Summary Description of and Future Projections for the Biometrics Industry:
The International Biometrics Group (IBG) defines biometrics simply as "the automated use of physiological or behavioral characteristics to determine or verify identity."(1) Once a rather obscure science, focused mainly on fingerprint identification in law enforcement agencies, biometrics has grown over the past decade into a multi-million dollar industry representing a wide variety of identification technologies.
Biometrics are divided into two general types: physiological biometrics which attempt to establish identity through the measurement and analysis of a part of the human body and behavioral biometrics which are based on the measurement and analysis of an action taken by a person. In the former category would be included such technologies as fingerprinting, retinal and iris scan, hand geometry and facial recognition. In the latter category, would reside such systems as those utilizing voice-recognition, keystroke scan and signature scan. Figure 1 is a representation of the market share projected for the various biometric technologies for fiscal 2003.
Figure 1.
All biometric technologies share certain basic components and processes. These include enrollment during which the user provides a sample or sample of physiological or behavioral data with which a biometric sample will be derived. The enrollment process usually consists of submission of the biometric sample through an acquisition device. This process can embody anything from a fingerprint from an inkpad or PC-based scanner, to a voice recording from a microphone or telephone, to an iris or retinal scan with a digital camera or a writing sample on a digital tablet. The biometric sample itself will take the form of a raw, unprocessed image or recording. After enrollment, the biometric samples will undergo some sort of feature extraction process which will use a proprietary set of algorithms to isolate and enhance certain key and singular features. Examples of this process are the location, measurement and encoding of ridge edgings and bifurcations on fingerprints, the filtering out of certain unique frequencies and patterns from a voice recording, the mapping of furrows and striations in the iris or the positioning and shape of the ears, forehead, cheekbones and nose. The results of the feature extraction are stored in a file known as a biometric template, or more specifically in this context, the reference template. The reference template is the core of the biometric match process. The reference template will be permanently stored in system memory and become the standard against which future match templates will be authenticated. Match templates are collected each time the user requests authentication/verification. They are subjected to the same algorithmic feature extraction process as the archived reference template and, after rendering, are matched against the archived reference template. A biometric match consists of a score determining the degree of similarity between the match template and the reference template. In most cases, matches should never be identical because of subtle changes over time and inherent error tolerances. Exact matches are often flagged by biometric systems as potential frauds resulting from a compromised reference template. In most cases, the score resulting from the match is compared against a predefined number known as the threshold. The threshold which is often decided upon by the biometric system administrator is used to establish an acceptable level of certainty that a successful match has been achieved. It is important to realize that the algorithms for extracting identifiable features, as well as the methods for encoding those features in the file template are essentially proprietary technologies. As a result, one vendors system is not compatible with another vendors using the same biometric. There are, as yet, few industry-wide standards for biometric systems. However, independent organizations such as The Biometric Foundation and The Association for Biometrics are currently involved in developing tentative standards.(4,5) The BioAPI Consortium has recently developed a standard for an API to various biometric technologies which has been accepted as ANSI standard ANSI/INCITS 358-2002 (6).
A common question is, "what is the best biometric system?" The IBG compiled a Zephyr analysis of the most popular biometric technologies; comparing each in terms of ease-of-use, cost, distinctiveness (accuracy), and perceived intrusiveness on the user (see figure 2).
Figure 2.
A perfect biometric would have all symbols at the extreme periphery while a poor one would have all symbols near the center of the chart. The perception is that there may be specific applications which are more amenable to specific biometrics than to others, but in general, there is no best biometric. All biometric systems have the potential of failure. The two major categories of failure are false match and false non-match. False match results in an unauthorized user being allowed access, while false non-match prevents an authorized user from gaining entry. False match rates in most biometric systems are extremely low, ranging from 1 in 10,000 to 1 in 100,000 depending on the particular system and algorithms employed. The major security threat resulting in a false match is the theft of someone's reference template. The template could then be copied or recorded to present back to the system. Current biometric systems implement a variety of safeguards to protect against the results of template theft. Most templates are encrypted both in storage and in transit to present a significant challenge to the would-be system cracker. Also, most new biometric systems incorporate processes to ensure that a new sample is being submitted for matching rather than a copy or recording. These processes often involve the biometric system sending a random number to the system scanner. This number also known as "the seed" can be encrypted in such a manner that only the sensor itself can decrypt it. When it returns the encrypted match template, the sensor embeds the seed number within the template. This verifies that the sample was created at the time of submission as opposed to an old template that has been encoded at an earlier date. False non-matches, on the other hand, are much more common and can be the result of a number of factors including age, passage of time and physiological change. Other factors are biometric specific and include such problems as dry/oily fingers and cuts on the fingers in fingerprinting; colds or flu, background noise and voice level in voice recognition; facial hair, lighting conditions, changes in weight and movement in facial recognition and glasses or contacts in iris or retinal scan. These are just a few of the many problems which can generate false non-matches. As biometric systems have matured, they have introduced a wide variety of error control features which have greatly reduced the effect of these factors and the number of false non-matches engendered from them. On their website, the IBG has published an extensive series of comparative tests, "to assess the real-world performance of leading biometric technologies and to provide…objective information on biometric system capabilities."(1) The National Biometrics Test Center also publishes a large series of articles, in .pdf format ,devoted to the comparative testing of biometric systems(3).
The 9/11 tragedy marked the beginning of a major investment by both U.S. and foreign governments in biometric-based identification systems. Legislation is currently pending in the US at both the Federal and State levels which include biometrics for border control, driver's licenses, airport/transport worker security, traveler authentication, etc. On April 29, 2002, the recently created US Transportation Security Administration introduced "an outline of a plan that will rely on biometric technology to identify all job applicants and control worker access to sensitive facilities." (2) Due to this increased government spending and increased corporate security awareness, the biometric industry is projected to grow from 601 million in revenues in fiscal 2002 to 4.035 billion in revenues in fiscal 2007 (1)(See Figure 3).
Figure 3.
New technologies currently in the development pipeline include algorithms for utilizing ear shape, human scent, vein-scans, finger geometry, nailbed identification, gait recognition (manner of walking), and dynamic, real-time DNA analysis. The International Biometric Industries Association (IBIA) predicts a migration of the industry over the next several years to "self-contained biometric devices ….. creating a broad new telecommunications category that includes any implementation of biometrics in units that use radio frequencies to signal the identity of the bearer"(2). These smart, portable devices will be able to send an encrypted match template directly to the biometric system from anywhere within range of the radio signal. This technology will not only alleviate 'backup' at system scanners, but will also allow for a user to authenticate to several biometric systems with a single transmission. The IBIA also predicts a significant increase in the use of biometrics in the automobile industry to protect automobiles and trucks from theft and unauthorized use. It is fairly certain that increasing tensions in the Middle East resulting from the Iraq War and other U.S. initiatives will result in the elevation of global insecurity and terrorism. The demand for high-end, reliable, and robust security systems to counter these threats will provide a lucrative market potential for those involved in biometric development.
Links: