Section 10.1. Introduction

10.1. Introduction

Biometrics is the comparison of live anatomical, physiological, or behavior characteristics to the stored template of a person. Physiological biometrics include those based on fingerprints, hand and/or finger geometry, and the patterns of retinas, veins, irises, and faces. Behavioral biometrics techniques include those based on voice, signature, and typing behavior.

Table 10-1 provides a brief description of the most well-developed biometrics technologies.

Table 10-1. Common types of biometrics

Biometrics	Description
Fingerprint	Patterns found on the fingertip, including the location and direction of ridge endings and bifurcations
Palm print	A larger-scale version of the fingerprint biometrics
Vein pattern	Vein and capillary patterns on the back of the hand
Hand geometry	Shape of the hand including height and width of bones and joints in the hands and fingers
Finger geometry	3D features of index and middle finger of leading hand
Retina	Layer of blood vessels in the back of the eye
Iris	Inherent radial pattern and visible characteristics (e.g., freckles, rings, furrows, corona) of the iris
Facial	Facial characteristics such as position and shape of nose and position of cheekbones, eye sockets, and mouth (but not hairline area, which is prone to change)
Voice	Voice characteristics (frequency, duration, cadence)
Signature	Time, stroke speed, spacing, letter formation, stylus pressure, etc.
Typing dynamics	Typing habits including speed and patterns for particular words

Other biometrics systems have been proposed but not brought to market. These include the recognition of a person's earlobe, ear shape, smell, gait, and pressure with which keys are pressed. Recently, recognition of laughter, bones in the finger, facial thermograms, inner ear bones, and lip shape have also been discussed. However, many of these techniques are still in the realms of fantasy. Moreover, no biometrics system has yet been developed that appears to be well suited for all applications.

Current biometrics research is being driven primarily by the military. The Defense Advanced Research Projects Agency (DARPA), for example, sponsors much of the research in the United States, with "Human ID at a distance" being one of their ongoing projects.^[9]

^[9] The Defense Advanced Research Projects Agency (DARPA), "Human ID at a Distance"; http://infowar.net/tia/www.darpa.mil/iao/HID.htm.

10.1.1. Biometrics Types

Before continuing, I must distinguish between two specific types of biometrics applications:

• Biometrics for identification. Those that require identifying an individual from the set of all possible users (by matching an acquired biometrics image to all possible templates)

• Biometrics for verification. Those that require verifying a particular identity (by matching an acquired biometrics image against a specific template)

Biometrics used for identification must ensure the uniqueness of each member of the target population. As the size of the population grows, so grows the probability that more than one user will fall within the match criteria. Fingerprints, retinal scanning, and iris scanning are the only biometrics techniques that can accurately identify a person from a large database. Facial systems are often used to create a manageable subset of possible identities, but they then must be scrutinized by a human observer. Thus, facial systems may not be suitable for real-time identification.^[10]

^[10] "Tomorrow's Markets," Biometric Technology Today (May 2004), 79.

Even when an individual can be uniquely identified using a biometrics system, the processing time required makes biometrics identification unsuitable for many uses. In applications such as border control and ATMs, the potential user base is in the millions and the processing time needed to identify someone from a biometrics measurement would be prohibitive. However, biometrics may be used for verification purposes.

For biometrics verification, an identifier is provided to allow the system to determine which identity is being claimed, and therefore which template to utilize in the verification process. Traditionally within the banking industry, the token is the conventional bank card used to activate the self-service terminal or ATM. Within other systems, tokens may include a national identification card, driver's license, or passportall of which have either been tested with, or are being considered for, being embedded with some form of biometrics identifier. However, any sufficiently individual tokenfor example, a radio frequency tagcould be used. Alternatively, the user could simply key in a unique identifier such as a personal account number or a Social Security number. The system then needs to check the biometrics information (template) associated with the claimed identity against the biometrics information that is currently being provided for verification.

10.1.2. Issues of Biometrics Specificity

Biometrics technologies are difficult to compare against one another. A variety of technologies can be used to verify a single biometrics characteristic. Further, each characteristic and technology brings with it a unique set of both technical and user issues, and significant differences exist between the software algorithms used to compare two samples.

Biometrics technologies have a wide range of accuracy, reliability, and usability. Thus, despite the difficulty in comparing biometrics, they will always have some comparable accuracy versus usability balance that can be compared with other technologies. The biometrics that are easiest to use are those that can be captured passively (e.g., some facial recognition systems). However, some systems that are more difficult to use (e.g., those requiring a user to align a particular body part with a sensor) currently produce more accurate results.

10.1.3. The Fingerprint Example

The fingerprint biometrics illustrates the range of issues each biometrics technology must address, the range of technologies available, the impact of the user, and his attitudes on the system's performance.

There are several commercially available methods of capturing the initial fingerprint image: optical, capacitive, ultrasonic, thermal, and pressure. Fingerprint systems require the user to place his finger flat on the sensor, or to move his finger across the sensor. Both methods require that the finger remain flat during this process. This may seem simple but has not proved natural or intuitive to untrained users who point down, or roll their fingers either side to side or bottom to top.^[11]

^[11] L. Coventry, A. De Angeli, and G. Johnson, "Biometric Verification at a Self-Service Interface," Proceedings of the British Ergonomic Society Conference (Edinburgh, April 2003).

According to Biometrics Report,^[12] fingerprint quality is affected by race, gender, occupation, and age: caucasians have better defined prints than other races; women have finer prints than men; manual workers can have worn or damaged prints; children have softer skin and thus less well-defined prints than adults; older adults lose moisture and skin elasticity. Optical systems themselves are affected by dirt, cold fingers, and finger damage, and are otherwise prone to fraud.^[13] Capacitive systems are not susceptible to dirt or fraud but have more placement issues, require a specific pressure to be applied, and are affected by cold fingers and age-related issues.

^[12] Biometrics Report 2000-2005; http://www.biometricgroup.com.

^[13] L. Thalheim, J. Krissler, and P. M. Ziegler, "Bodycheck: Biometric Access Protection Devices and Their Programs Put to the Test," C'T, 11 (May 22, 2002); http://www.heise.de/ct/english/02/11/114/.

For a fingerprint sensor to be considered successful, it must be able to respond to "outlying" cases (those unable to effectively present their biometrics to the system). Independent test data^[14] has shown the ultrasonic to be more effective than either the optical or the capacitive sensors, as it is of higher resolution and can deal with dry fingers. However, the vibration experienced by users may feel strange. Many companies produce software algorithms^[15] for fingerprint recognition that work on any image.

^[14] The National Biometric Test Centre, San Jose State University, San Jose, CA; http://www.engr.sjsu.edu/biometrics/.

^[15] D. Maio et al., "Fingerprint Verification Competition 2000," Proceedings of the 15th International Conference on Pattern Recognition (Barcelona, Sept. 2000); http://www.csr.unibo.it/research/biolab.

User concerns about fingerprint sensors include hygiene, association with crime (although this is diminishing), fear of attacks aimed at removing fingers, and fraud from severed or artificial fingers or from images of the print. Some vendors offer life-testing sensors as an option, although "no fingerprint systemcurrently on the marketis 100% foolproof."^[16]

^[16] Biometric Technology Today 9:6 (Oct. 2001), 9.