Technology-savvy organizations looking to develop a competitive advantage should carefully watch developments in biometrics.

Simon Liu and Mark Silverman

A Practical Guide to Biometric Security Technology

s organizations search for more secure authentication methods for user access, e-commerce, and other security applications, biometrics is gaining increasing attention. But should your company use biometrics? And, if so, which ones should you use and how do you choose them? There is no one best biometric technology. Different applications require different biometrics. To select the right biometric for your situation, you will need to navigate through some complex vendor products and keep an eye on future developments in technology and standards.Your options have never been more diverse. After years of research and development, vendors now have several products to offer. Some are relatively immature, having only recently become commercially available, but even these can substantially improve your companys information security posture.We briey describe some emerging biometric technologies to help guide your decision making.

Of these, a biometric is the most secure and convenient authentication tool. It cant be borrowed, stolen, or forgotten, and forging one is practically impossible. (Replacement part surgery, by the way, is outside the scope of this article.) Biometrics measure individuals unique physical or behavioral characteristics to recognize or authenticate their identity. Common physical biometrics include ngerprints; hand or palm geometry; and retina, iris, or facial characteristics. Behavioral characters include signature, voice (which also has a physical component), keystroke pattern, and gait. Of this class of biometrics, technologies for signature and voice are the most developed. Figure 1 describes the process involved in using a biometric system for security.

Fingerprints
A ngerprint looks at the patterns found on a ngertip.There are a variety of approaches to ngerprint verification. Some emulate the traditional police method of matching minutiae; others use straight pattern-matching devices; and still others are a bit more unique, including things like moir fringe patterns and ultrasonics. Some verication approaches can detect when a live nger is presented; some cannot. A greater variety of fingerprint devices is available than for any other biometric. As the prices of these devices and processing costs fall, using fingerprints for user verification is gaining acceptancedespite the common-criminal stigma.
January February 2001 IT Pro 27

WHAT IS A BIOMETRIC?
The security eld uses three different types of authentication: something you knowa password, PIN, or piece of personal information (such as your mothers maiden name); something you havea card key, smart card, or token (like a SecurID card); and/or something you area biometric.

Inside
Glossary Resources

1520-9202/01/$10.00 2001 IEEE

SECURITY

Figure 1. How a biometric system works.

1 Biometric devices 2 Biometric enrollment 6 4 Biometric devices 5 Biometric verification 7 Business applications 8 Template storage 3 Template storage

the unique patterns of the retina. Retinal scanning can be quite accurate but does require the user to look into a receptacle and focus on a given point.This is not particularly convenient if you wear glasses or are concerned about having close contact with the reading device. For these reasons, retinal scanning is not warmly accepted by all users, even though the technology itself can work well.

Iris

An iris-based biometric, on the other hand, involves analyzing features found in the colored ring of tissue that surrounds the pupil. Iris scanning, undoubtedly the less intrusive of the eye(1) Capture the chosen biometric; (2) process the biometric related biometrics, uses a fairly conventional and extract and enroll the biometric template; (3) store the camera element and requires no close contact template in a local repository, a central repository, or a portable between the user and the reader. In addition, it token such as a smart card; (4) live-scan the chosen biometric; has the potential for higher than average tem(5) process the biometric and extract the biometric template; plate-matching performance. Iris biometrics (6) match the scanned biometric template against stored temwork with glasses in place and is one of the few plates; (7) provide a matching score to business applications; (8) devices that can work well in identication mode. record a secure audit trail with respect to system use. Ease of use and system integration have not traditionally been strong points with iris scanning devices, but you can expect improvements in Fingerprint verification may be a good choice for in- these areas as new products emerge. house systems, where you can give users adequate explanation and training, and where the system operates in a Face controlled environment. It is not surprising that the workFace recognition analyzes facial characteristics. It station access application area seems to be based almost requires a digital camera to develop a facial image of the exclusively on ngerprints, due to the relatively low cost, user for authentication. This technique has attracted consmall size, and ease of integration of ngerprint authenti- siderable interest, although many people dont completely cation devices. understand its capabilities. Some vendors have made extravagant claimswhich are very difcult, if not impossible, to substantiate in practicefor facial recognition Hand geometry Hand geometry involves analyzing and measuring the devices. Because facial scanning needs an extra peripheral shape of the hand.This biometric offers a good balance of not customarily included with basic PCs, it is more of a performance characteristics and is relatively easy to use. niche market for network authentication. However, the It might be suitable where there are more users or where casino industry has capitalized on this technology to creusers access the system infrequently and are perhaps less ate a facial database of scam artists for quick detection by security personnel. disciplined in their approach to the system. Accuracy can be very high if desired, and exible performance tuning and configuration can accommodate a Signature wide range of applications. Organizations are using hand Signature verication analyzes the way a user signs her geometry readers in various scenarios, including time and name. Signing features such as speed, velocity, and pressure attendance recording, where they have proved extremely are as important as the finished signatures static shape. popular. Ease of integration into other systems and Signature verification enjoys a synergy with existing processes, coupled with ease of use, makes hand geometry processes that other biometrics do not. People are used to an obvious rst step for many biometric projects. signatures as a means of transaction-related identity verication, and most would see nothing unusual in extending this to encompass biometrics. Signature verication devices Retina A retina-based biometric involves analyzing the layer of are reasonably accurate in operation and obviously lend blood vessels situated at the back of the eye. An estab- themselves to applications where a signature is an accepted lished technology, this technique involves using a low- identier. Surprisingly, relatively few signicant signature intensity light source through an optical coupler to scan applications have emerged compared with other biomet28 IT Pro January February 2001

ric methodologies. But if your application ts, it is a technology worth considering.

Glossary
Crossover error rate (CER)a comparison metric for different biometric devices and technologies; the error rate at which FAR equals FRR. The lower the CER, the more accurate and reliable the biometric device. Enrollmentthe initial process of collecting biometric data from a user and then storing it in a template for later comparison. False-acceptance rate (FAR)the percentage of imposters incorrectly matched to a valid users biometric. False-rejection rate (FRR)the percentage of incorrectly rejected valid users. Identicationthe process by which the biometric system identies a person by performing a one-to-many (1:n) search against the entire enrolled population. Templatea mathematical representation of biometric data. A template can vary in size from 9 bytes for hand geometry to several thousand bytes for facial recognition. Verificationthe authentication process by which the biometric system matches a captured biometric against the persons stored template (1:1).

Voice
Voice authentication is not based on voice recognition but on voice-to-print authentication, where complex technology transforms voice into text.Voice biometrics has the most potential for growth, because it requires no new hardwaremost PCs already contain a microphone. However, poor quality and ambient noise can affect verication. In addition, the enrollment procedure has often been more complicated than with other biometrics, leading to the perception that voice verification is not user friendly. Therefore, voice authentication software needs improvement. One day, voice may become an additive technology to nger-scan technology. Because many people see nger scanning as a higher authentication form, voice biometrics will most likely be relegated to replacing or enhancing PINs, passwords, or account names.

USES FOR BIOMETRICS

Security systems use biometrics for two basic purposes: to verify or to identify users. Identication tends to be the more difcult of the two uses because a system must search a database of enrolled users to nd a match (a one-to-many search). The biometric that a security system employs depends in part on what the system is protecting and what it is trying to protect against.

Physical access
For decades, many highly secure environments have used biometric technology for entry access. Today, the primary application of biometrics is in physical security: to control access to secure locations (rooms or buildings). Unlike photo identication cards, which a security guard must verify, biometrics permit unmanned access control. Biometric devices, typically hand geometry readers, are in office buildings, hospitals, casinos, health clubs, and even a Moose lodge. Biometrics are useful for high-volume access control. For example, biometrics controlled access of 65,000 people during the 1996 Olympic Games, and Disney World uses a fingerprint scanner to verify season-pass holders entering the theme park. Engineers are developing several promising prototype biometric applications to support the International Air Transport Associations Simplifying Passenger Travel (SPT) initiatives. One such program is EyeTicket, which Charlotte/Douglas International Airport in North Carolina and Flughafen Frankfurt/Main Airport in Germany are evaluating. EyeTicket links a passengers frequent-flyer number to an iris scan. After the passenger enrolls in the system, an unmanned kiosk performs ticketing and check-in (without luggage). The US Immigration and Naturalization Services Passenger Accelerated Service System uses hand geometry

to identify and process preenrolled, low-risk frequent travelers through an automated immigration system. Currently deployed in nine international airports, including Washington Dulles International, this system uses an unmanned kiosk to perform citizenship-verication functions.

Virtual access
For a long time, biometric-based network and computer access were areas often discussed but rarely implemented. Recently, however, the unit price of biometric devices has fallen dramatically, and several designs aimed squarely at this application are on the market. Analysts see virtual access as the application that will provide the critical mass to move biometrics for network and computer access from the realm of science-ction devices to regular system components.At the same time, user demands for virtual access will raise public awareness of the security risks and lower resistance to the use of biometrics. Physical lock-downs can protect hardware, and passwords are currently the most popular way to protect data on a network. Biometrics, however, can increase a companys ability to protect its data by implementing a more secure key than a password. Using biometrics also allows a hierarchical structure of data protection, making the data even more secure: Passwords supply a minimal level of access to network data; biometrics, the next level. You can even layer biometric technologies to enhance security levels.
January February 2001 IT Pro 29

SECURITY

Resources
The Biometric Consortium (http://www.biometrics.org): Serves as the US governments focal point for research, development, test, evaluation, and application of biometric-based personal identication and verication technologies. Association for Biometrics (http://www.afb.org.uk): Aims to promote the awareness and development of biometric-related technologies. It provides an international forum for research and development, system design and integration, application development, market development, and other issues. Avanti (http://homepage.ntlworld.com/avanti/): A reference site for biometrics, Avanti contains a considerable amount of background information about biometrics, their use in everyday business situations, and how to deploy them. Biometrics: Journal of the International Biometric Society (http:// stat.tamu.edu/Biometrics/): Published quarterly, Biometrics aims to promote and extend the use of mathematical and statistical methods in various disciplines. It describes and exemplies developments in these methods and their application for experimenters and those primarily concerned with data analysis. International Biometric Industry Association (http://www.ibia. org): A trade association founded in September 1998 in Washington, D.C., to advance, advocate, defend, and support the biometric industrys collective international interests. Governed by and for biometric developers, manufacturers, and integrators, IBIA aims to serve all biometric technologies in all applications.

body recognition technologies, researchers hope to use biometrics to automatically identify known suspects entering buildings or traversing crowded security areas such as airports.The use of biometrics for covert identification as opposed to authentication must overcome technical challenges such as simultaneously identifying multiple subjects in a crowd and working with uncooperative subjects. In these situations, devices cannot count on consistency in pose, viewing angle, or distance from the detector.

THE FUTURE OF BIOMETRICS

Although companies are using biometrics for authentication in a variety of situations, the industry is still evolving and emerging. To both guide and support the growth of biometrics, the Biometric Consortium formed in December 1995. The recent Biometric Consortium annual conference highlighted two important areas.

Standardization

E-commerce applications
E-commerce developers are exploring the use of biometrics and smart cards to more accurately verify a trading partys identity. For example, many banks are interested in this combination to better authenticate customers and ensure nonrepudiation of online banking, trading, and purchasing transactions. Point-of-sales (POS) system vendors are working on the cardholder verication method, which would enlist smart cards and biometrics to replace signature verication. MasterCard estimates that adding smart-card-based biometric authentication to a POS credit card payment will decrease fraud by 80 percent. Some are using biometrics to obtain secure services over the telephone through voice authentication. Developed by Nuance Communications, voice authentication systems are currently deployed nationwide by both the Home Shopping Network and Charles Schwab.The latters marketing catch phrase is No PIN to remember, no PIN to forget.

The biometrics industry includes more than 150 separate hardware and software vendors, each with their own proprietary interfaces, algorithms, and data structures. Standards are emerging to provide a common software interface, to allow sharing of biometric templates, and to permit effective comparison and evaluation of different biometric technologies. The BioAPI standard released at the conference, denes a common method for interfacing with a given biometric application. BioAPI is an open-systems standard developed by a consortium of more than 60 vendors and government agencies. Written in C, it consists of a set of function calls to perform basic actions common to all biometric technologies, such as enroll user, verify asserted identity (authentication), and discover identity. Not surprising, Microsoft, the original founder of the BioAPI Consortium, dropped out and developed its own BAPI biometric interface standard. Another draft standard is the Common Biometric Exchange File Format, which denes a common means of exchanging and storing templates collected from a variety of biometric devices. The Biometric Consortium has also presented a proposal for the Common Fingerprint Minutia

Covert surveillance
One of the more challenging research areas involves using biometrics for covert surveillance. Using facial and
30 IT Pro January February 2001

Table 1. Comparison of biometrics

Characteristic Ease of Use Error incidence Accuracy Cost User acceptance Required security level Long-term stability Fingerprints High Dryness, dirt, age High * Medium High High Hand geometry High Hand injury, age High * Medium Medium Medium Retina Low Glasses Very high * Medium High High Iris Medium Poor lighting Very high * Medium Very high High Face Medium Lighting, age, glasses, hair High * Medium Medium Medium Signature High Changing signatures High * Very high Medium Medium Voice High Noise, colds, weather High * High Medium Medium

* The large number of factors involved makes a simple cost comparison impractical.

Exchange format, which attempts to provide a level of interoperability for ngerprint technology vendors. Biometric assuranceconfidence that a biometric device can achieve the intended level of securityis another active research area. Current metrics for comparing biometric technologies, such as the crossover error rate and the average enrollment time, are limited because they lack a standard test bed on which to base their values. Several groups, including the US Department of Defenses Biometrics Management Ofce, are developing standard testing methodologies. Much of this work is occurring within the contextual framework of the Common Criteria, a model that the international security community developed to standardize evaluation and comparison of all security products (Kimberly Caplan, Building an International Security Standard, IT Professional, Mar.-Apr. 1999).

a smart card that contains a ngerprint sensor directly on the card.This is a stronger secure architecture because cardholders must authenticate themselves directly to the card. PKI uses public- and private-key cryptography for user identication and authentication. It has some advantages over biometrics: It is mathematically more secure, and it can be used across the Internet.The main drawback of PKI is the management of the users private key. To be secure, the private key must be protected from compromise; to be useful, the private key must be portable. The solution to these problems is to store the private key on a smart card and protect it with a biometric. In the Smart Access common government ID card program, the US General Services Administration is exploring this marriage of biometrics, smart cards, and PKI technology. The government of Finland is also considering using these technologies in deploying the Finnish National Electronic ID card.

Hybrid technology uses

One of the more interesting uses of biometrics involves combining biometrics with smart cards and public-key infrastructure (PKI). A major problem with biometrics is how and where to store the users template. Because the template represents the users personal characters, its storage introduces privacy concerns. Furthermore, storing the template in a centralized database leaves that template subject to attack and compromise. On the other hand, storing the template on a smart card enhances individual privacy and increases protection from attack, because individual users control their own templates. Vendors enhance security by placing more biometric functions directly on the smart card. Some vendors have built a ngerprint sensor directly into the smart card reader, which in turn passes the biometric to the smart card for verication.At least one vendor,Biometric Associates,has designed

SELECTING A BIOMETRIC TECHNOLOGY

Biometric technology is one area that no segment of the IT industry can afford to ignore. Biometrics provide security benets across the spectrum, from IT vendors to end users, and from security system developers to security system users.All these industry sectors must evaluate the costs and benets of implementing such security measures. Different technologies may be appropriate for different applications, depending on perceived user profiles, the need to interface with other systems or databases, environmental conditions, and a host of other application-specic parameters (see Table 1).

Ease of use
Some biometric devices are not user friendly. For example, users without proper training may experience diffiJanuary February 2001 IT Pro 31

SECURITY

Figure 2. Crossover error rate attempts to combine two measures of biometric accuracy.

Crossover error rate

biometric capture hardware; back-end processing power to maintain the database; research and testing of the biometric system; installation, including implementation team salaries; mounting, installation, connection, and user system integration costs; user education, often conducted through marketing campaigns; exception processing, or handling users who cannot submit readable images because of missing appendages or unreadable prints; productivity losses due to the implementation learning curve; and system maintenance.

False-rejection rate 0

False-acceptance rate

User acceptance
Generally speaking, the less intrusive the biometric, the more readily it is accepted. However, certain user groups some religious and civil-liberties groupshave rejected biometric technologies because of privacy concerns.

culty aligning their head with a device for enrolling and matching facial templates.

Error incidence
Two primary causes of errors affect biometric data: time and environmental conditions. Biometrics may change as an individual ages. Environmental conditions may either alter the biometric directly (for example, if a nger is cut and scarred) or interfere with the data collection (for instance, background noise when using a voice biometric).

Required security level

Organizations should determine the level of security needed for the specic application: low, moderate, or high. This decision will greatly impact which biometric is most appropriate. Generally, behavioral biometrics are sufficient for low-to-moderate security applications; physical biometrics, for high-security applications.

Accuracy
Vendors often use two different methods to rate biometric accuracy: false-acceptance rate or false-rejection rate. Both methods focus on the systems ability to allow limited entry to authorized users. However, these measures can vary signicantly, depending on how you adjust the sensitivity of the mechanism that matches the biometric. For example, you can require a tighter match between the measurements of hand geometry and the users template (increase the sensitivity). This will probably decrease the false-acceptance rate, but at the same time can increase the false-rejection rate. So be careful to understand how vendors arrive at quoted values of FAR and FRR. Because FAR and FRR are interdependent, it is more meaningful to plot them against each other, as shown in Figure 2. Each point on the plot represents a hypothetical systems performance at various sensitivity settings. With such a plot, you can compare these rates to determine the crossover error rate. The lower the CER, the more accurate the system. Generally, physical biometrics are more accurate than behavioral biometrics.

Long-term stability
Organizations should consider a biometrics stability, including maturity of the technology, degree of standardization, level of vendor and government support, market share, and other support factors. Mature and standardized technologies usually have stronger stability.

iometric technology has been around for decades but has mainly been for highly secretive environments with extreme security measures. The technologies behind biometrics are still emerging. This article gives a snapshot of the dynamics under way in this emerging biometric market, and we hope it will help you consider all the possible alternatives when acquiring new biometric technologies. s

Simon Liu is director of computer and communications systems at the National Library of Medicine. He is also an adjunct professor at Johns Hopkins University. Contact him at simon_liu@nlm.nih.gov. Mark Silverman is a technical advisor at the Center of Information Technology, National Institutes of Health. Contact him at mls@nih.gov.

Cost
Cost components include
32 IT Pro January February 2001