Secure sensor path: Camera/fingerprint SPI/I2C is routed via an IOMMU that grants exclusive access to the secure world during auth. The AP's DMA is blocked; raw frames cannot be sniffed by a compromised kernel.

3. Template protection: Templates are encrypted with a key derived from UID + passcode. Without the passcode, brute-forcing the enclave is rate-limited in hardware — after 5 failures, delays grow exponentially; after 10, SEP wipes the key on iOS or extends to hours on Android. The hardware counter is monotonic and cannot be reset by reflashing.

// Android BiometricPrompt — hardware-backed CryptoObject
val prompt = BiometricPrompt(activity, executor,
  object : BiometricPrompt.AuthenticationCallback() {
    override fun onAuthenticationSucceeded(result: BiometricPrompt.AuthenticationResult) {
      // result.cryptoObject.cipher is unlocked ONLY by TEE
      val cipher = result.cryptoObject?.cipher!!
      vaultKey = cipher.doFinal(encryptedVaultKey) // never exposes template
    }
})

On failure, the enclave never reveals why matching failed — distance scores stay inside. This constant-time, constant-power matcher mitigates side-channel leakage that plagued early TrustZone implementations.

7. What’s Next: Under-Display Face ID and Multimodal Fusion

The next frontier is invisible biometrics. Under-display Face ID prototypes move the dot projector and IR camera beneath OLED, using 940nm-transparent cathode regions and diffractive compensation — similar challenges to under-display cameras analyzed in sensor comparisons, but stricter: dot positional accuracy must stay <0.3% for depth fidelity.

Expect multimodal fusion: ultrasonic fingerprint + selfie face checked simultaneously, with risk-based weighting. Low-risk unlock (read notifications) may need one factor; high-risk (wire transfer via biometrics) requires both plus passcode. The FIDO Alliance’s upcoming “hybrid authenticator” spec anticipates exactly this.

For engineers, the lesson is durable: minimize Trusted Computing Base, encrypt everything with hardware-bound keys, and assume the sensor lies. The enclave — not the lens — is the product.