Biometrics

Biometrics (derived from the Greek words bios = "life" and metron = "measure") is the study and development of automated methods for the identification and authentication of individuals based on each person's unique physical and behavioral traits. The term biometrics is also used to refer to the automated methods themselves. In addition, the word biometric is sometimes used as a noun to refer to the particular characteristic being measured, and sometimes as an adjective to describe the measurements, products, or technologies in this field.

Examples of unique physical characteristics include fingerprints, eye retinas and irises, facial patterns, hand measurements, and DNA sequences (DNA "fingerprints"). Examples of chiefly behavioral characteristics include signature, gait, and typing patterns. Voice is considered a mix of both physical and behavioral characteristics.

Biometric systems have been designed to function either as instruments of surveillance that look for terrorist or criminal activity, or as a means to verify the identity of individuals who wish to gain access to a secure place or system. In today's world, such capabilities appear necessary. These systems, however, have technical limitations and associated error rates. In addition, systems used for surveillance could intrude on individual privacy and freedoms, and if biometric information were not sufficiently safeguarded, people with criminal intent, exacerbating the problem of identity theft, could steal it. Thus, although these technologies can help enhance safety and security, they could, if misused, lead to the opposite effects.

History

While biometrics did not show up in practice in Western cultures until the late nineteenth century, it was being used in China by at least the fourteenth century. Explorer and writer Joao de Barros recorded that Chinese merchants stamped children’s palm prints and footprints on paper with ink, as a way to distinguish young children from one another.

In the West, identification relied heavily on "photographic memory" until Alphonse Bertillon, a French police desk clerk and anthropologist, developed the "anthropometric" system (later known as Bertillonage) in 1883. It was the first precise, scientific system widely used to identify criminals. It turned biometrics into a field of study. It involved precisely measuring certain lengths and widths of the head and body, as well as recording individual markings such as tattoos and scars. Bertillon’s system was widely adopted in the West until its flaws became apparent—mainly problems associated with differing methods of measurement and changing measurements. After that, Western police forces turned to fingerprinting—essentially the same system seen in China hundreds of years earlier.

Until recently, fingerprinting was used mainly for forensics and criminal identification. With the development of biometrics technologies, silicon-based sensors that produce digital images of the fingerprint have replaced printer’s ink, and this new approach can be used as a means to secure access to a place (such as an office) or device (such as a computer). Moreover, the scope of biometrics has been expanded to include many different methods involving the measurement of various physical and behavioral traits.

Operation and performance

The use of biometric systems for human recognition is based on the premise that the chosen traits are unique to each individual and can be recorded at a high level of accuracy. These systems can serve two types of functions: (a) surveillance of a crowd to identify potential terrorists or criminals; and (b) authentication (verification) of a person's identity to allow or deny access to a place or system. Biometric systems serving both types of functions can be used to ensure the security of critical locations, such as military bases, power plants, and water reservoirs. They can also be used at border crossings, supplementing the system of checking passports and visas.

For the biometric surveillance of large numbers of people, facial images are thought to be the method of choice, especially because remotely located cameras can obtain the images. Each digitized image is converted to a template that defines the geometry of the facial features, and the template is compared with others in a database to look for possible matching templates.

When a biometric system is set up as an authentication device (to verify personal identity), it offers authorized users the advantage of being able to identify themselves and gain access to secure systems without having to carry a key or remember a password or personal identification number. First-time users are required to begin with an enrollment process, when the system records one or more of the person's physical and behavioral traits. The system uses a numerical algorithm (procedure for handling mathematical data) to convert the information into a digital representation, which is then entered into a database.

During each subsequent attempt to use the system, the person's biometric is captured again and processed into a digital template. That template is then compared with those in the database to determine a match. Ideally, when a user logs in, nearly all his features match and the system accepts the person as a valid user. On the other hand, when someone whose traits do not fully match tries to log in, the system rejects the attempt and does not allow the person to log in.

The performance of a biometric device is usually measured in terms of its "false accept rate" (FAR), "false reject (or nonmatch) rate" (FRR), and "failure to enroll" rate (FTE or FER). The FAR is a measure of the percentage of invalid users who are incorrectly accepted as genuine users, while the FRR is a measure of the percentage of valid users who are rejected as impostors.

In real-world biometric systems, if an instrument's sensitivity is adjusted to lower its FAR, then its FRR tends to increase, as shown (in a simplified form) in the graph on the right. Conversely, if the sensitivity is adjusted to lower FRR, then FAR tends to increase. Thus the instrument's FAR and FRR can be typically traded off against each other by changing some parameter.

One of the most common measures of biometric systems is the rate at which both accept and reject errors are equal. It is called the equal error rate (EER) or the cross-over error rate (CER). The lower the EER or CER, the more accurate the system is considered to be. Current technologies have widely varying equal error rates, ranging from as low as 60 percent to as high as 99.9 percent.

Although there are various misgivings about the use of biometric systems, some of these systems have the potential to identify individuals with a high degree of certainty. In particular, substantial claims are being made about the accuracy of iris recognition technology, which is said to have the capacity to distinguish between identical twins.

A comparison of biometrics technologies

The table on the right (Yau Wei Yun 2003 [1]) compares the performance of various biometrics technologies with one another in seven categories of evaluation:

• Universality describes how commonly a biometric trait occurs in each individual.
• Uniqueness is how well the biometric distinguishes one individual from another.
• Permanence measures how well a biometric resists aging.
• Collectability explains how easy it is to acquire the biometric for measurement.
• Performance indicates the accuracy, speed, and robustness of the system capturing the biometric.
• Acceptability indicates the degree of approval of a technology by the public in everyday life.
• Circumvention is how easy it is to fool the authentication system.

Each system is ranked as low, medium, or high in each category. A low ranking indicates poor performance in the evaluation criterion, whereas a high ranking indicates very good performance.

The chart shows that iris scanning has a high rating in practically every category, but a low rating in acceptability, perhaps because people may be hesitant to look into an eye scanner. On the other hand, signature receives a high rating in acceptability but a low rating in most other categories, probably because signatures can be forged.

Issues and concerns

As biometrics technologies continue to advance, more and more private companies and public utilities may be expected to use them for safe, accurate identification, and governments may use them to monitor and restrict criminal and terrorist activity. The use of biometric systems, however, has also raised various concerns, as follows.

One set of issues is related to the technical limitations of biometric systems. The biometrics approach to identity verification is only as good as the performance of the software and hardware used, and the accuracy of information in the database. Glitches in the software or hardware or computer vandalism (hacking) may cause a system to fail to recognize a genuine user, leading to a false rejection, or it may allow access to an unregistered person, leading to a false acceptance. As noted above, the "equal error rate" (the point at which the false accept rate is equal to the false reject rate) varies widely for different technologies.

Moreover, if biometric information is not sufficiently safeguarded, criminals may steal, rearrange, or copy it, and use it to access personal data and financial accounts. Alternatively, the stolen data may be sold to other parties. In this manner, the problem of identity theft could be exacerbated, severely harming the victims. A related concern is that biometric information "skimmed" from a passport could be used for international criminal schemes, including kidnapping.

An individual who wishes to foil the system may:

• plant DNA at the scene of a crime;
• associate another's identity with his own biometrics, thereby impersonating without arousing suspicion; or
• interfere with the interface between a biometric device and the host system, so that a "fail" message gets converted to a "pass".

In such cases, an innocent person may be charged with a crime, while the real culprit may escape.

Some believe that certain biometric systems may cause physical harm to its users, particularly if the instruments used are unsanitary. For example, there are concerns that retina scanners might not always be clean.

Others have expressed the fear that governments may use biometrics technologies to diminish the privacy and personal liberties of law-abiding citizens. Today, a government can use a huge range of new technologies, including but not limited to biometric systems, to "search" individuals and collect vast databases of information on them. These technologies include digital video recorders, infrared scanners, X ray scanners, wireless devices, global positioning satellite systems, voice recognition devices, DNA analyzers, and brain-wave fingerprinting instruments.

In light of these issues, the very technologies that are intended to enhance safety and security could, if misused, lead to the opposite effects.

Uses and initiatives

Brazil

Since the early twentieth century, Brazilian citizens have used identification (ID) cards. The Brazilian government's decision to adopt fingerprint-based biometrics was spearheaded by Dr. Felix Pacheco at Rio de Janeiro, then the capital of the federal republic. Dr. Pacheco was a friend of Dr. Juan Vucetich, an Argentine anthropologist and police official, who invented one of the most complete fingerprint classification systems in existence. The Vucetich system was adopted not only by Brazil but also by most other South American countries.

Each state in Brazil has the authority to print its own ID cards, but they all have the same layout and type of data. To enhance the security of these cards, they are now fully digitized, using a 2D bar code that encodes a color photo, a signature, two fingerprints, and other data. This information can be matched against its owner off-line.

Canada

Canada has introduced biometrics in its passports, with the use of digitized photos. Each passport has a chip that contains the person's picture, name, date of birth, and other information. Border crossings have electronic readers that can read the chip and verify the information on the passport.

In addition, the Canadian customs agency has instituted a system called CANPASS at major airports and other border crossings. The system involves iris-recognition technology, which allows for the efficient identification and clearance of pre-approved travelers.

United States

The United States government has become a strong advocate of biometrics, as security concerns have increased in recent years. Starting in 2005, U.S. passports with facial (image-based) biometric data were scheduled to be produced. Technical difficulties, however, are delaying the integration of biometrics into passports in the United States and European Union. These difficulties include compatibility of reading devices, information formatting, and nature of content (e.g. the US and UK currently expect to use only image data, whereas the EU intends to use fingerprint and image data in their passport RFID biometric chip(s)).

References

ISBN links support NWE through referral fees

• A Brief History of Biometrics Retrieved March 19, 2005.
• Ashborn, Julian. Guide to Biometrics. Springer Professional Computing, 2004.
• Yun, Yau Wei. The ‘123’ of Biometric Technology, 2003. Retrieved on November 21, 2005.

External Links

All links retrieved February 3, 2022.

• Access Control news portal Authoritative news site for access control and for biometric systems and products.