How to calculate combined false acceptance/rejection rates of multiple biometrics authentication systems?

Question

I am a taking a network security class at grad school, and I need a little help with my assignment question. I am trying to think this through, and just want to know whether my approach is right or wrong.

Question:

To deal with false acceptance and false rejection, multiple biometrics authentication schemes can be combined to authenticate a user. Consider the combination where the user is authenticated as long as a user passes one of the biometric tests: Retina Scan, Finger print or Voice Recognition. Suppose the false acceptance rates of retina scan, ngerprint and voice recognition are f a1, f a2, and f a3. And their false rejection rates are fr1, fr2, and fr3 respectively. Assuming the above false acceptance and false rejection rates are independent, what are the false acceptance rate and the false rejection rate of the above combined scheme?

When I read the question - I immediately thought that the users (legit or not, but specially non-legit since we're talking about false acceptance) would start using the one method that would let them in most easily. So the false acceptance rate of the combined scheme would be max(fa1, fa2, fa3). Likewise, I thought legit users would not want to be rejected therefore they would use the one method that has the least amount of rejection, hence I think the combined false rejection rate of the system will be min(fr1, fr2, fr3).

If I am not onto something here, and missing something completely, please direct me to what I should read/study so I get on to the correct path.

Answer 1

Since the rates of each device are independent of each other, and the user is authenticated when any one of the devices authenticates the user, we have the following information:

A user is rejected if and only if all three devices reject him (him is used throughout to represent him or her), therefore, the combined rejection rate becomes:

FR = fr1 * fr2 * fr3

So we know that introducing more biometrics systems lower the overall false rejection rate.

Now, to calculate the rate that any one of these produces a false accept:

FA = 1 - Niether 1, nor 2, nor 3 produce fa
   = 1 - [(1 - fa1)(1 - fa2)(1 - fa3)]
   = 1 - [(1 - fa1 - fa2 + fa1fa2)(1 - fa3)]
   = 1 - (1 - fa1 - fa2 + fa1fa2 - fa3 + fa1fa3 + fa2fa3 - fa1fa2fa3)
   = 1 - 1 + fa1 + fa2 + fa3 - fa1fa2 - fa2fa3 - fa3fa1 + fa1fa2fa3
   = fa1 + fa2 + fa3 - fa1fa2 - fa2fa3 - fa3fa1 + fa1fa2fa3