InfoSecurity

July 27, 2006
Biometrics: Way of the future!

Geetanjali Babbar

NEW DELHI -- The word biometrics comes from the Greek words 'bio' and 'metric', meaning "life measurement." Biometrics is automated methods of recognising a person based on a physiological or behavioral characteristic. Among the features measured are face, fingerprints, hand geometry, handwriting, iris, retinal, vein, and voice. Biometric technologies are becoming the foundation of an extensive array of highly-secure identification and personal verification solutions. As the level of security breaches and transaction fraud increases, the need for secure identification and personal verification technologies is becoming apparent. By measuring something unique about an individual and using that to identify him or her, an organisation can dramatically improve their security measures.

With security becoming an increasing concern for world governments as well as corporate businesses, biometric access to computers would alleviate fears to a large extent, and should therefore, become more popular. There are two key aspects of most biometric authentication projects: identification and authentication. Products already on the market include finger print scanner units, keyboard and mouse scanners, touch screen monitors, voice-activated softwares, etc.

The oldest and most widely accepted biometric is the fingerprint. The tip of every finger has a characteristic called friction ridges. While generally similar, no two friction ridges are exactly the same. By imaging the ridges of the fingertips, we get the fingerprint. Newer biometric measurements include DNA from tissue samples, voice pattern, face pattern or even the arrangement of blood vessels in the retina or pattern of coloration in the cornea of the eye. Trusted Platform Module (TPM) is also being adopted slowly because it can support a multi-user environment, lock files and folders and enable superior security.

Technological Options

Biometrics are collected using a device called a sensor. These sensors are used to acquire the data needed for recognition and to convert the data to a digital form. The quality of the sensor used has a significant impact on the recognition results. The ‘sensors’ could be digital cameras for face recognition or a telephone for voice recognition.

The most viable, mature and easy to use technology is finger print authentication. The least intrusive being iris/retinal scan, however, they can be cumbersome and difficult to use. Finger print technology has the largest market share in the technology segment, for the simple reason that it fits nicely within the constraints of convenience and security.

“Fingerprint scanning is the most viable and established biometrics technique available today. It is the easiest to use and the most economical to implement in user authentication techniques. Voice recognition analysis is the least intrusive of the biometrics techniques available today, but has its drawbacks on the security front as a person's voice can be recorded and used for unauthorised PC or network access. An illness such as a cold can change a persons voice making absolute identification difficult or impossible,” said Manikandan, general manger, sales and marketing, IT Division, LGEIL.

Enhancing security and convenience

As mentioned previously, various biometric authentication systems have proven to be effective means of deterring fraud. In conjunction with smart cards, biometrics allow for controlled, portable access to personal information. They provide a solid foundation for developing secure applications and communications. Applications vary and range from logical access to a personal computer, to physical access of a secure laboratory. These identification systems, therefore, can vary based on the environment.

Biometrics are also used for accountability applications such as recording the biometric identities of individuals boarding an aircraft, signing for a piece of equipment, or recording the chain of evidence. Of course, biometrics perform more reliably in controlled environments, such as offices and laboratories, than in uncontrolled environments, such as the outdoors.

Consequently, many companies are also implementing biometric technologies to secure areas, maintain time records, and enhance user convenience. To take a simple example, an employee enters a restricted area and uses his fingerprint as a password – not only eliminating the need to remember multiple passwords, but also providing a stronger security framework. Therefore, in access entry applications, fingerprint recognition technologies are now not only mature enough, but also cost effective enough, to be implemented.

Access entry applications aside, biometrics have the potential to have an impact on our everyday lives. An interesting biometric application is linking biometrics to credit cards. Other financial transactions could benefit from biometrics, e.g., voice verification when banking by phone, fingerprint validation for e-commerce, etc. The market is huge, and covers a very wide range of hardware, applications and services.

The usefulness of biometrics vary from application to application. To determine their true benefit, one must first develop and understand the operational requirements of the application. However, before making a decision, one must ensure this task will meet the determined operational needs. Biometrics can potentially provide cost savings through relocating security resources or diminishing the expenses associated with password maintenance.

Safety

“The safety of using biometrics has recently come under the radar as it has been associated with severe miscarriages of justice. Technology has the ability to blind us when individuals are able to plant DNA at the scene of the crime, thereby implicating someone with a great deal of certainty. Criminals can even interfere with the interface between a biometric device and the host system so that a fail message gets converted to a pass," said Vipin Tyagi, president and CEO, Network Programs.

Physically, these technologies have varying degrees of intrusiveness but present no risk to public health and safety. Biometric technologies have been used and tested under the most demanding real world applications and conditions. Biometrics are typically passive and designed to be safe to use. The systems usually implement ordinary computing and video technology, such as that encountered in a person's day-to-day activities.

Applications: The Story so Far

The bulk of biometric applications to date are probably in areas that a common man will never hear of because there are a very large number of relatively small security related applications undertaken by specialist security systems suppliers. These systems account for the majority of unit sales as far as the device manufacturers are concerned and are often supplied via a third-party distribution chain. The applications being deployed in the public domain include:

Prison visitor systems: Visitors to inmates are subject to verification procedures to ensure that identities are not swapped during the visit – a more common occurrence than one would imagine in prisons worldwide;

Drivers licences: Some authorities have found that drivers (particularly truck drivers) have multiple licences, some have even swapped licences among themselves when crossing state lines or national borders;

Canteen administration: Particularly on campus where subsidised meals are available to bona fide students, a system that is easy to abuse without proper verification;

Voting systems: Eligible voters may be required to verify their identity during a voting process. This is intended to stop 'proxy' voting where the vote may not go as expected;

In addition to the above mentioned items, there are numerous applications in gold and diamond mines, bullion warehouses and bank vaults, as indeed you might expect, as well as the more commonplace physical access control applications in industry.

Emerging Opportunities:

Vendors in today’s day and age take a broader view of available solutions. Biometric applications need to interconnect to multiple devices and legacy applications. A fingerprint scan is only as good as the database that supports it. So linking the two is key to providing business value. Keeping this fact in mind, Network Programs has integrated four technologies (4T) -- biometrics, RFID, telematics and smartcards.

“The market is ripe for opportunities in the biometrics domain. Nothing is simpler than using your own finger for various transaction you do in your day to day life, right from opening doors with keys to remembering passwords for internet accounts, e-banking accounts, up to starting you car,” said BioEnable Tech. BioEnable has already developed and launched products like the fingerprint based car immobiliser and special biometric-enabled locks for homes.

According to Manikandan, the biometric industry is at an infancy stage in India, but is catching up fast. It has become indispensable in top-end laptops today. “The opportunities for us are limited to the commercial space because security is a major concern in commercial/office space. Security issues are not much of a concern for the home segment. The areas where enhanced security is being used heavily are defence, research and corporates in areas where security and confidentiality cannot be compromised,” he added.

Taking into consideration the growing necessity of security, LG has ensured that its newly launched notebooks -- P1 and T1, which are based on the latest Napa platform/dual core, and are equipped with enhanced security features such as TPM, Finger Print Reader (FPR) and HDD security.

Moving on?

Over the past ten years, there's been a significant evolution in biometrics technology. Front-end applications and the supporting hardware have matured, failure rates are very low, while back-end integration with existing PKI and encryption systems has improved. The real future of the technology lies in creating a flexible 'biometric trust infrastructure' that allows enterprises and the public sector to handle security needs that get identified beyond the first implementation. Ultimately, such an infrastructure would allow people to move to various locations worldwide while maintaining their security clearance as defined by their professional and personal identities.

Apart from rise in demand, new segments opening up and greater acceptance of this technology is taking place – there is a shift toward advance solution involving integration of these system with existing systems. Customers also want future upgradeable systems where they can start with simple systems and later upgrade to more complex and sophisticated system.

Commenting on the evolution of biometrics technology over the past several years, Manikandan said: “The technology has been floating in the market for a long time but it's only recently that its importance has been realised. A major advantage LG offers is that its FPR is doubly secured with the technology. The TPM is a microcontroller, affixed to the motherboard of a PC that stores keys, passwords and digital certificates. The nature of this silicon ensures that the information stored there is made more secure from external software attack and physical theft. Access to data and secrets in a platform could be denied if the boot sequence is not as expected.”

Privacy issues and ethical standards demand attention

Industry reports have shown that while some technologies have gained more acceptance than others, it is beyond doubt that the access control and biometrics as a whole show great potential for use in end-user segments such as airports, stadiums and defence installations. The intrusive nature of many biometric technologies demand adequate resolution (and legislation) to ethical issues before they can be publicly implemented. Privacy issues are steeped in ethical standards – this is a thorny issue that needs to be tackled.

“With respect to technological diversity, the biometrics industry includes more than 150 separate hardware and software vendors, each with their own proprietary interfaces, algorithms, and data structures. So among the technology issues one of the most important ones is the development of solutions that can be integrated. This demands a common platform. We are working towards this end by integrating the 4Ts. At Network Programs, we enjoy the challenge of successfully developing cutting edge technologies, and working with 4T, and biometrics highlights our passion for pushing innovation,” said Vipin Tyagi of Network Programs.

“It’s clear that biometric technology has a tremendous opportunity to reshape the manner in which citizens, employees, and consumers interact with their governments, their employers, and with each other. However, the biometric industry must immediately address major challenges related to performance, real-world utility, and potential privacy impact in order for biometrics to reach their full potential,” commented Prem Rathore, manager, value added services, BioEnable Technologies.

“In order to keep up with this expectation, we have introduced more rigid testing procedures, upgraded to the latest in communication technologies, and are making the system architecture more open and easy to use / integrate, while also making them more secure using special techniques,” he added.

Regulatory framework expected soon

The lack of a standard regulatory framework is a major issue. In the West, there have been outbursts against biometrics usage. Some organisations and groups are of the opinion that the technology is being implemented inappropriately, and threaten to invade the privacy of individuals. These groups have been demanding a ban on the usage of biometrics, until and unless an appropriate and legally enforceable regulatory regime is established. There have been talks of implementation of regulations that prohibit the manufacture, import, installation or use of biometric measuring devices that do not comply with certain design standards. However, with the increasing adaptation of this technology, the enforcement of appropriate laws and regulations is not far.

Mr. Rathore of BioEnable is of the view that new government regulations are mandating security investment, and as a result are leading to high growth rates of biometric technologies. Increased IT spending in the government and financial sector offers better opportunities for such deployments. The corporate enterprise market and consumer markets are adopting biometric technologies for increased security and convenience. The decreasing prices of biometric solutions and improving technology performance are leading to more deployments. Even though there are no global mandated or regulatory frame works as of now, they are expected to arrive very soon.

Key technology trends

The trends are changing as more and more sectors are becoming more open to use this technology for various applications. There is a substantial increase in terms of the user handling capacities of these systems.

Integration of Biometrics with auto-id technologies: The natural trend will be the integration of biometrics technology with other auto-id technologies like Mifare and RFID.

Increased demand: There is an increasing demand for wireless technology based products in this domain.

What is the future?

There is no doubt that biometric technology is mature and eminently useable across a wide variety of advanced personal ID-related applications. Both the systems integrator and the end user have a wider choice than ever before of front-end biometric components, and it’s easier than it has ever been to integrate these components into bespoke systems. Individual unit cost is still relatively high for biometric products, but this too is changing and several manufacturers are introducing lower cost OEM modules to the market place.

In short, if you have an operational problem that biometrics might solve there is no reason to sit on the fence any longer - biometrics are alive and well and available off the shelf at a location near you!