Information Risk Management Plc. - What are BioMetrics?

What are BioMetrics? - The Executive Summary

Biometrics are an emerging tool to use for authenticating users in a variety of systems. While biometrics have previously been the domain of the military and high-security civil sites, they are increasingly used in public systems. In the past five years, biometrics have emerged to be deployed in environments ranging from the construction industry to airport customs controls. Biometrics also play a role in casino tracking of card counters and fraudsters.

Biometrics Offerings

Biometrics can be used in two different ways. Firstly, they can be used to authenticate known users, confirming that an employee is who he claims. Secondly, they can be used to identify individuals who are not providing an identity, such as intruders or vandals. Different forms of biometrics are suited to different uses (see "Biometrics Mechanisms").

Key Benefits of Biometrics

Biometrics provide a range of opportunities for businesses. When properly applied, biometrics can be used to reduce fraud in organisations by preventing doubled registrations for benefits, and ensuring that timekeeping systems are honest and accurate. When configured to do so, biometrics can also assist an organisation in minimising system support costs by diminishing reliance on support engineers to reset PINs or passwords.

Key Pitfalls of Biometrics

Biometrics can be costly to deploy, and benefits in support areas can be overestimated. When inappropriate mechanisms are selected or systems attempt to do more than is possible with current technologies, systems may prove unreliable. For example, remote identification is still a bleeding edge technology, therefore pilot systems are strongly recommended prior to any rollout. Biometrics are sometimes portrayed in a negative light in media coverage, and public perception is not always positive, particularly with more invasive mechanisms.

Biometrics Mechanisms

Biometrics come in a range of forms, but are consistent in their use of physical attributes to verify user identities. The main forms of biometrics to be aware of are; fingerprinting, the measuring of attributes of fingertips; facial recognition, which measures various facial dimensions; retinal scans, which map the veins of the retina; iris scans, which map the human iris; and hand geometry, which measures the basic geometry of the palm and fingers.

Fingerprinting is the most widely deployed mechanism at present, particularly for identification purposes. There have been many facial recognition and hand geometry rollouts as well - both are suited to authentication more than identification. Iris scanning is an up and coming technology, while retinal scanning is generally seen as too invasive for most applications. Both are excellent for identification.

Issues

An issue which is key to the configuration of biometrics is that of failure rates. Biometric systems are not infallible, however it is possible to configure them such that they fail more towards false rejection or towards false acceptance. Which direction is wanted for your system depends on the security required, the possible backups to deal with false rejections and the implications of false acceptance. Failure rates relate directly to customer experience and support costs, so careful planning is needed.

There are general concerns related to the scalability of biometrics systems - it is key that any solutions vendor be pressed to prove that the solution offered is going to be appropriately scalable.

Conclusion

Employing biometrics as an authentication mechanism can provide significant benefits to your business. However the risks are also considerable. The key to a successful biometrics deployment is very thorough consideration of all aspects of the system and its users, and a measure of the potential benefits of biometrics against what problems your business plans to solve.

Introduction

Biometrics are an up and coming authorisation mechanism, with use and confidence in the technology gradually becoming more widespread. That said, there are a number of issues which must be considered when planning a roll out of biometric authentication in any environment. Issues such as cost, reliability and general practicality must all be considered before making the significant investment needed to use biometrics as a principal authentication mechanism.

This guide is intended to serve as a general introduction to some of the issues security designers and architects may encounter when considering a biometrics rollout. While there are several sections to this guide, they are intended to be read completely so as to give a complete picture with regards to biometrics and their potential for your organisation.

The first section of this guide serves to introduce biometrics and place them in the context of life and work in the UK today. Who uses them, and how did they get their varying reputation we see today? These are important issues to consider, particularly for public-facing biometrics rollouts.

After setting this context, the issues of the management and operations of biometrics must be considered. The overall processes of biometrics must also be understood to make a properly informed decision about their use in an organisation. How will a biometric solution fit into your working environment? Do the issues you wish to address improve when biometrics are used to replace your current authentication mechanisms?

Next, the business issues of biometrics are considered. Issues around public perception and its impact on the public's view of a biometrics system are examined. The total cost of ownership (TCO) of biometrics is considered to assist you in determining if biometrics will assist your organisation are discussed, along with potential issues around the system users and potential views on biometrics.

Next the actual biometric mechanisms are considered, along with some general comments on their applicability, and areas where particular biometric mechanisms have been employed. The pros and cons of various mechanisms and the limits of their use in certain situations are examined. The two main mechanisms which biometrics support are discussed, and the two key failure rates of biometrics are introduced.

Finally, the key issues are summarised. There are several issues which are unique to authentication mechanisms, and understanding these mechanisms is crucial when considering a biometrics solution.

Overview

This chapter is intended to give the user a basic context of biometrics use both in the United Kingdom and abroad. Before discussing this, the basics of biometrics and their increasing use are discussed. Following on, a variety of rollouts worldwide are examined, and the points they illustrate are discussed. This chapter is useful as a discussion point, but is not intended to form part of a checklist for rollouts.

Context

Biometrics are an emerging authentication mechanism in the world today. Moving on from early perception as a science-fiction type mechanism used only in black-box government organisations, biometrics are increasingly seeing use in the light of day for identification and authorisation purposes. In the past few years, we have seen biometrics used in building sites, airports, casinos, and other areas where security is crucial to the smooth and efficient running of organisations.

In addition to commercial organisations, biometrics are progressively seen as an ideal mechanism for government use in public-facing systems. Biometric credentials are soon to form a crucial and mandatory part of travel documents for travellers heading to the United States. Closer to home, biometrics are being considered for the use in identity cards for the United Kingdom.

In this basic but positive context, it can be tempting for a business to leap directly into a biometrics rollout - of any kind, simply to take part. Security architects and designers take note - if you have yet to be approached by a business level manager and asked about biometrics, it will likely happen soon. Biometrics are definitely becoming a high-visibility technology. As such, it's worth considering - are they for you?

Such a question is not an easy one, because while biometrics are reasonable for many applications, they are not the magic bullet for security that one might believe. Biometrics have their own issues and drawbacks, ranging from uncertain public perception to potential cost issues, and the always troubling question of error rates in biometrics.

Before examining these issues, it is worthwhile examining the current state of biometrics, both in the United Kingdom and around the world. Where are they being used, and how successful are their uses? More importantly, how does this use translate back to you and your potential business requirement for biometrics?

Biometrics have yet to take on a truly visible role in the public eye in the United Kingdom. This can be deceptive, as in fact, biometric systems have been deployed in a number of areas in the United Kingdom, and in fact the industry is growing rapidly at the moment.

The Construction Industry

The environment of a typical building site does not tend to conjure up images of high-tech security measures, but instead a chaotic affair of mixed traffic and continual arrival and departure of various levels of contracting. It might surprise some to know that if anything, high-profile construction sites are leading the way in the use of biometrics to monitor employee arrivals and departures.

The construction industry has a number of reasons to want to monitor employees closely. Construction is dangerous work, and for health and safety reasons, it is crucial to know who is and isn't in should an emergency situation arise. Typical punchcard systems are unfortunately, quite inadequate for the task of generating an assured listing of employees. As in any industry, employees may wish to "cover" for each other by punching in missing employees. Alternatively employees may trade off a job to a friend for a few days to both assist a friend and get a break from work.

Clearly what is needed for such an environment is a form of authentication based upon something the authenticated user cannot share, and biometrics seems to fit the bill. Swipecards and PINs are easily shared, and supervisors are bound not to know all employees faces in construction sites. As a result, construction firms are beginning to use systems which remember faces for them. In particular, face recognition vendors are finding considerable work in the construction industry. Facial recognition is ideal in an environment where dirt and grime are likely to boost the error rates of technologies such as fingerprint authentication.

Policing

Policing is an area where biometrics can in some forms be seen as old-hat. Obviously, fingerprint analysis has been used by the police forces for a considerable amount of time, however biometric technologies have clearly facilitated a move away from manual analysis of fingerprints to automated analysis of both fingerprints and palmprints.

Furthermore, there have been a number of facial recognition trials in the United Kingdom. Crucially, these have tended to steer away from previous trials in the United States which attempted to scan large numbers of people at once and instead focused on two different situations; either capturing pictures of suspects to compare against mug books, or to assist in the live tracking of individuals in CCTV feeds. The effectiveness of these rollouts is difficult to gauge due to a general lack of reports over efficiency from independent sources.

Banking

Financial institutions seem a clear candidate for high-security systems deployment, and several banks have made use of biometrics for the securing of their headquarters.

Public Perception in the UK

Biometrics in the United Kingdom tends to be focused in FTSE top 100 corporate environments and the law enforcement, making it difficult to gauge the public's perception of biometrics. That said, the United Kingdom makes heavy use of CCTV camera coverage, and as previously noted, the construction industry makes fairly regular use of biometrics. It is possible (but not certain) that public perception of biometrics may be one of acceptance in the United Kingdom. Market research in the target markets of your business is critical to determine how biometrics may be received.

Reviewing the biometrics systems discussed above, it is interesting to note that none of the major systems found involve the use of biometrics for identifying or authorising entities who are voluntary. In timekeeping situations, the employee is either complying, or not working. In policing, the use of biometrics is far from optional for those caught and scanned. Biometrics in the UK are seen very much as institutional tools.

Biometric World-wide

Biometrics have seen increasing levels of use throughout the western world in the past five to ten years. High profile areas of use have not necessarily been the usual suspects for high-tech rollouts. While nations such as the United States have had a certain level of rollouts, there have also been significant deployments in nations ranging from Australia to Chile.

The use of biometrics for timekeeping is ever popular in the Americas: employee timekeeping is still an area where precise counts and timekeeping are crucial. In this case, fingerprint technologies were used instead of facial recognition, however the principle is identical - close monitoring of employee timekeeping is used to maintain consistent records.

In the United States, there is an interestingly different situation to be seen with biometrics. As a nation with reasonably strong views on civil liberties, biometrics have previously been seen as something too invasive for Americans to consider. However, after the attacks of 9/11, the country has been more receptive to their use.

It is thus unfortunate that it would appear that the United States seems to have many cases of ill-considered biometrics rollouts which do little to improve public perception. Facial recognition software has been deployed in several areas in the United States, most notably at the Super Bowl events, and at Palm Beach International airport. Both rollouts were accompanied by some controversy, but more importantly, both rollouts, fairly or otherwise, tended to be branded as failures.

It is important to note failures along with the successes of such rollouts. In the two cases mentioned, biometrics were being used to perform tasks far more complicated than authorisation. Both cases involved the use of facial recognition for identification of subjects. As was discovered, facial recognition being used outside of a controlled environment with variable lighting and photography angles resulted in unsurprisingly poor results. Much can be found online for these cases, and they are an important indication of how the right tool must be selected for a job, and how in some cases, there simply is not a suitable mechanism at the moment.

While these examples are unfortunate, the United States is also home to a wide range of successful rollouts. Hand geometry authentication is being used for accelerated customs processing in California's Mineta San Jose airport, and has been deemed to be highly successful. Government initiatives such as the Airport Security Improvement Act (2000) and the Enhanced Border Security and Visa Entry Reform Act (2002) both push quite heavily for the increased use of biometrics in the United States.

Therefore, it can be seen that the use of biometrics worldwide is increasing, but the use of biometrics to identify customers who have the option of shopping elsewhere or banking with the competition has not been as widespread. The major users of biometrics at present are government bodies, and private sectors wishing to monitor employees.

Management & Operations Factors

There are a number of issues to consider in the operation and management of biometrics. The most pressing issues around biometrics surround the enrolment process and authentication requirements for enrolment. This section will introduce the central aspects of these issues, and then discuss the mechanisms and procedural controls needed to address them. For registered users, there must be some thought for the processes and procedures to follow for failed authentication. If a user fails to authenticate, will there be a backup mechanism?

Authentication Requirements

Before enrolling a new user, the system must establish to a proper degree of certainty that a new user is indeed who they claim to be. Without sufficiently strong authentication during the enrolment step, a biometrics authentication system is effectively useless, no matter how strong the actual mechanisms employed.

Authentication for enrolment will always ideally be performed in-person with well trained and vetted staff. The verification process should be explicitly defined in terms of the identification required, and the steps which must be taken to verify this identification. When possible, authentication should be a two-stage process to diminish the likelihood of insider attacks resulting in deliberately incorrect authentication of new users.

In some models, an in-person verification may not be possible, or may not be seen as necessary for user authentication. For example, a bank rolling out biometrics devices for authentication across the Internet may wish to mail out devices and incorporate their enrolment process into the next session the user establishes through the historic authentication mechanisms. In such cases, additional remote mechanisms must be found to ensure that enrolment is secure. If the chain of authentication to establish biometric authentication credentials contains a step with authentication of a lower strength than the biometrics layer, then an attacker will simply move one layer down and attack systems at the initial authentication/enrolment stage.

Enrolement Guidelines

Once authentication has been performed and the user is to authenticate, the system and those administering it must ensure that the user credentials gathered from the mechanism are sufficient to identify the new user accurately..

Biometrics systems assemble their views of users through sets of measurements, as described in the techniques section. The precise location of each measurement and number of measurements taken for each user may vary slightly, as each user will have different characteristics to compare. The biometrics system which is used must be configured and employed such that all user credential sets contain a minimum number of points of reference to identify or authenticate that user.

As an example, if a fingerprint based system typically relies on fifteen points of reference, and attempts to enrol a user with worn fingers, the system may simply not be able to enrol this user. If only ten points of reference are found, this must result in a failed enrolment, not simply a weaker profile for this user. Similarly, a user attempting to enrol with damaged fingerprints might enrol with a set of characteristics which are both temporary and potentially reproducible. Enrolment officers must be qualified to judge both potential cases, and must have clearly defined procedures to deal with these issues.

Similarly, enrolment officers must be accustomed to dealing with equipment and its failures. In the case of mechanisms such as fingerprint authentication, sensors can wear out over time, leading to issues of either complete failure, or repeated generation of user information sets lacking the detail to form a proper authentication set.

Daily Operations

The day to day operations of a biometric authentication system merit some thought. Managing to roll out a system is sadly only the first issue of many facing authentication systems.

Administration & Maintenance

Biometrics systems will ideally be as low-maintenance as possible. If stored locally, the integrity of both authentication data and authentication mechanisms must be maintained. Role separation and tamperproof systems auditing are both controls to be strongly considered. If systems do require regular maintenance by administrative staff, role-based access controls should be considered to ensure that staff maintaining systems do not have access to either the data, logic, or logs of the systems. Similarly, auditing personnel should not have access to the system whose logs they examine. Maintaining clear separations of both roles and data access will ensure that data and logic functions are kept as securely as possible.

Failed Authentication & Back Ups

When a user attempts to authenticate with a valid set of properly formed credentials, they may, either through faulty equipment or some other error find that they cannot access their account, funds, or other assets protected by an authentication mechanism. Backup solutions must be considered for this type of situation, however the solution is not simple. If a system contains a backup mechanism which is much more straightforward to attack (such as a PIN), attackers may simply fail authentication attempts repeatedly to gain access to the backup system. In the case of deliberate sharing of credentials, such a backup would render the authentication system useless without additional controls.

Secure backup mechanisms can incur a higher cost for the system as a whole, particularly if the backup is intended to provide a rapid response. This cost must be weighed against the costs of a slower response.

For example, a bank user locked out of his account may not be as understanding as a nuclear scientist locked out of a laboratory. By the same token, a user having to wait a day to remove funds from an account may be less concerning than an engineer having to wait a day to access an overheating nuclear core. In some cases you might not need a backup system, in others nothing less than an immediate backup via physical verification may do.

Business Issues

While technical issues often take the forefront, business issues must be considered when looking at biometrics, as business factors should be the key reason for deploying a biometrics system. This section will briefly examine both the issues which biometrics can help you address, and the issues which biometrics raise.

Issues Addressed

Improving the Customer Experience

An often repeated complaint from customers of various service sectors today is that is it increasingly difficult for users to keep track of the ever-increasing number of PINs and passwords which they are required to remember. In the case of banking services, this can be compounded as users are asked to remember not only their PIN but their account number, online account number, and so forth. In cases where PINs and passwords are overwhelming customers, a biometric solution can be a major boost to not only a customer's sense of security, but also a customer's overall experience.

Combating Fraud

Fraud is an ongoing problem in a wide range of businesses, and biometrics are increasingly seen as a mechanism for combating this. The key advantage here for biometrics is the lack of potential for a customer to either share their authentication token, (for example their fingerprint) or attach this token to multiple identities. Even with credentials more suited to authentication than identification, biometrics can make the chase to catch "double dipping" fraudsters easier. Biometrics deployments for social security benefits are an excellent example of this form of control.

Lowering Business Costs

A major cost for most organisations maintaining any authentication system, be it a system of ATMs or a local network, is dealing with user support issues related to forgotten PINs or passwords. Many organisations have looked to biometrics as a potential solution for this area. Intuitively this is an area for biometrics to impress, as there is a reasonable potential for reduction in support calls. That said, the issues of security and failure rates must be considered carefully - a high security system with a low false acceptance rate is much less likely to drop the number of support calls placed. Indeed, if factored in with the potential for non-registered users, a highly-secure biometrics system could conceivably increase this problem. Considerable testing and beta rollouts are recommended if large reductions in business costs are needed to justify a biometrics rollout in your organisation.

Increased Security and Perception

Biometrics have a real potential to boost some areas of security in a system, though clearly they are not a magical bullet for all security issues. Biometrics can play a real role in systems where identity theft is an issue, ensuring that each individual user is only present once on a system. Clearly though, this is still limited, as the first user to claim an identity on a given system is then the "owner" of this identity. While biometrics can be used to cut down on account hijacking, issues around fraudulent accounts fall back onto registration procedures, just as is the case with any other authentication system.

On the perception side, it has been suggested that in the casino trade, the use of facial recognition to monitor card counters and the like has been split regarding identifying culprits, and deflecting potential cheats.

Issues Raised

Clearly biometrics can be used to address a number of business areas, however it brings several issues with it. It is crucial to consider both the positives and negatives when looking at biometric solutions.

Public Perception

The perception of biometrics is interestingly mixed, and careful research into the target market is called for. Biometrics are variously seen as a highly secure mechanism with a James Bond style reputation, or as an invasive mechanism with "Big Brother". overtones. Clearly it pays to know what your users will think before you roll out a system that they may either love or fear.

Even without clear user issues, there is a general trend in the media in many Western nations to portray biometrics in a negative light. Careful marketing should be considered for biometrics rollouts, and cautious analysis of the implications of negative media coverage must be considered.

Data Protection & Data Storage

By their very definition, biometrics involve the use of data which is very personal to the subject being identified or authorised. Clearly this data is very sensitive, and personal to the user. While this does not explicitly fall into the "Personal Sensitive" classification of the Data Protection Act (DPA) per se, this data must be treated quite carefully to ensure that organisations making use of it do not fall foul of either the DPA, or any one of a variety of other data protection and privacy acts that may be encountered around the world.

Legal advice is a necessity to ensure that the data storage model of your biometrics solution can be used in the target nation or nations. One of the nations a biometrics rollout might have targeted could be found to have decided that biometric data is not particularly sensitive, however another may place severe restrictions on their use. Therefore it is recommended that careful research be considered prior to any rollout.

Key Issues in Biometrics

Authentication or Identification?

This chapter introduces several of the key issues to consider in the examination of biometrics for authentication systems. This section is meant to be read in its entirety to provide the user with the key questions and issues to consider from an implementation point of view.

A key factor in the selection of a biometric mechanism is whether your system is meant to be identifying users, or simply authenticating users. Identification of a user is a much more difficult task.

Authentication is the verification that a user is who they claim to be. For such a situation, the user provides a possible range of users of one. The authentication mechanism then compared the expected credentials for the claimed identity to the credentials it finds on the claimant. If there is a match, the user is authenticated. This is known as a one to one test.

In contrast, identification does not involve a claim of identity at all. Instead, the system is presented with a set of (ideally complete) credentials, and asked to compare this set of credentials against the users it knows of, returning a result which identifies the user in question. This is known as a one to many test, and it should be evident that this type of test is both more labour intensive for the system, and more reliant on having a wide range of attributes to compare users with. As is discussed in the mechanisms section below, this poses difficulties when identification is the mechanism most often wanted for use at a distance. Care should be employed in deploying biometrics for identification at a distance, as questions remain as to whether this is currently feasible.

Failure Rates

Failure rates are a critical consideration in the configuration and day to day running of a biometrics system. Two types of failure rates must be considered; false acceptance rates, and false rejection rates. These failure rates are a function of how precisely the system attempts to verify each user against the characteristics registered for them. Thus, a system which is configured to be very precise and have very low false acceptance rates will almost invariably be performing a higher number of false rejection rates, relative to a balanced system. Similarly a system which involves lower value access will likely be granted to be less precise to ensure that the positive customer experience is delivered.

A security professional will tend to move immediately towards a configuration with low false acceptance rates and ignore the false rejection rates. This is not a practical option in all cases, and the configuration depends strongly on the environment in which the biometrics-based system is to be deployed. In a high security military-style setting where security is paramount, users, or at least their administrators will be more accepting of a high false rejection rate which is in support of a low false acceptance rate. In a commercial setting, there will often be less scope for the acceptance of delays and difficulties associated with false rejection rates.

To illustrate, a quick comparison of the false rejection of a banking customer versus a false acceptance; The false acceptance is unlikely to be a significant financial burden when the limits of withdrawals from accounts via ATM are already limited for security reasons. An attacker would gain access to the current account funds of a customer, limited by cash withdrawal limits, and repeated withdrawals would ideally be caught by the bank's standard fraudulent use detection systems. In contrast, the user of a new banking system who appears in local or national media telling of being denied funds at 3am whilst stranded in a remote location could have serious public relations consequences. A pragmatic approach is essential in the configuration of error rates.

Liveness

A number of attacks on biometrics systems have been proposed over the years, and a number have been quite successful. Fingerprinting systems were originally entirely reliant on fingerprints for authentications, meaning that moulded synthetic fingers with imprints of fingerprints could be used to authenticate users. Similarly, hand geometry systems were entirely reliant on superficial physical attributes.

Since these attacks have been proposed, a new area of biometrics has arisen which focuses entirely on determining whether the authenticating attributes being measured are in fact the attributes of a living being, as opposed to a recording or a synthetic imitation. The mechanisms are varied, relying on things such as prompted user actions to smile for facial recognition. In the area of fingerprinting systems have been developed to measure both perspiration and the pulse of the authenticating user.

Liveness testing is becoming a vital part of biometrics systems. It is vital that before selecting a vendor, you familiarise yourself with potential means to trick the system, and determine what means vendors use to detect these attacks.

Non-Registrable Users

During the rollout and use of a system based on biometrics, it is inevitable that some users will be found who cannot register for a given system due to their physical characteristics. Thus, a secondary authentication mechanism is always needed for biometric systems. Care must be taken to ensure that the use of biometrics does not mean the complete exclusion of a given group of users.

The mechanics of non-registrable users varies depending on the biometric mechanism being used. Even without actual physical injury, some mechanisms can suffer in particular sections of the population. When examining fingerprinting, for example, it has been found that the elderly often have either very dry skin, or very weak fingerprints simply as a result of aging skin. As always, careful consideration of the target market is key to selecting an appropriate mechanism.

Circumvention

It is key that when rolling out a biometrics system, the view of a system as a chain is maintained, along with the understanding that a system is only as secure as the weakest part of that chain. Biometrics offer a strong means to authenticate users for systems, however attackers will tend to attack systems at their weakest point, not their strongest. It is vital that biometrics serve a supporting role in well designed, properly secured systems. Installing biometrics into a fundamentally weak system is a waste of both resources and time.

Scalability

While it is highly recommended that test pilots be performed for rollouts of biometrics systems, the issue of scalability is a more difficult one to tackle. Biometrics rollouts across very large user populations may not scale well. Research into this area is lacking at present, and unfortunately the larger rollouts of biometrics to date have involved organisations who are less likely to wish to discuss their authentication mechanisms in depth. Assurances and contractual guarantees with significant financial penalties for non-conformance against performance criteria are needed to ensure that the selected vendor for your biometrics rollout is confident that the solution offered performs as needed.

Conclusion

Biometrics come with a complex set of issues which need careful consideration. The issues above illustrate a number of potential pitfalls, and hopefully give an indication of the consequences of ill-considered biometrics deployments.

Techniques & Limiting Factors

There are a number of popular biometrics mechanisms currently deployed, some with strong histories, and some relatively new mechanisms. Each mechanism has its own strengths and weaknesses. As a result, it has been found that some mechanisms are much more suited to some applications than others. This section introduces the key concept of authentication versus identification, and then proceeds to describe the major biometrics mechanisms and their benefits and drawbacks.

Facial Recognition

Facial recognition works through the assembly of measurements based around the characteristics of a person's face. Attributes such as the distance between eyes, between the nose and mouth, and the angle of the jaw are all used to build up a set of expected criteria. Instead of storing a user's photograph, a subset of details is stored to minimise storage costs.

The main advantage of facial recognition systems is the lack of user interaction needed to perform scans. While users may be required to stand still, facial recognition systems are without a doubt one of the least intrusive on the market. In addition facial recognition is suited to environments where there is significant dirt or potential pathogens, as there is no physical contact required between users and systems.

Questions have been posed with regards to the effectiveness of facial recognition systems. When images are captured in less than ideal conditions, the use of facial recognition systems for identification may be unreliable. Conditions which may cause difficulties are those in which lighting is variable, or camera angles are not reliably similar to the angles at which users have initially been entered into the system.

As is often the case with commercial products which are deployed primarily by the police, there are no hard and fast numbers to refer to. At present, facial recognition systems seem best suited for authentication applications, and not identification.

Fingerprinting

Fingerprint authentication mechanisms rely on the identification of minutiae in the fingerprints - discontinuities in the flow of a user's fingerprints that can come in the form of deltas, pores, islands, and other characteristics. Once systems have isolated the minutiae of a fingerprint, the precision of the matching is based on the numbers of minutiae which are used to create a positive match.

Fingerprinting as an identification mechanism is the oldest of the mechanisms to be incorporated into biometric systems. Fingerprinting also enjoys a favourable image with the public, as this mechanism is frequently used by police forces around the world, and features in innumerable law-enforcement movies and television programs. Fingerprint biometrics also enjoy a reasonable amount of success in current computer peripherals. Keyboards, mice and PDAs are all available with integrated fingerprint scanning devices for the provision of biometric user verification. This serves both as an boost to the overall acceptance rates users are likely to have for the mechanism, and as a source of affordable hardware for a biometrics system rollout.

Fingerprint biometrics have a number of benefits. They enjoy good acceptance rates in the general public, and have a positive image. The mechanism is not overly intrusive, and is generally trusted. The mechanism is quite flexible for failure rates, as fingerprints have a high number of potential areas to be mapped for identification. Thus if desired, fingerprint based rollouts can be highly secure.

As a popular and precise mechanism, fingerprinting does have drawbacks. Fingerprinting systems will struggle in areas where users are likely to have either injured or dirty hands. Similarly, the elderly and those with dry skin may struggle to register and make use of these biometrics systems. Finally fingerprinting systems are the most commonly targeted systems for attempts to falsify credentials. A number of methods used to counter this are available, and mechanisms such as liveness testing should be considered when using fingerprinting.

Retinal Scans

Retinal scanning relies on the mappings of blood vessels in the eyes for user identification. This mapping requires users to look into a fixed light while the scanning systems is mapping the retina. Once the mapping is complete the system views the retinal maps in thin slices much like a long series of barcodes.

Popularised in various science fiction and action movies, it is interesting to note that retinal scans are based on very old theories related to the uniqueness of patterns of blood vessels in the human eye. Clearly the image of retinal scans is one of a technology which is much more invasive than any other alternative to date. Public perceptions of retinal scanning include concerns around potential eye damage. Combining this with the invasive reputation, retinal scanning technology may not have an ideal image for rollout to the public. Hardware costs are high, and systems are not particularly mobile, limiting their use in a field environment or at user desktops.

Iris Imaging

Iris imaging maps the coloured tissue at the front of an eye. The tissue has a variety of rings, folds and freckles which can be used to uniquely identify users. As the iris is in plain view, images can be captured with standard video equipment from a distance of up to two feet, allowing for a more relaxed, non-intrusive authentication experience for account holders.

Iris recognition utilises infrared illumination during image capture, which is harmless. There is no use of lasers or scanning during this image acquisition phase - a common misconception here is that iris and retina recognition are the same. Unlike retina scanning, iris imaging is both less intrusive and more flexible in terms of subject location relative to the equipment in use. The relative performance and accuracy of iris recognition has also far exceeded that of retina recognition in numerous tests conducted worldwide.

Hand Geometry

Hand geometry employs measurements of various aspects of the hand including width, length, and width and length of fingers. Because of the relatively basic nature of this mechanism, it is suitable for authentication, but not identification.

Hand geometry systems have been well accepted to date, and can be configured to be quite reliable. They have been deployed in several major areas with no major issues of public acceptance, possibly due to the lack of potential for identification with this mechanism. While hand geometry systems can struggle with equipment issues in dirty environments, authentication should not be an issue as the attributes to be measured are far less detailed than those used for fingerprinting.

Hand geometry systems come at a higher cost. The hardware used for such scanning is dedicated, and systems are proprietary. Different manufacturers employ different mapping standards based on different attributes, so potential buyers would be advised to obtain field results on failure types and enrolment issues.

Summary

There are a wide range of mechanisms available today for deployment. Before selecting the mechanism to deploy in your environment, it is crucial that the requirements of the system be determined, particularly with respect to the working environment, and the need for either authentication or identification of users.

Report Conclusion

Biometrics are an up and coming authorisation mechanism, and their use is spreading into more commercial areas. The appeal of biometrics lies in the range of cost-related business issues which can be addressed. When properly applied, biometrics can be used to combat fraud, and ensure that timekeeping systems are honest and accurate. When configured correctly, biometrics can also assist an organisation in minimising system support costs by reducing reliance on support engineers to reset PINs or passwords.

There are a number of key areas which must be examined when considering a biometrics rollout to ensure that biometrics are solving the problems your business faces. Firstly a cost analysis is needed which takes into consideration the impact of your desired failure rates, and the costs of the actual hardware needed for your rollout. Consideration must be made for the target users of the system. The range of physical traits, tolerance for new technology, and potential views of biometric authentication systems must be estimated wherever possible.

Honest views as to the practicality of what is being attempted must be sought. As always, care must be taken when receiving advice from vendors, and independent IT and Legal counsel is recommended. Pilot schemes are vital as a checkpoint to assess technologies before proceeding into a full scale rollout.

If all the appropriate aspects are considered, system owners may well find that biometrics offer an ideal solution to the problems they wish to address. There are many advantages to biometrics, and it seems very likely that they will continue to expand in use as time moved on. When deployed correctly, they are a powerful tool that shouldn't be ignored.