Biometric and QR Code Access Control System (BQACS) : Building and Evaluating a Biometric Authentication-Based Framework

This thesis focused on developing a modular biometric access con-trol system by integrating built-in biometric sensors of smartphoneswith dynamic QR code generation to improve security and usability inaccess control. The goal was to eliminate the use of passwords, keys,and RFID cards as physical access credentials, which are susceptibleto loss or theft. A cross-platform mobile application using Flutter wascreated to run on both IOS and Android. The system uses built-in bio-metric sensors to validate the user locally and then generates a time-based one-time password QR code. The QR code contained a hashedtoken and a timestamp to be then scanned by the intercom for accessverification. The user’s privacy is preserved by using hashed tokensand not handling raw biometric data due to user privacy concerns.Replay attacks were mitigated with the use of timestamps. To assessthe biometric security, a Liveness attack was performed with multi-ple spoofing methods. The biometric authentication was confirmed byApple and Android to meet stringent security requirements by testingthe false acceptance rate with a result of 0.002% for the fingerprintsensor (Android) and by 0.0001% for Face ID (Apple). The projectaimed to create a secure proof-of-concept and was successful in show-ing that biometric authentication with dynamic QR code generationrepresents an effective alternative to traditional access systems. Whilethe system is not immune to advanced attacks, such as complex re-play scenarios, it offers practical improvements in security, especiallyin environments where traditional access cards still predominate.