Biometric technology came to the fore more than a decade ago, and despite predictions that it would change the way we viewed access control, it never really took hold in the way that the experts claimed it would. With many years of R&D on the clock, has the technology really advanced?
Demand for rapid and accurate identification of an individual is paramount for many businesses. There are a vast number of applications which demand such a capability, ranging from the high security applications of access control in governmental, military and financial institutions to the social services looking for ways to stop the increasing levels of fraud. Banks are constantly involved in the battle to reduce ATM crime. Credit card companies want to eliminate the loss of billions of pounds in annual fraud losses and many other businesses and institutions, such as healthcare trusts and prisons, are looking to control records and regulate personnel movement in a stricter fashion.
There are three general methods for authenticating the identity of an individual. These are by something a person possesses, such as a key, token or card; by something a person knows, such as a personal identification number (PIN), alphanumeric code or password; or by a physical or behavioural characteristic.
Biometric systems which use human characteristics such as a fingerprint, retina, iris or vein structure, or behaviours such as handwriting and speech patterns, to distinguish people offer an increasingly credible identification option. The biometric path is ideal for those looking to reduce costs and meet increasing demands for effectiveness and efficiency from their system.
The first biometric identification systems were based on the fingerprint, a universally accepted unique biometric feature. Systems now span the spectrum from voice and signature analysis through to hand geometry, retinal scanning, vein patterns, facial recognition, thermography and iris scanning.
Over the years, biometric systems have become more accurate, reliable and affordable. However, when choosing the right system for an application, integrators and end-users must know how to evaluate several key components. These include verification and identification capabilities, accuracy, speed, reliability, acceptability to people who have to use the solution, resistance to counterfeiting, enrolment time and finally, the uniqueness of the verified characteristic.
Verify or identify?
It is essential to understand the difference between biometric verification and biometric identification. What do we mean by verification? Verification is the process of determining that the person requesting access is who they say they are. With regard to biometric systems, this might involve matching the user’s fingerprints to a fingerprint called up from a central database.
This will have been stored by the authorised person, and will be recalled by inputting their card or personal identification number (PIN). The system only has to compare the user’s biometric information to the set of data called up or already encoded on the user’s card, rather than to the entire database of data – effectively reducing the time of data processing and operation. This is commonly referred to as a ‘one-to-one’ comparison, which most biometric systems perform.
Identification and verification are two separate operations. Identification is the process of determining who the user is, not just who they say they are.
To identify an individual, biometric data being presented is compared to the codes or templates in the database, until a match is found or the data is rejected as unidentified. With an iris recognition system, for example, the user presents his or her iris to the camera for video imaging and analysis.
A search processor compares the template of the iris pattern to every template stored in the system. The user is identified if the iris template matches one stored on file.
Identification has the advantage of eliminating the need for a user PIN or card, but it can be too time-consuming to be feasible. Some systems have thousands of users and individual file sizes of hundreds of bytes. Whilst any delay on a single transaction might be negligible, it will cause delays if hundreds of people arrive at a workplace minutes before they are due to start a shift. Consequently, most biometric systems are used for verification only.
Some applications demand identification. This is also beneficial where it is important to identify enrollees to ensure they are not entered in the system more than once. For example, people may try to enrol several times in a social services recipient database under aliases to receive extra benefits. When a person enrols in the system, the system can scan the database to make sure the applicant is not already enrolled. This process may take a few seconds or more per person. However, it may only be necessary to verify the person – which takes less than one second – when subsequent access attempts are made.
Accuracy levels
A perceived problem with biometric systems is a lack of long term accuracy rates, relative to simpler systems, such as those based on a password or card. Biometric systems can be adjusted to require near-perfect template or code matches to virtually eliminate false accepts (approving an unauthorised user). However, when this is done, false rejects increase. Similarly, to reduce false rejects, system sensitivity can be lowered so that anything resembling a match is accepted. In such a case, however, false accepts would correspondingly increase.
False accepts are a security risk. False rejects create user dissatisfaction. If users are the general public, false rejects may create serious customer service problems.
Some biometrics manufacturers and vendors have, on occasions, advertised low false accept rates and low false reject rates in a single system, without revealing that these rates require radically different system sensitivity settings and cannot be attained simultaneously.
To counteract these claims, prospective purchasers should consider the ‘cross-over error rate’. This rate represents the setting at which the false accept and false reject rates are equal. This cross-over error rate provides a truer picture of the system’s overall performance.
User interface speed, data acquisition speed and system processing speed are collectively referred to as the ‘throughput’ rate – how quickly a user can get through the system. Historically, biometric systems with slow throughput rates have not survived in access control applications because users will not tolerate the resulting delays.
User interface speed refers to the time required for the user to approach the data collection unit and position him or herself for data acquisition. This includes getting in alignment with a visual sensor for iris scanning, retina scanning or facial identification; getting the hand or fingers in the proper position for hand geometry or fingerprint sensors; and the picking up of the handset or stylus for voice or signature sensors. For systems that operate in the verification mode, user interface speed includes the time required to swipe or insert the card and get an accurate reading, or enter a PIN on a keypad.
Data acquisition speed reflects the time required for the system to collect the biometric data on which the access decision is based. It includes any time necessary for the system to collect anti-counterfeit data. Also necessary for consideration is the time required to process the sensor input and compare it to the stored biometric data.
The total of these times determines the throughput rate of the system. In the case of access control systems, acceptable rates have been determined through testing and field experience.
Throughput rates for biometric access control systems are maximised in the six to ten persons per minute range. This rate means that each person has from six to ten seconds after arrival to get through the door. Considering the time required to physically open and close a door, these are optimum rates, only attained by the best systems.
Reliability issues
In the past, biometric systems earned a reputation for unreliability. Even systems that functioned well initially lacked the robustness necessary for long-term performance. System accuracy degraded over time or required continual maintenance and adjustment.
Many fingerprint systems have proven to be vulnerable to the build-up of skin oils and dirt on the sensor plate, as well as moisture, dryness and even aging! Fingerprint systems not frequently maintained and tested can quickly deteriorate in performance and accuracy. Some systems also become more susceptible to counterfeit attempts when not well maintained.
User acceptability is also an increasingly significant factor in biometric systems. No matter how effective the technology, a biometric system will fail if it is not accepted by the user population. Reasons for non-acceptance include a number of arguments including invasion of privacy, the requirement to touch a plate or eyepiece, perceived health risks and slower processing times.
Users are becoming more resistant to systems that require intrusive data collection methods. Some users even perceive having to touch something as an invasion of personal space or a violation of personal rights. Identifications based on data collected from a distance, such as iris recognition, avoid these issues.
Perceptions can be more important than reality. A few years ago a number of military pilots refused to use a retina scanning system, believing that it might impair their vision. No evidence that the system affected eyesight existed, but the system was removed as a result.
Biometric systems were originally designed for high security applications where one false accept could constitute a fatal flaw. Now, as biometric systems are used for other less sensitive applications, resistance to false positives is not as high a priority, although security that cannot be easily fooled is important.
Generally, biometric systems on the market have acceptable methods of resistance to counterfeit IDs built into them. Many spoofing attempts, as seen in Hollywood films, would not work with today’s systems. The counterfeit-resistant features of credible systems probably have more basis in perceived threats than real ones.
The most critical area to be considered when investigating a biometric system for a security application is the ‘unique’ element. If a human biometric feature being analysed for identification is duplicable or found on one or more individuals, the overall long term reliability and security of the system has to be questionable.
The stability of the biometric feature during the lifespan of a given individual must also be considered very carefully. Biometric features that are generally accepted as unique are fingerprints (with the exception of identical twins), the retina and the iris. Voice patterns tend to change with the individual’s mood and health. The common cold or flu, for instance, would alter the tone and pitch of a person’s voice. The heat patterns in a person’s face, or facial thermography, are often affected by weather conditions.
Some biometric features are also susceptible to damage and change over time. For instance, those who work with their hands in industrial occupations will, over time, destroy parts of their fingerprint pattern, making long term use of fingerprint biometrics require consistent updates of templates. With vein pattern recognition, these structures change to varying degrees as the person ages, dependent on the particular individual.
In summary
If selected appropriately, the right biometric system can provide an organisation with an effective method to identify and authenticate personnel. However, it is critical that the specifier must carefully evaluate the various system capabilities, including accuracy, speed, acceptability, resistance to counterfeit, enrolment time and the uniqueness of the biometric feature being measured.
This will ensure that the system meets the demand of the company’s own specific security requirements.
