Vital Signs of Identity
Ben Miller
Identifying a person seems straightforward-people do it all the time in business and social encounters. But modern society has complicated things, most notoriously when a welfare recipient signs up for benefits under six identities, a child is released to a stranger from a day care center, a hacker accesses sensitive databases, a counterfeiter makes copies of bank cards, and the murderer switches places with the car thief leaving prison on a work release.
At all levels, a sure-fire means of identification has never been more in demand. Today, the average businessperson may use more than as dozen computer passwords-personal identification numbers (PINS) for automated teller machines, licenses and telephone calling, membership, and credit cards. Ten years ago, he or she probably and only a few. Yet finding satisfactory methods of identifying employees or customers can be difficult. Some techniques are easy to fool, some are too expensive, and others are felt to be too intrusive.
One area where technology is enhancing, and often simplifying, our ability to identify people is biometrics. Biometrics systems are automated methods of verifying or recognizing the identity of a living person on the basis of some physiological characteristic, like a fingerprint or iris pattern, or some aspect of behavior, like handwriting or keystroke patterns.
While biometrics is being applied both to identity verification and to identity recognition, the problems each involves are somewhat different. Verification requires the person being identified to lay claim to an identity, so that the system has a binary choice of whether accepting or rejecting the person’s claim. Recognition requires the system to look through many stored sets of characteristics and pick the one that matches the characteristics of the unknown individual being presented, a more difficult task.
A range of biometrics systems is in development or on the market, because no one system meets all needs. The tradeoffs in developing these systems involve component cost, reliability, discomfort in using a device, the amount of data needed, and other factors. Fingerprints, for example, have a long history of reliability, but the electronic imaging components required for capturing a fingerprint cost hundreds of dollars and the data describing a fingerprint, the template is large. In contrast, the tools required to capture a signature—some sort of pen or stylus and tablet—are low in cost, and the template is very small; but signatures are not as stable as fingerprints, varying with people’s emotional state, for example. Voice, too, is cheap to capture, relying on low-cost microphones or existing telephones, but varies when emotions and states of health change, and has a large template size.
Psychological factors also come into play when researchers consider biometrics for different applications. Eye recognition, for example—both retina scanning, which requires close contact with the recognition device, and iris scanning, which can be done from a more comfortable distance—disconcerts some people because of an inherent protectiveness about their eyes. Quite the contrary, hand recognition, in which the palm is placed on a plate, appears not to bother people, perhaps because shaking hands is common behavior. But in some applications, eye recognition’s psychological effect is benefit—it appears to be a very serious recognition method and this seriousness may in itself discourage intruders.
While advances in biometrics technology are snowballing, though, the market itself is growing slowly. Only a few high-quality products are being shipped and prices are too high for many applications. Potential users of biometrics—in areas ranging from banking to government, health care, and business—see clear benefits in the technology, but need reliable devices at affordable prices. They want systems that rarely reject authorized individuals, catch most impostors, and cost under $500. With the healthy pace of research and development under way, it is simply a matter of time before these goals are reached and biometrics become commonplace.
The lion’s share of biometrics devices depends on a verification system, which requires the user to lay claim to an identity by presenting a code or a card. A formula for matching two items then compares the live and enrolled images of the user’s characteristic. The question put by the machine is, “Are you who you say you are?” instead of “Do I know who you are?”
Indispensable to all biometrics systems is that they recognize a living person. One of the first questions newcomers to the field ask is, “What about a counterfeiting attempt using a latex finger, digital audio tape, plastic hand, prosthetic eyes, and so son?” To prevent such fraud, many, but not all, devices include methods for determining whether a live characteristic is being presented. The methods are sometimes ingenious but usually simpler than would be expected. Several companies are working on devices that will be very difficult to fool: for instance, an iris-scanning system soon to be released will look at characteristic patterns in the flecks of the iris, an infrared system for checking veins will look at flows warm blood, and ultrasound fingerprint readers will look at subcutaneous structures.
Biometrics encompasses both physiological and behavioral characteristics. A physiological characteristic is a relatively stable physical feature such as a fingerprint, hand silhouette, iris pattern, retina pattern, or facial feature—all these are basically unalterable without trauma to the individual.
A behavioral trait, on the other hand, has some physiological basis, but also reflects a person’s psychological makeup. The most common trait used in identification is a person’s signature. Other behaviors used include a person’s keyboard typing and speech patterns. Because most behavioral characteristics change over time, many biometrics machines that rely on behavior update their enrolled reference may differ significantly form the original data, and the machine become more proficient at identifying the person. Behavioral biometrics work best with regular use.
The differences between physiological and behavioral methods are important. For one, the degree of interpersonal variation is smaller in a physical characteristic than in a behavioral one. Barring injury, after all, a person’s fingerprint is the same day in and day out, whereas a signature is influenced by both controllable actions and day out, whereas a signature is influenced by both controllable actions and unintentional psychological factors.
Developers of behavior-based systems, therefore, have a tougher job adjusting for an individual’s variability. For example, it is easier to build a machine that guides you in placing your hand in the same position every time than it is to write formulas that take into account emotional states or the sniffles. However, machines that measure physical characteristics tend to be larger and more expensive, and may seem threatening to users. Behavior-based biometrics devices are often smaller, cheaper, and more friendly. Either technique affords a much more reliable level of identification than passwords or cards alone.
Because of these differences, no one biometrics will serve all needs. A company may even decide to use different techniques in different parts of its operations. For example, voice verification may be used in the executive suites while fingerprints are used in the computer rooms.
Hand geometry is the granddaddy of biometrics by virtue of its 20-year history of live applications. Over this span, six hand-scanning products have been developed but only one commercially viable product is currently available. For general security and computer access control applications, fingerprints are gaining popularity. As might be expected, fingerprint verifiers are installed at military facilities like the Pentagon and government laboratories, but banks, jails, and commercial entities have also been early adopters.
Fingerprints have overcome the stigma of their use in law enforcement and military applications. While some applications do steer clear of the technology for this reason, others actually build on the mystique, which seems to shout, “Identification is taken seriously here!” As a result, more than a dozen companies around the world are working on new fingerprint identification systems, and most claim their systems swill offer better False Rejection Rate (FRR) performance, lower cost, and smaller template.
Two other methods of identification involve the eye, scanning the blood vessel pattern on the retina and examining the pattern of the structure on the iris.
Retina scans, in which a weak infrared light is directed through the pupil to the back of the eye, are one of the best biometrics performers on the market, with low false-reject rates and a nearly 0 percent false-accept rate. The technology also offers small data templates, provides quick identity confirmations, and handles well the job of recognizing individuals in users’ resistance—people do not want to put their eyes as close to the device as necessary.
A device that examines the human iris is being developed now. the technique’s big advantage over retinal scans is that it does not require the user to move close to the device and focus on a target because the iris pattern is on the eye’s surface. In fact, the video image of an eye can be taken at a distance of a meter or so, and the user need not interact with the device at all.
Biometrics developers have also not lost sight of the fact that human use the face as their primary method of telling who's who. More than a dozen efforts to develop automated facial verification or recognition system use approaches ranging from pattern recognition based on neural networks to infrared scans of “hot spots” on the face. Yet, despite the best efforts of organizations, including government research laboratories, machine vision companies, and satellite image-processing experts, only one system is available on the market today.
Despite the challenges involved in facial recognition—having to deal with beards, hair cuts, expressions, and the like—there is tremendous interest in the approach. Law enforcement agencies are eager to have a machine that could spot a known terrorist, drug dealer, or bank robber in a crowd. Physical security professionals would jump at the chance to build on their existing investments in closed-circuit television systems, and computer security mavens talk of a small video-camera built into PCs that would constantly check that the person sitting at the machine is the authorized user.