The 123 of Biometric Technology

Transcription

1 We are so used to recognising people in our daily life that we often take this task for granted. Despite the often heard problems of fraud in the electronic transactions over the Internet in which lack of identity authentication is a prime cause, automated identity authentication afforded by biometric technology is not looked into seriously by most corporations. owever, after the September 11 incident, biometric technology is gaining in popularity. This article will give an overview of this technology, its potential, issues and challenges to widespread adoption. Yau Wei Yun Research anager, aboratories for Information Technology Co-Chair, Biometrics Working Group of Security & Privacy Standards Technical Committee 1. Introduction Section Three Even in the current Information Technology (IT) age, identity authentication is very crucial. IT brings with it capability for electronic transaction where face-to-face or other means of personal contact is not necessary. The lack of actual contact makes identifying the real user necessary as well as difficult. Necessary because as the saying goes, in the Internet, even a monkey can be human! Difficult as it goes beyond the traditional means of identity authentication and where being anonymous and staying anonymous is the desired feature of the Internet. 83 One of the remarkable ability of human and most animals is to identify friends from foes. Such capability is crucial for survival from ancient time till now. Why is it so? Wrongly identifying a foe as a friend could mean goodwill abused, property or wealth stolen, valuable information lost to unwanted hands, life of oneself and family members jeopardised or in larger scale, the society or nation threatened. The reverse will equally cost one dearly in societal and personal relationship. If you think about it, our capability to recognise people has been developed since young and is used daily - we recognise our family members, friends and foes, primarily through face and voice. Our daily transactions, from purchasing things at the nearby convenience stores, withdrawing small amount of money at the Auto-Teller achines, entering our house or office to large monetary transactions at a bank involves our identity and the means of authenticating it. Indeed, it is pervasive in our daily life.

2 Traditional means of identity authentication using tokens such as keys and cards, or personal identification numbers (PINs) and passwords are ill suited for such a task. For example, if you would like to purchase anything in the Internet, most likely you will require a credit card number to authenticate who you are and that you have means to pay for your goods. owever, such a number can be obtained rather easily by hackers, not to mention the numerous fake credit cards in circulation. Bank cards need PINs to authenticate one's identity. owever, in many situations, the PINs can be obtained easily either because the users wrote the PINs behind their cards or at some place or that the PINs were obtained through observation or fraudulent means. Some users have more than one bank account and thus it is challenging to remember all the PINs on top of the various PINs/passwords used daily. The most important issue is how to identify the "real" person without resorting to any complex and troublesome mechanism for verification. Biometrics is seen as one of the best candidates to solve this problem. Essentially, biometrics is the automated approach to authenticate the identity of a person using the individual's unique physiological or behavioural characteristics such as fingerprint, face, voice, signature etc. Since it is based on a unique trait which is part of you, you do not have to worry about forgetting it, losing it or leaving it at some place. Since it is unique to you, it is more difficult for others to copy, duplicate or steal it. Thus in general, biometrics offers a more secure and friendly way of identity authentication. 2. Biometrics There are several biometric technologies in use today with a few more technologies being investigated in research laboratories worldwide [1, 2]. Nevertheless, all the technologies share a common process flow as follows: Figure 1: Common Biometric Process Flow 84 Processing: Extract Features and Generate Template

3 A sensor is required to acquire the biometric data that will then be processed by a processor which could be part of an embedded system or a PC. The processing involves enhancing the data, removing noise and segmenting out the crucial data. From such conditioned data, the unique features are then extracted and a template is then generated to represent the biometric data. This template will be the basis from which the uniqueness of the data is associated with the identity of the user. If it is the first time the user is using the biometric system, the template will be stored for future references. Other information associated with the user may be included as well. User access to the system involves comparing the generated template against the reference of allowed user(s). If the matching is made against a claimed identity, the matching process will be a one to one comparison between the generated template and the stored reference template. Such a matching process is called a verification process. There are many ways to claim an identity, such as by entering name, telephone number, PIN or password and using token such as smart card or contactless card. Another possible mode of matching is to compare the generated template against a list of reference templates of legitimate users. Such a process involves one to many comparisons and the matching process is called an identification process. The type of matching process used in a biometric system will depend on the nature of application where the biometric system is used and the biometric technology involved, as not all biometric technology is suitable for identification. The following sections will discuss the common biometric technology such as face, fingerprint, hand geometry, iris, and voice. 3. Face Section Three Feature-based approach rely on the identification of certain fiducial points on the face which are less susceptible to alteration, including the points at the eyes, the side of the nose and the mouth, the points surrounding one's cheekbones etc. The locations of these points are used to compute the geometrical relationships between the points. The regions surrounding the points can be analysed locally as well. Results from all the local processing at the fiducial points are then combined to obtain the overall face recognition. Since detection of feature points precedes the analysis, such a system is robust to position variations in the image. owever, automatic detection of the fiducial points is not accurate and consistent enough to yield a high accuracy rate for the face recognition. 85 A face image can be acquired using a normal camera such as an off-the-shelf desktop camera. As such, it is the most natural biometric for identity authentication. Two main approaches are used to perform face recognition, namely holistic or global approach and feature-based approach [3].

4 olistic approach processes the entire face image simultaneously without attempting to localise the individual points. This approach has some variants in the type of technology used, such as statistical analysis, neural networks or transformations. The famous examples for statistical analysis are the eigenface technique [5] and local feature analysis [6] while for neural network is the elastic bunch graph matching technique [7]. The advantage of holistic approach is that it utilizes the face as a whole and does not destroy any information by exclusively processing only certain fiducial points. This generally yields more accurate recognition results. owever, such technique is sensitive to variations in position and scale, and thus requires large training data sets [3, 4]. Figure 2A: Sample Eigenfaces [8] Figure 2B: Elastic Bunch Graph [9] Face recognition is generally accepted by the public, easy to use, a covert process, compact and the cost is rather low. The disadvantage is that the accuracy achievable it is only suitable for verification, but is still insufficient for identification. The performance will also be affected by variation in face due to aging, make-up, hair-style, glasses, pose and lighting condition in addition to not being able to separate twins. 4. Fingerprint 86 Fingerprint is the oldest method of identity authentication and has been used since 1896 for criminal identification. The fingertips have corrugated skin with line like ridges flowing from one side of the finger to another. The flow of the ridges is non-continuous and forms a pattern. The discontinuity in the ridge flow give rise to feature points, called minutiae, while the pattern of flow give rise to classification pattern such as arches, whorls and loops. These are the basis of fingerprint recognition.

5 Figure 3: A Sample Fingerprint Image Section Three There are two main technical approaches for fingerprint recognition: minutia matching and pattern matching. The former approach locates all the minutiae in the fingerprint consisting mainly ridge ending (where the ridge ends) and bifurcation (where the ridge branches into two). Other possible minutiae include dot (very short ridge), island (two nearby bifurcations), crossover (two ridges crossing each other) and pore. From the geometric information, type, direction and relationship of the minutiae, comparisons can be made in order to establish whether the two minutia template matched or not. The latter approach utilizes the region surrounding a minutiae or other distinct mark and extrapolates data from the series of ridges in this region. For matching, the same area need to be found and compared and methods to handle deformation in the pattern is devised. Typically, the template size of the pattern matching approach is 2-3 times larger than in minutia approach [1]. It is almost impossible to recreate the fingerprint image from the minutia based template but this cannot be said for the pattern matching approach. In addition, all the AFIS system used in forensic applications is minutia based and is an accepted approach in a court of law. Thus majority of the fingerprint recognition system uses the minutia approach. 87 In forensic application, the fingerprints of criminal suspects are acquired (traditionally using the ink-and-roll procedure) and stored centrally. Identity search is then conducted using an Automated Fingerprint Identification System (AFIS) to narrow the search to one or a few prime suspects when a crime occurs. For civil applications, the fingerprint is not stored, but acquired live. The template which represents the fingerprint is stored rather than the image. There are a few variants of image capture technology available for such commercially oriented fingerprint sensor, including optical, silicon, ultrasound, thermal and hybrid.

6 In general, fingerprint recognition can achieve good accuracy sufficient for both verification and identification. It is low cost and compact and is getting popular as consumer products. owever, not everyone has fingerprints that can be recognised. The sensor is also not able to capture acceptable quality fingerprint images for people with very wet and very dry skin. In addition, the sensor needs to be maintained properly in order to get consistent performance. The Spring 2002 international developer survey conducted by Evans Data recently has concluded that fingerprints have the most potential in terms of user authentication. 5. and Geometry The hand image is obtained using a camera looking from the top when the user placed his or her hand at a specified surface. The hand can be aligned using pegs or reference marks. Two views are usually taken in a single image, the top view and the side view. The side view is usually taken by the top camera as well using a side mirror. From the hand image, the fingers are located and the length, width, thickness, curvatures and their relative geometry measured. Figure 4: easurements of Typical and Geometry System [10] 88 The hand geometry template size can be very small. It has acceptable accuracy for verification but not sufficient for identification. The major advantage is that most people can use it and as such, the acceptance rate is good. owever, the system is rather bulky and may have problems with aging and health condition such as arthritis.

7 6. Iris Iris, the coloured part of the eye, is composed of a type of tissue called trabecular meshwork which gives the appearance of layered radial lines or mesh when the iris is examined closely. The visible mesh consists of characteristics such as striations, rings, crypts, furrows etc. giving the iris a unique pattern. The iris pattern is stable throughout the lifespan and is different for twins as well since the pattern is independent of genetic makeup. The iris image is usually acquired using a monochrome camera with visible and near infra red light ( nm) [1]. In the processing stage, the eye is located and then the iris is segmented, leaving out the pupil and other noisy areas caused by reflection of light. Based on the efficient algorithm invented by Prof. John Daugman of Cambridge University, England, the iris is divided into rims [11]. For each rim, 2-D Gabor wavelets (a type of filter) are applied sequentially throughout the rim to extract the iris feature into numerical data, called the IrisCode(tm). The algorithm is able to reveal 266 independent degrees-of-freedom of textural variation, making it a very accurate biometric [12]. The IrisCode takes up 256 bytes of memory storage and can be efficiently matched by computing the fraction of mismatched bits relative to matched bits of two IrisCodes, called the amming distance [11]. Section Three Iris recognition is very accurate with very low false acceptance rate (wrongly identifying the impostor as the genuine user) and can be applied to both verification and identification. The identification speed is also very fast and it is relatively easy to verify whether the iris is from a living subject. owever, the cost of the system is somewhat high and not compact. It also suffers from poor lighting, reflection and possibly glasses and may not be suitable for people with cataract and young children. In addition, some imaging system will require the user to be motionless for a while. 89 Figure 5: A Sample Segmented Iris with IrisCode at Top eft Corner [11]

8 7. Voice Voice authentication or speaker recognition uses a microphone to record the voice of a person. The recorded voice is digitised and then used for authentication. The speech can be acquired from the user enunciating a known text (text dependent) or speaking (text independent). In the former case, the text can be fixed or prompted by the system. The text can also be read discretely or the entire text read out continuously. The captured speech is then enhanced and unique features extracted to form a voice template. There are two types of templates: stochastic templates and model templates. Stochastic templates require probabilistic matching techniques such as the popular idden arkov odel and results in a measure of likelihood of the observation given the template. For model templates, the matching techniques used are deterministic. The observation is assumed to be similar to the model, albeit some distortion. atching result is obtained by measuring the minimum error distance when the observation is aligned to the model. The matching techniques popularly used for model templates include Dynamic Time Warping algorithm, Vector Quantisation and Nearest Neighbours algorithm [13]. As voice is a common means of communication, and with an extensive telephone network, a microphone becomes rather common and as such the cost of voice authentication can be very low and compact. Furthermore, it is relatively easy to use. owever, voice varies with age and there can be drastic change from childhood to adolescence. Also illness and emotion may affect the voice as well as room acoustics and environmental noise. Variation in microphones and channel mismatch (use of different type and quality of microphones) is also a major problem for the widespread use of this biometric technology. 8. Other Biometric Technologies 90 There are other biometric technologies including signature, retinal scan, DNA typing, vein pattern (such as within the wrist, palm or dorsal surfaces of the hand), thermal pattern of the face (facial thermogram), keystroke dynamics, gait pattern, body odour and ear shape. Instead of relying on only one technology, a multi-modal system which combines several biometric technologies to increase the likelihood of finding a match will be increasingly feasible as hardware and system cost decreases to an attractive level.

9 Table I below shows a comparison amongst the various biometric technologies discussed. Table I: Comparison of Biometric Technologies [14] Biometrics Univer- Uniquesality ness Face Fingerprint and Geometry Keystroke Dynamics and vein Iris Retina Signature Voice Facial Thermogram DNA =igh, =edium, =ow Permanence Collectability Performance Accept- Circumability vention 1.False Acceptance Rate (FAR) This is also known as Type I error. It measures the percentage of impostors being incorrectly accepted as genuine user. Since almost all biometric systems aim to achieve correct identity authentication, this number should be as low as possible. Section Three In the PIN or password based system, the matching between the input data against the stored data is straight forward and the outcome is either "yes" or "no". If the result is not a match, you will usually blame yourself for providing the wrong input. owever, for a biometric system, the extracted data is never an exact replica of the stored biometric data due to the many variability factors involved. Thus, the matching algorithm is more complex, and the outcome of the comparison is usually a degree of confidence that the input biometric data is from the same person as the registered data. There is a tolerance involved. owever, the user will usually blame the system if he or she is rejected but at the same time, high level of security is needed to avoid wrongly accepting an impostor. In order to compare the performance of biometric technologies, there are several key measures that need to be understood: 91 In the above table, universality indicates how common the biometric is found in each person; uniqueness indicates how well the biometric separates one person from the other; permanence indicates how well the biometric resist the effect of aging; while collectability measures how easy it is to acquire the biometric for processing. Performance indicates the achievable accuracy, speed and robustness of the biometrics while acceptability indicates the degree of acceptance of the technology by the public in their daily life and circumvention indicates the level of difficulty to circumvent or fool the system into accepting an impostor.

10 2.False Rejection Rate (FRR) Also known as Type II error, this measures the percentage of genuine users being incorrectly rejected. In order to minimise inconveniences (or embarrassment) to the genuine user, this number should also be low. Nevertheless, in general, this error is more acceptable as usually the user can make a second attempt. 3.Equal Error Rate (EER) FAR and FRR are related. A stringent requirement for FAR (as low as possible) will inadvertently increase the FRR. The point where the FAR is equal to FRR is given by this measure. The smaller the EER, the better is the system as it indicates a good balance in the sensitivity of the system. The above measures can be found in almost all biometric product brochures. owever, these values typically apply to specific (usually controlled laboratory) settings and these measures are dependent on the quality of the database used. The dependency on the database needs to be highlighted as the degree of imperfection in the biometric data of the database used will greatly influence the achievable rate for these measures. Such degree of imperfection or distortion will usually arise in the actual use of the system and is also dependent on how familiar the users are to the system. As such, these measures are meant more as a guide than as an absolute metrics for comparison. If these measures are to be used for product comparison, then a "best practice" or standard is needed to validate these measures. Such standard is still lacking currently. In addition, the actual achievable rate experienced by the user when the biometric system is used will depend on the scenario, environment and application context of the system. For example, installing a voice authentication system at the airport exposed to the loud aircraft noise will drastically reduce the performance of the voice authentication system. 9. Issues and Challenges 92 With the basics of biometric technology, we now consider the issues, potential and challenges faced by biometric technology. In selecting a specific biometric technology, the following should be considered: 1. Size of user group. 2. Place of use and the nature of use (such as needs for mobility). 3. Ease of use and user training required. 4. Error incidence such as due to age, environment and health condition. 5. Security and accuracy requirement needed.

11 6.User acceptance level, privacy and anonymity. 7.ong term stability including technology maturity, standard, interoperability and technical support. 8.Cost. Despite the long list above, one should not be disheartened by it. The Jan/Feb 2001 issue of IT Technology Review identified biometrics amongst the 10 emerging technologies that will change the world. Analysis by Frost & Sullivan, a strategic market consulting and training company in San Antonio, Texas, in "World Biometric Technologies arkets" indicates the total biometrics market generated $66 million in 2000 and is expected to reach $900 million by 2006 [15]. Just recently (14 June 2002), a report from the Cutter Consortium reveals that the use of biometric-based technology is increasing. According to the report, a survey of business technology professionals revealed that biometric systems have been implemented by six percent of the companies interviewed. In addition, according to the Biometric arket Report 2003, Biometric revenues are expected to grow from $399m in 2000 to $1.9b by 2005 and that revenues attributable to large-scale public sector biometric usage, currently 70% of the biometric market will drop to under 30% by Furthermore, finger-scan and biometric middleware will emerge as two critical technologies for the desktop, together comprising approximately 40% of the biometric market by 2005 [16]. Section Three 93 Figure 6: Total Biometric Revenues from 1999 to 2005 (US$m) [16]

12 Other motivating factors for biometrics include the report by Asian Wall Street Journal in 2001 indicating that online transaction is only 5% of the total credit card transactions but makes up 50% of all credit card fraud, the fear by consumers that shopping online will allow their credit card data to be seized by hackers and the terrorist attack on the World Trade Center in the United States. All these increase the awareness and demand for biometrics as a better and more secure means of identity authentication. Coupled to that, the cost of biometric solutions is decreasing. There are numerous applications for biometric systems. ost applications currently concentrate on security related physical and logical access control. These include the following areas: 1. Banking/Financial services such as ATs, payment terminals, cashless payment, automated cheque cashing etc. 2. Computer & IT Security such as Internet transactions, PC login etc. 3. ealthcare such as privacy concern, patient information control, drug control etc. 4. Immigration such as border control, frequent travelers, asylum seekers etc. 5. aw and Order such as public ID card, voting, gun control, prison, parole etc. 6. Gatekeeper/Door Access Control such as secure installations, military, hotel, building management etc. 7. Telecommunication such as telephony, mobile phone, subscription fraud, call center, games etc. 8. Time and Attendance such as school and company attendance, 9. Welfare, including health care services and benefit payments Consumer Products such as automated service machines, vault, lock-set, PDA etc. Another major area which has received little attention is the opportunity for personalisation services. For example, a TV remote control with biometric capability can automatically select the channel of interest of the user together with the preferred volume and brightness settings. Similarly, a mobile phone with biometric capability is able to customise the user interface, ring tone, phone diary, speed dial etc. Imagine entering a members-only golf club reception with the automated system calling your name - it will surely impress you and your guests!

13 There are major challenges to the wide roll-out and adoption of biometric systems, such as lack of user education, especially since there are several biometric technologies to choose but not every technology is suitable for all application scenarios and the impact to privacy on the use of such technology. Over expectation, either due to ignorance of the users or exaggerated by the over-zealous sellers in the capability of biometric will also slow the market adoption as the system will not perform as "expected" in the eye of the users, causing lack of trust in the technology. ack of interoperability and standard is also a challenge preventing wide-scale adoption since users especially corporations will not want to invest in a technology that will soon obsolete or lack technical support. In this area, several international standardisation efforts have been pursued, including the BioAPI for biometrics application programming interface, CBEFF for common biometric data exchange format and very recently, the formation of groups at ISO/IEC to look into biometric standardisation. Some of the biometric technology is also less mature and will need more time for research and trial testing before its performance can be enhanced to suit the market requirements. 10.Conclusion Biometric is an emerging area with many opportunities for growth. The technology will continue to improve and challenges such as interoperability solved through standardisation. This will lead to increase in the market adoption rate and the technology will proliferate. Possibly in the near future, you will not have to remember PINs and passwords and keys in your bags or pockets will be things of the past. 11.References [1] International Biometric Group website, [5]. Turk and A. Pentland, "Eigenfaces for Recognition", Journal of Cognitive Neuroscience, Vol. 3, pp , [6] Visionics website, [7]. Wiskott, J.. Fellous and C. von der alsburg, "Face Recognition by Elastic Bunch Graph atching", IEEE Trans. on Pattern Analysis and achine Intelligence, Vol. 19, pp , [4] IT edia ab Website, Section Three [3] R. Chellappa et al., "uman and achine Recognition of Faces: A Survey", Technical Report CAR-TR-731, University of aryland Computer Vision aboratory, [2] ISO/IEC JTC1/SC17 N1793, "Usability of Biometrics in Relation to Electronic Signatures v1.0."

14 [8] Eigenfaces Demo website, IT: [9] Face Recognition by Elastic Bunch Graph atching website, Bochum University: Recognition/contents.html. [10] Biometric Systems ab website, Bologna University: [11] John Daugman's website, [12]. Negin et al., "An Iris Biometric System for Public and Personal Use", Computer, Vol. 33, No. 2, pp , [13] J.P. Campbell Jr., "Speaker Recognition: A Tutorial", Proceedings of The IEEE, Vol. 85, No. 9, pp , [14] A Jain, R. Bolle, S. Pankanti, "Biometrics: Personal Identification in Networked Society", Kluwer, [15] CNN Tech News, July 20, [16] International Biometric Group "Biometric arket Report 2003" website: 96