ZlodeiBaal August 11, 2011 at 9:54 pm

Modern biometric identification methods

• Information Security

Recently, many articles have appeared on Habré devoted to Google’s facial identification systems. To be honest, many of them reek of journalism and, to put it mildly, incompetence. And I wanted to write a good article on biometrics, it’s not my first! There are a couple of good articles on biometrics on Habré - but they are quite short and incomplete. Here I will try to briefly outline the general principles of biometric identification and modern achievements of mankind in this matter. Including identification by faces.

The article has, which, in essence, is its prequel.

A joint publication with a colleague in a journal (BDI, 2009), revised to suit modern realities, will be used as the basis for the article. Habré is not yet a colleague, but he supported the publication of the revised article here. At the time of publication, the article was a brief overview of the modern biometric technology market, which we conducted for ourselves before introducing our product. The applicability judgments put forward in the second part of the article are based on the opinions of people who have used and implemented the products, as well as on the opinions of people involved in the production of biometric systems in Russia and Europe.

general information

Let's start with the basics. In 95% of cases, biometrics is essentially mathematical statistics. And matstat is an exact science, the algorithms from which are used everywhere: in radars and in Bayesian systems. Errors of the first and second types can be taken as two main characteristics of any biometric system). In radar theory they are usually called “false alarm” or “target miss”, and in biometrics the most established concepts are FAR (False Acceptance Rate) and FRR (False Rejection Rate). The first number characterizes the probability of a false match between the biometric characteristics of two people. The second is the probability of denying access to a person with clearance. The lower the FRR value for the same FAR values, the better the system. Sometimes a comparative characteristic of EER is also used, which determines the point at which the FRR and FAR graphs intersect. But it is not always representative. You can see more details, for example.
The following can be noted: if the characteristics of the system do not include FAR and FRR for open biometric databases, then no matter what the manufacturers declare about its characteristics, this system is most likely ineffective or much weaker than its competitors.
But not only FAR and FRR determine the quality of a biometric system. If this were the only way, then the leading technology would be DNA recognition, for which FAR and FRR tend to zero. But it is obvious that this technology is not applicable at the current stage of human development! We have developed several empirical characteristics that allow us to assess the quality of the system. “Forgery resistance” is an empirical characteristic that summarizes how easy it is for a biometric identifier to be fooled. “Environmental stability” is a characteristic that empirically evaluates the stability of the system under various external conditions, such as changes in lighting or room temperature. “Ease of use” shows how difficult it is to use a biometric scanner, and whether identification is possible “on the go.” An important characteristic is “Speed ​​of operation” and “Cost of the system”. We should not forget that a person’s biometric characteristic can change over time, so if it is unstable, this is a significant disadvantage.
The abundance of biometric methods is amazing. The main methods using static biometric characteristics of a person are identification by papillary pattern on the fingers, iris, facial geometry, retina, pattern of hand veins, hand geometry. There is also a family of methods that use dynamic characteristics: identification by voice, handwriting dynamics, heart rate, and gait. Below is the breakdown of the biometric market a couple of years ago. Every other source fluctuates by 15-20 percent, so this is just an estimate. Also here, under the concept of “hand geometry,” there are two different methods hidden, which will be discussed below.


In this article we will consider only those characteristics that are applicable in access control and management systems (ACS) or in tasks similar to them. Due to its superiority, these are primarily static characteristics. Of the dynamic characteristics at the moment, only voice recognition has at least some statistical significance (comparable to the worst static algorithms FAR~0.1%, FRR~6%), but only under ideal conditions.
To get a feel for the probabilities of FAR and FRR, you can estimate how often false matches will occur if you install an identification system at the entrance of an organization with N employees. The probability of a false match of a fingerprint scanner for a database of N fingerprints is FAR∙N. And every day about N people also pass through the access control point. Then the probability of error per working day is FAR∙(N∙N). Of course, depending on the goals of the identification system, the probability of an error per unit of time can vary greatly, but if we accept one error per working day as acceptable, then:
(1)
Then we find that stable operation of the identification system at FAR=0.1% =0.001 is possible with a staff size of N≈30.

Biometric scanners

Today, the concepts of “biometric algorithm” and “biometric scanner” are not necessarily interrelated. The company can produce these elements individually, or together. The greatest differentiation between scanner manufacturers and software manufacturers has been achieved in the finger papillary pattern biometrics market. The smallest 3D face scanner on the market. In fact, the level of differentiation largely reflects the development and saturation of the market. The more choice there is, the more the theme is worked out and brought to perfection. Different scanners have different sets of abilities. Basically it is a set of tests to check whether a biometric object is tampered with or not. For finger scanners this could be a bump test or a temperature check, for eye scanners it could be a pupil accommodation test, for face scanners it could be facial movement.
Scanners greatly influence the resulting FAR and FRR statistics. In some cases, these numbers can change tens of times, especially in real conditions. Typically, the characteristics of the algorithm are given for a certain “ideal” base, or simply for a well-suited one, where blurry and blurry frames are discarded. Only a few algorithms honestly indicate both the base and the full issuance of FAR/FRR for it.

And now in more detail about each of the technologies

Fingerprints

Dactyloscopy (fingerprint recognition) is the most developed biometric method of personal identification to date. The catalyst for the development of the method was its widespread use in forensic science of the 20th century.
Each person has a unique papillary fingerprint pattern, which makes identification possible. Typically, algorithms use characteristic points on fingerprints: the end of a pattern line, the branching of a line, single points. Additionally, information is used about the morphological structure of the fingerprint: the relative position of the closed lines of the papillary pattern, “arched” and spiral lines. The features of the papillary pattern are converted into a unique code that preserves the information content of the fingerprint image. And it is the “fingerprint codes” that are stored in the database used for searching and comparison. The time to convert a fingerprint image into a code and identify it usually does not exceed 1s, depending on the size of the database. The time spent raising your hand is not taken into account.

VeriFinger SDK statistics obtained using the DP U.are.U fingerprint scanner were used as a source of FAR and FRR data. Over the past 5-10 years, the characteristics of finger recognition have not made much progress, so the above figures show the average value of modern algorithms quite well. The VeriFinger algorithm itself won the International Fingerprint Verification Competition for several years, where finger recognition algorithms competed.

The characteristic FAR value for the fingerprint recognition method is 0.001%.
From formula (1) we find that stable operation of the identification system at FAR=0.001% is possible with a staff size of N≈300.

Advantages of the method. High reliability - the statistical indicators of the method are better than the indicators of identification methods by face, voice, and painting. Low cost devices that scan a fingerprint image. A fairly simple procedure for scanning a fingerprint.
Disadvantages: the fingerprint papillary pattern is very easily damaged by small scratches and cuts. People who have used scanners in enterprises with several hundred employees report a high rate of scanning failure. Many of the scanners do not treat dry skin adequately and do not allow older people to pass through. When communicating at the last MIPS exhibition, the head of the security service of a large chemical enterprise said that their attempt to introduce finger scanners at the enterprise (scanners of various systems were tried) failed - minimal exposure to chemical reagents on the fingers of employees caused a failure of the scanners' security systems - the scanners declared the fingers a fake. There is also insufficient security against fingerprint image forgery, partly caused by the widespread use of the method. Of course, not all scanners can be fooled by methods from MythBusters, but still. For some people with “inappropriate” fingers (body temperature, humidity), the probability of being denied access can reach 100%. The number of such people varies from a fraction of a percent for expensive scanners to ten percent for inexpensive ones.
Of course, it is worth noting that a large number of shortcomings are caused by the widespread use of the system, but these shortcomings do exist and they appear very often.

Market situation

Currently, fingerprint recognition systems occupy more than half of the biometric market. Many Russian and foreign companies are engaged in the production of access control systems based on the fingerprint identification method. Due to the fact that this direction is one of the oldest, it has become most widespread and is by far the most developed. Fingerprint scanners have come a really long way to improve. Modern systems are equipped with various sensors (temperature, pressure, etc.) that increase the degree of protection against counterfeiting. Every day systems become more convenient and compact. In fact, the developers have already reached a certain limit in this area, and there is nowhere to develop the method further. In addition, most companies produce ready-made systems that are equipped with everything necessary, including software. Integrators in this area simply do not need to assemble the system themselves, since this is unprofitable and will take more time and effort than buying a ready-made and already inexpensive system, especially since the choice will be really wide.
Among the foreign companies involved in fingerprint recognition systems, one can note SecuGen (USB scanners for PCs, scanners that can be installed in enterprises or built into locks, SDK and software for connecting the system with a computer); Bayometric Inc. (fingerprint scanners, TAA/Access control systems, fingerprint SDKs, embedded fingerprint modules); DigitalPersona, Inc. (USB scanners, SDK). In Russia, the following companies operate in this area: BioLink (fingerprint scanners, biometric access control devices, software); Sonda (fingerprint scanners, biometric access control devices, SDK); SmartLock (fingerprint scanners and modules), etc.

Iris

The iris of the eye is a unique characteristic of a person. The pattern of the iris is formed in the eighth month of intrauterine development, finally stabilizes at the age of about two years and practically does not change throughout life, except as a result of severe injuries or severe pathologies. The method is one of the most accurate among biometric methods.
The iris identification system is logically divided into two parts: a device for capturing an image, its primary processing and transmission to a computer, and a computer that compares the image with images in the database and transmits the admission command to the executive device.
The time for primary image processing in modern systems is approximately 300-500ms, the speed of comparing the resulting image with the database is 50,000-150,000 comparisons per second on a regular PC. This speed of comparison does not impose restrictions on the use of the method in large organizations when used in access systems. When using specialized computers and search optimization algorithms, it even becomes possible to identify a person among the residents of an entire country.
I can immediately answer that I am somewhat biased and have a positive attitude towards this method, since it was in this field that we launched our startup. A paragraph at the end will be devoted to a little self-PR.

Statistical characteristics of the method

The FAR and FRR characteristics for the iris are the best in the class of modern biometric systems (with the possible exception of the retinal recognition method). The article presents the characteristics of the iris recognition library of our algorithm - EyeR SDK, which correspond to the VeriEye algorithm tested using the same databases. We used CASIA databases obtained by their scanner.

The characteristic FAR value is 0.00001%.
According to formula (1) N≈3000 is the number of personnel of the organization, at which employee identification is quite stable.
Here it is worth noting an important feature that distinguishes the iris recognition system from other systems. When using a camera with a resolution of 1.3MP or more, you can capture two eyes in one frame. Since the FAR and FRR probabilities are statistically independent probabilities, when recognizing using two eyes, the FAR value will be approximately equal to the square of the FAR value for one eye. For example, for a FAR of 0.001% using two eyes, the false admission rate would be 10-8%, with an FRR only twice as high as the corresponding FRR value for one eye at FAR=0.001%.

Advantages and disadvantages of the method

Advantages of the method. Statistical reliability of the algorithm. Capturing an image of the iris can be done at a distance of several centimeters to several meters, without physical contact between a person and the device. The iris is protected from damage - which means it will not change over time. It is also possible to use a high number of methods that protect against counterfeiting.
Disadvantages of the method. The price of a system based on the iris is higher than the price of a system based on finger recognition or facial recognition. Low availability of ready-made solutions. Any integrator who comes to the Russian market today and says “give me a ready-made system” will most likely fail. Most of them sell expensive turnkey systems installed by large companies such as Iridian or LG.

Market situation

At the moment, the share of iris identification technologies in the global biometric market is, according to various estimates, from 6 to 9 percent (while fingerprint recognition technologies occupy over half of the market). It should be noted that from the very beginning of the development of this method, its strengthening in the market was slowed down by the high cost of equipment and components necessary to assemble an identification system. However, as digital technologies developed, the cost of a single system began to decrease.
The leader in software development in this area is Iridian Technologies.
The entry of a large number of manufacturers into the market was limited by the technical complexity of the scanners and, as a consequence, their high cost, as well as the high price of the software due to Iridian’s monopoly position in the market. These factors allowed only large companies to develop in the field of iris recognition, most likely already engaged in the production of some components suitable for the identification system (high-resolution optics, miniature cameras with infrared illumination, etc.). Examples of such companies include LG Electronics, Panasonic, OKI. They entered into an agreement with Iridian Technologies, and as a result of joint work, the following identification systems appeared: Iris Access 2200, BM-ET500, OKI IrisPass. Subsequently, improved models of systems emerged, thanks to the technical capabilities of these companies to independently develop in this area. It should be said that the above companies also developed their own software, but in the end they prefer Iridian Technologies software in the finished system.
The Russian market is dominated by products of foreign companies. Although even that can be purchased with difficulty. For a long time, the Papillon company assured everyone that they had iris recognition. But even representatives of RosAtom, their direct buyer, for whom they made the system, say that this is not true. At some point, another Russian company appeared that made iris scanners. Now I don’t remember the name. They purchased the algorithm from someone, perhaps from the same VeriEye. The scanner itself was a 10-15 year old system, by no means contactless.
In the last year, a couple of new manufacturers have entered the global market due to the expiration of the primary patent for human eye recognition. The most trustworthy of them, in my opinion, is AOptix. At least their previews and documentation do not raise suspicions. The second company is SRI International. Even at first glance, to a person who has worked on iris recognition systems, their videos seem very deceitful. Although I wouldn’t be surprised if in reality they can do something. Both systems do not show data on FAR and FRR, and also, apparently, are not protected from counterfeiting.

Face recognition

There are many recognition methods based on facial geometry. All of them are based on the fact that the facial features and shape of the skull of each person are individual. This area of ​​biometrics seems attractive to many because we recognize each other primarily by our faces. This area is divided into two areas: 2-D recognition and 3-D recognition. Each of them has advantages and disadvantages, but much also depends on the scope of application and the requirements for a particular algorithm.
I’ll briefly tell you about 2-d and move on to one of the most interesting methods today - 3-d.

2-D facial recognition

2-D facial recognition is one of the most statistically ineffective biometric methods. It appeared quite a long time ago and was used mainly in forensic science, which contributed to its development. Subsequently, computer interpretations of the method appeared, as a result of which it became more reliable, but, of course, it was inferior and every year is increasingly inferior to other biometric methods of personal identification. Currently, due to poor statistical indicators, it is used in multimodal or, as it is also called, cross-biometrics, or in social networks.

Statistical characteristics of the method

For FAR and FRR, data for the VeriLook algorithms were used. Again, for modern algorithms it has very ordinary characteristics. Sometimes algorithms with an FRR of 0.1% with a similar FAR flash by, but the bases on which they were obtained are very questionable (cut out background, identical facial expression, identical hairstyle, lighting).

The characteristic FAR value is 0.1%.
From formula (1) we obtain N≈30 - the number of personnel of the organization, at which employee identification occurs quite stably.
As you can see, the statistical indicators of the method are quite modest: this eliminates the advantage of the method that it is possible to covertly photograph faces in crowded places. It’s funny to see how a couple of times a year another project is funded to detect criminals through video cameras installed in crowded places. Over the past ten years, the statistical characteristics of the algorithm have not improved, but the number of such projects has increased. Although, it is worth noting that the algorithm is quite suitable for tracking a person in a crowd through many cameras.

Advantages and disadvantages of the method

Advantages of the method. With 2-D recognition, unlike most biometric methods, expensive equipment is not required. With appropriate equipment, recognition is possible at significant distances from the camera.
Flaws. Low statistical significance. There are lighting requirements (for example, it is not possible to register the faces of people entering from the street on a sunny day). For many algorithms, any external interference is unacceptable, such as glasses, a beard, or some elements of a hairstyle. A frontal image of the face is required, with very slight deviations. Many algorithms do not take into account possible changes in facial expressions, that is, the expression must be neutral.

3-D facial recognition

The implementation of this method is a rather complex task. Despite this, there are currently many methods for 3-D facial recognition. The methods cannot be compared with each other, since they use different scanners and databases. Not all of them issue FAR and FRR; completely different approaches are used.
The transitional method from 2-d to 3-d is a method that implements the accumulation of information about a person. This method has better characteristics than the 2d method, but it also uses only one camera. When a subject is entered into the database, the subject turns his head and the algorithm connects the image together, creating a 3D template. And during recognition, several frames of the video stream are used. This method is rather experimental and I have never seen an implementation for access control systems.
The most classic method is the template projection method. It consists of projecting a grid onto an object (face). Next, the camera takes pictures at a speed of tens of frames per second, and the resulting images are processed by a special program. A beam incident on a curved surface is bent - the greater the curvature of the surface, the stronger the bend of the beam. Initially, a source of visible light was used, supplied through “blinds”. Then visible light was replaced by infrared, which has several advantages. Typically, at the first stage of processing, images in which the face is not visible at all or in which there are foreign objects that interfere with identification are discarded. Based on the resulting images, a 3-D model of the face is reconstructed, on which unnecessary noise (hairstyle, beard, mustache and glasses) is highlighted and removed. Then the model is analyzed - anthropometric features are identified, which are ultimately recorded in a unique code entered into the database. Image capture and processing time is 1-2 seconds for the best models.
The method of 3-D recognition based on images obtained from several cameras is also gaining popularity. An example of this is the Vocord company with its 3D scanner. This method gives positioning accuracy, according to the developers, higher than the template projection method. But until I see FAR and FRR at least in their own database, I won’t believe it!!! But it has been in development for 3 years now, and progress at exhibitions is not yet visible.

Statistical indicators of the method

Complete data on FRR and FAR for algorithms of this class are not publicly available on manufacturers’ websites. But for the best models from Bioscript (3D EnrolCam, 3D FastPass), working using the template projection method with FAR = 0.0047%, the FRR is 0.103%.
It is believed that the statistical reliability of the method is comparable to the reliability of the fingerprint identification method.

Advantages and disadvantages of the method

Advantages of the method. No need to contact the scanning device. Low sensitivity to external factors, both on the person himself (the appearance of glasses, a beard, a change in hairstyle) and in his environment (lighting, turning the head). High level of reliability comparable to fingerprint identification.
Disadvantages of the method. High cost of equipment. Commercially available systems were even more expensive than iris scanners. Changes in facial expressions and facial noise impair the statistical reliability of the method. The method is not yet well developed, especially in comparison with the long-used fingerprinting, which makes its widespread use difficult.

Market situation

Recognition by facial geometry is considered one of the “three big biometrics”, along with recognition by fingerprints and iris. It must be said that this method is quite common, and it is still preferred over recognition by the iris of the eye. The share of facial geometry recognition technologies in the total volume of the global biometric market can be estimated at 13-18 percent. In Russia, there is also greater interest in this technology than, for example, in iris identification. As mentioned earlier, there are many 3-D recognition algorithms. For the most part, companies prefer to develop ready-made systems, including scanners, servers and software. However, there are also those who only offer the SDK to the consumer. Today, the following companies are involved in the development of this technology: Geometrix, Inc. (3D face scanners, software), Genex Technologies (3D face scanners, software) in the USA, Cognitec Systems GmbH (SDK, special computers, 2D cameras) in Germany, Bioscrypt (3D face scanners, software) - a subsidiary of the American company L- 1 Identity Solutions.
In Russia, the companies Artec Group (3D facial scanners and software) are working in this direction - a company whose head office is located in California, and development and production are carried out in Moscow. Also, several Russian companies have 2D facial recognition technology - Vocord, ITV, etc.
In the field of 2D face recognition, the main subject of development is software, because... regular cameras do a great job of capturing facial images. The solution to the problem of recognition from a face image has to some extent reached a dead end - for several years now there has been virtually no improvement in the statistical indicators of algorithms. In this area, a systematic “work on mistakes” is taking place.
3D facial recognition is now a much more attractive area for developers. Many teams work there and we regularly hear about new discoveries. Many works are in the “about to be released” state. But so far there are only old offers on the market; the choice has not changed in recent years.
One of the interesting points that I sometimes think about and which may be answered by Habr: is the accuracy of kinect enough to create such a system? There are quite a few projects to pull out a 3D model of a person through it.

Recognition by veins of the arm

This is a new technology in the field of biometrics, its widespread use began only 5-10 years ago. An infrared camera takes pictures of the outside or inside of the hand. The pattern of veins is formed due to the fact that hemoglobin in the blood absorbs infrared radiation. As a result, the degree of reflection is reduced and the veins are visible on the camera as black lines. A special program creates a digital convolution based on the received data. No human contact with the scanning device is required.
The technology is comparable in reliability to iris recognition, being superior in some ways and inferior in others.
The FRR and FAR values ​​are given for the Palm Vein scanner. According to the developer, with a FAR of 0.0008%, the FRR is 0.01%. No company provides a more accurate graph for several values.

Advantages and disadvantages of the method

Advantages of the method. No need to contact the scanning device. High reliability - the statistical indicators of the method are comparable to the readings of the iris. Hiddenness of the characteristic: unlike all the above, this characteristic is very difficult to obtain from a person “on the street,” for example, by photographing him with a camera.
Disadvantages of the method. The scanner should not be exposed to sunlight or halogen lamps. Some age-related diseases, such as arthritis, greatly worsen FAR and FRR. The method is less studied in comparison with other static biometric methods.

Market situation

Recognition of hand vein patterns is a fairly new technology, and therefore its share in the world market is small and amounts to about 3%. However, there is increasing interest in this method. The fact is that, being quite accurate, this method does not require such expensive equipment as, for example, recognition methods based on facial geometry or iris. Now many companies are developing in this area. For example, by order of the English company TDSi, software was developed for the biometric palm vein reader PalmVein, presented by Fujitsu. The scanner itself was developed by Fujitsu primarily to combat financial fraud in Japan.
The following companies also operate in the field of vein pattern identification: Veid Pte. Ltd. (scanner, software), Hitachi VeinID (scanners)
I don’t know of any companies in Russia working on this technology.

Retina

Until recently, it was believed that the most reliable method of biometric identification and personal authentication was a method based on scanning the retina. It contains the best features of iris and arm vein identification. The scanner reads the pattern of capillaries on the surface of the retina. The retina has a fixed structure, unchanged over time except as a result of disease, such as cataracts.
A retinal scan uses low-intensity infrared light directed through the pupil to the blood vessels at the back of the eye. Retinal scanners have become widespread in access control systems for highly sensitive facilities, since they have one of the lowest percentages of denied access to registered users and there is virtually no erroneous access permission.
Unfortunately, a number of difficulties arise when using this biometric method. The scanner here is a very complex optical system, and the person must not move for a considerable time while the system is aimed, which causes unpleasant sensations.
According to EyeDentify, for the ICAM2001 scanner with FAR=0.001%, the FRR value is 0.4%.

Advantages and disadvantages of the method

Advantages. High level of statistical reliability. Due to the low prevalence of systems, the likelihood of developing a way to “deceive” them is low.
Flaws. Difficult to use system with high processing time. High cost of the system. Lack of a wide market supply and, as a consequence, insufficient intensity of development of the method.

Hand geometry

This method, which was quite common 10 years ago and originated from criminology, has been on the decline in recent years. It is based on obtaining the geometric characteristics of the hands: finger lengths, palm width, etc. This method, like the retina of the eye, is dying, and since it has much lower characteristics, we will not even introduce a more complete description of it.
It is sometimes believed that vein recognition systems use geometric recognition methods. But we have never seen anything like this explicitly stated on sale. And besides, often when recognizing by veins, a picture of only the palm is taken, while when recognizing by geometry, a picture of the fingers is taken.

A little self-PR

At one time, we developed a good eye recognition algorithm. But at that time, such a high-tech thing was not needed in this country, and we didn’t want to go to bourgeoistan (where we were invited after the first article). But suddenly, after a year and a half, there were investors who wanted to build themselves a “biometric portal” - a system that would feed 2 eyes and use the color component of the iris (for which the investor had a worldwide patent). Actually, this is what we are doing now. But this is not an article about self-PR, this is a short lyrical digression. If anyone is interested, there is some information, and sometime in the future, when we enter the market (or don’t), I will write a few words here about the ups and downs of the biometric project in Russia.

conclusions

Even in the class of static biometric systems, there is a large selection of systems. Which one should you choose? It all depends on the requirements for the security system. The most statistically reliable and forgery-resistant access systems are the iris and hand vein access systems. For the first of them there is a wider market of offers. But this is not the limit. Biometric identification systems can be combined to achieve astronomical precision. The cheapest and easiest to use, but with good statistics, are finger tolerance systems. 2D face tolerance is convenient and cheap, but has a limited range of applications due to poor statistical performance.
Let's consider the characteristics that each of the systems will have: resistance to counterfeiting, environmental resistance, ease of use, cost, speed, stability of the biometric feature over time. Let's put ratings from 1 to 10 in each column. The closer the score is to 10, the better the system in this regard. The principles for selecting assessments were described at the very beginning of the article.


We will also consider the relationship between FAR and FRR for these systems. This ratio determines the efficiency of the system and the breadth of its use.


It is worth remembering that for the iris, you can increase the accuracy of the system almost quadratically, without loss of time, if you complicate the system by making it for two eyes. For the fingerprint method - by combining several fingers, and recognition by veins, by combining two hands, but such an improvement is only possible with an increase in the time spent working with a person.
Summarizing the results for the methods, we can say that for medium and large objects, as well as for objects with the highest security requirements, the iris should be used as a biometric access and, possibly, recognition by hand veins. For facilities with up to several hundred personnel, access using fingerprints will be optimal. Recognition systems based on 2D facial images are very specific. They may be required in cases where recognition requires the absence of physical contact, but it is impossible to install an iris control system. For example, if it is necessary to identify a person without his participation, using a hidden camera, or an external detection camera, but this is only possible if there is a small number of subjects in the database and a small flow of people filmed by the camera.

A note for young technicians

Some manufacturers, for example Neurotechnology, have demo versions of the biometric methods they produce available on their website, so you can easily connect them and play around. For those who decide to delve into the problem more seriously, I can recommend the only book that I have seen in Russian - “Guide to Biometrics” by R.M. Ball, J.H. Connell, S. Pankanti. There are many algorithms and their mathematical models. Not everything is complete and not everything corresponds to modern times, but the base is good and comprehensive.

P.S.

In this opus I did not go into the problem of authentication, but only touched upon identification. In principle, from the characteristics of FAR/FRR and the possibility of forgery, all conclusions on the issue of authentication suggest themselves.

Tags:

• biometrics
• fingerprint scanners

Add tags

01/17/2002 Jim Carr

The new generation of biometric authentication devices is sweeping away previous barriers.

If the spaceship crew led by Captain Gene Luke Picard from the famous television series Star Trek could interact with the Enterprise computing system using voice, then why don't we log into the network this way? In fact, today this is both possible and impossible.

Biometric authentication devices for verifying a user's identity based on unique biological indicators such as voice, fingerprints or facial features have become the basis of many movie scripts. To enter manual control mode, Captain Picard could address the system as follows: “Computer, use the alpha-omega authentication code!” However, reality often does not coincide with fiction, and it is unlikely that you or your colleagues will be able to enter your network using speech.

This is not to say that biometric devices have not been available before. For example, EyeDentify was the first to market retinal scanners in 1982; Since 1986, Recognition Systems has been selling a reading device for identifying employees by palm shape; Iris and fingerprint reading equipment, as well as voice and facial ID systems are available in abundance. However, the widespread use of such devices was hampered by a number of factors. The biggest obstacle was their high price, but institutions that require personal authentication devices require large quantities - they need hundreds or thousands of such devices.

In addition, most authentication tools have proven to be too cumbersome to install on desktops, laptops, and portable devices such as cell phones or personal digital assistants. Their mass implementation was hampered by too low speed.

Finally, few IT managers realize the need to purchase such products. Most computing systems get by just fine with simple passwords and standard access systems controlled by magnetic key cards, although employees often break work rules by sharing their passwords and cards with colleagues.

However, there are all signs that the market is quite “ripe” for such equipment. Manufacturers are beginning to overcome the physical and financial barriers to implementing biometric devices, and it is likely that they will find use in many networking solutions.

So what's happening in the biometric products market? One thing is clear: it is developing rapidly, especially in the field of fingerprint recognition, where the technology is moving away from optical solutions to integrated circuits (ICs). In addition, biometric capabilities are implemented in a huge number of other devices, including keypads, smart cards and access control equipment. Let's take a closer look at some of them.

SMALL BUT GROWING DEMAND

Whatever the numbers, it is clear that few organizations actually need biometric authentication devices. Therefore, the market for such products is still small, although it is growing quite rapidly.

According to the analytical company Frost&Sullivan, total sales of biometric equipment in America in 2000 did not exceed $86.8 million and grew in 2001 only to $160.3 million - small numbers, nevertheless, the average annual growth rate in compound interest is 109%. Worldwide sales of these devices are expected to be around $300 million in 2001, rising to $900 million in 2003, according to research center META Group.

According to New York-based consulting company International Biometric Group, fingerprint scanning has become the most common technology. It is noted that of the $127 million in revenue from the sale of biometric devices, 44% comes from fingerprint scanners. Facial recognition systems take second place in terms of demand, which is 14%, followed by palm shape recognition devices (13%), voice recognition (10%) and iris recognition (8%). Signature verification devices make up 2% of this list.

Earl Perkins, META Group's associate director of biometrics and smart cards, compares user aversion to biometrics to the landscape in the Public Key Infrastructure (PKI) market. He believes both areas deserve recognition from corporate security teams and network administrators. According to Jason Wright, head of security at Frost&Sullivan, the main factor that can radically influence the situation in the market for biometric devices is their cost. Only recently have prices for biometric products fallen to levels acceptable to the mass consumer.

For example, fingerprint readers now sell for between $100 and $200 per user, down significantly from 1998's price of about $400. In addition, numerous PC and external device manufacturers integrate fingerprint scanners into their products; Among them are the largest PC manufacturer Compaq, mouse suppliers SecuGen and Siemens, and Fujitsu Takaisaws keyboard maker.

A sharp decline in prices for authentication devices is also observed in the market for other biometric technologies. In particular, the cost of voice and facial recognition equipment, which may use microphones and cameras that come standard with many desktop PCs and laptops, has fallen to commodity levels.

But there's something more important than prices, Perkins says. The fact that organizations are not yet purchasing biometric devices in large quantities indicates a lack of adequate attention to their own identity infrastructure. Most organizations have many different directories, five or six authentication methods, network login to Windows, and each application is protected by its own password.

Essentially, the bulk of biometric authentication systems are developed in the form of independent or “point” solutions; that is, one department uses a fingerprint reader for authorized access to a PC, another uses palm scanning technology to access the server room, but there is no relationship between these two solutions. Therefore, such devices are usually implemented on their own, without integration with internal systems and user ID lists. The situation here is changing, but slowly.

Until recently, manufacturers were unable to combine these disparate methods into one integrated product so that a variety of biometric equipment could be used with one internal system. However, some companies, such as Ankari, BioNetrix, Identix, Keyware and SAFLinks, already sell similar products.

They integrate biometric capabilities into internal systems, such as enterprise-scale Single Sign-On (SSO) systems such as Computer Associates' eTrust and Novell's Novell Modular Authentification Service (NMAS). This consolidation allows network administrators to replace one-time password authentication services with biometric technologies.

With lower prices, smaller device sizes and greater integration, analysts believe network administrators will finally realize the benefits of biometric devices over password authentication systems. By using fingerprint scanners and voice recognition devices to log into networks, employees are freed from the need to remember complex passwords. At the same time, no one else will be able to “borrow” their fingerprints for unauthorized access to critical network resources.

According to Frank Prince, senior analyst in the e-commerce infrastructure group at Forrester Research, the biometric approach makes it easier to find out who you are. Drawing attention to the fact that manufacturers consider the ease of use of these devices to be the main factor in promoting biometric technologies, he warns against oversimplification of the identification system, which should not lead to a violation of the principle of “reasonable sufficiency.”

OPTICS VERSUS INTEGRATED CIRCUITS

Unsurprisingly, the most significant progress has been seen in fingerprint scanners, as they make up a significant share of the biometric device market. At the same time, many manufacturers are increasingly moving from optical-based fingerprint equipment to products based on integrated circuits.

In traditional fingerprint scanning devices, the main element is a small optical camera to record the characteristic finger pattern. A number of manufacturers, including DigitalPersona, still use this technology.

However, according to Scott Moody, chief executive officer at AuthenTec, a semiconductor company that designs chips for some edge fingerprint scanners, more fingerprint equipment manufacturers are turning their attention to integrated circuit-based touch devices. This trend opens up new applications for fingerprint-based authentication.

The new generation of products measures skin capacitance to form an image of various fingerprint characteristics. For example, Veridicom's fingerprint sensor collects information by reading capacitance using a solid-state semiconductor sensor.

The operating principle is as follows: a finger applied to this device acts as one of the capacitor plates. The other, located on the surface of the sensor, is a silicon chip with 90 thousand sensitive capacitor plates, which form an eight-digit representation of the convexities and depressions of the pattern of the blood vessels of the finger. The received information is converted into a video signal and then processed in accordance with an algorithm that generates a sample image. It is by this sample, and not by the image of the fingerprint itself, that the user is verified during subsequent registration.

Another method used by AuthenTec makes IC-based touch testing even more accurate. The integrated circuit-based fingerprint reader FingerLoc (and the recently released EntrePad) contains a rectangular fingerprint verification surface called a touch array. This is nothing more than an active antenna array consisting of more than 16 thousand elements with a transparent coating that protects from scratches and other external influences. The sensor matrix is ​​surrounded by a guide ring, which transmits weak signals that are picked up by individual antenna elements.

Moody gives an example of how TruePrint software and AuthenTec hardware work together to scan the deeper layer (under the epidermis) where the unique ridges and valleys that create a finger's pattern are located. When the user touches the surface of the chip, the guide ring associates a weak signal with the subcutaneous layer of the finger.

This signal creates a digital pattern that reflects the unique subcutaneous structure - this is the distinctive advantage of AuthenTec technology. Using higher-resolution amplifiers (less than 1 pixel) and other signal reconstruction tools, TruePrint manipulates the output signals from thousands of individual sensor elements to create an accurate, undistorted representation of the fingerprint, which is then translated into a sample that is later used for verification.

PROS AND CONS OF INTEGRAL AND OPTICAL APPROACHES

While the vendors of IC-based and optical-based biometric devices are not at war with each other, each technology still has ardent adherents who make different arguments for and against both methods. The debate is mainly around cost and performance.

Moody points out that IC-based products can be much smaller than optical readers, making them easier to implement in a wider range of peripheral devices. AuthenTec's new AuthenPad touch device is a 20 mm square with a thickness of 1.4 mm (the dimensions of the FingerLoc sensor released a year ago are 26 mm and 4 mm, respectively).

As for optical readers, according to Georg Meyers, deputy director of marketing at DigitalPersona, they will continue to be present on the market, and there are several reasons for this. Demand for equipment is determined not only by performance, but also by price. Myers argues that integrated circuit devices don't handle handling well because grease, oil, and salt on your hands can degrade the surface of the chip over time. Although silicon manufacturers are able to overcome these challenges, manufacturing biometric products on integrated circuits still requires some cost, and the cost can only be reduced by reducing chip size.

The problem, he says, is that the finger pattern information captured by the small chips isn't enough to give an accurate picture because they don't read information from the entire finger. Meanwhile, DigitalPersona's U.are.U sensors make it possible to do this. In addition, such devices rely on an algorithm to convert the fingerprint image into a unique pattern of “feature points” (see Figure 1). This scanning algorithm is used in fingerprint devices intended for penitentiary institutions. Characteristic points are those that carry unique information about the fingerprint: for example, those places where the pattern of blood vessels ends in a curl or bulge. Myers believes that this method allows for more accurate reading of fingerprint information than copying lines of blood vessels indicating the features of the skin relief.

The small size of fingerprint readers on integrated circuits ensures their integration into peripheral devices, providing the latter with combined functions.

As noted, Compaq markets the DeskPro PC with a reader as an option. This reader, developed by Identix, is about an inch in area and connects to a PC via a parallel port.

Other manufacturers combine biometric systems with smart cards and key cards. For example, AiT/affinitex integrated the VeriMe reader into the ID card. This 1.27 mm thick device communicates with the ID card reader via an infrared signal, as is already implemented in the case of access control cards, which are used in many institutions to open doors. But even with this approach, users are required to initially enter their fingerprint into the system to create a sample.

According to Bernie Ash, senior administrator at AiT/affinitex, the employee must place their finger on the card while being within a five-foot zone from the reader. If the fingerprint matches the sample, the control system is informed of its personal encryption key. This ensures secure access to authorized resources.

Oberthur Card Systems has taken a similar approach with its Authentic biometric ID smart card. As with VeriMe, the fingerprint pattern is stored in the card's memory during the user ID listing process, matching the pattern to the private encryption key. Then, when the user inserts the smart card into the reader and places their finger on the sensor, the key verifies their identity.

Earl Perkins believes the combination of biometric devices and smart cards is a good solution. "Many European smart card manufacturers are salivating at the thought of the North American market," he says, noting that Gemplus and Schlumberger are also developing them.

GIVE ME YOUR HAND

Palm scanning devices, or palm shape scanning devices, rank second among biometric devices in terms of revenue, but are rarely used in a network environment due to their high cost and size. One example is Recognition Systems, which sells the HandKey II palm-shape recognition system for $1,595, which is beyond the capabilities of many organizations looking to purchase desktop security devices. Additionally, like many similar devices, the HandKey II is wall-mounted and too large to fit on a desktop or laptop.

But palm scanners are ideal for high-security, high-traffic computing environments, including server rooms, says Martin Huddart, director of Recognition Systems. He claims they are extremely accurate and have a very low False Rejection Rate (FRR), the percentage of legitimate users that are rejected. A low FRR is very important, primarily because it helps alleviate the frustration and discomfort that users experience with biometric equipment.

Palm shape readers create a three-dimensional image of the palm by measuring finger length, thickness, and palm surface area. Recognition Systems products perform more than 90 measurements, which are converted into a nine-bit sample for further comparisons. This pattern can be stored locally, on a personal palm scanner, or in a centralized database.

Among the manufacturers of palm shape recognition devices are Stromberg and Dermalog.

FACE AND VOICE RECOGNITION SYSTEMS

Facial feature scanning technology is suitable for applications where other biometric technologies are not suitable. In this case, the features of the eyes, nose and lips are used to verify and identify the person.

Manufacturers of facial recognition devices - BioID America, Visionics and eTrue - have developed their own mathematical algorithms for identifying users: for example, Visionics created a device called Local Feature Analysys to obtain a facial image.

BioID America supplies the market with both facial recognition equipment and voice verification devices. Jeff Bechler, director of sales, cites the benefits of facial scanning as being able to be used with the various types of cameras that come standard with PCs.

But research from the International Biometric Group suggests that employees in many organizations don't trust facial recognition devices, partly because they are photographed by a camera and then displayed on a monitor; however, many fear that the camera used is of low quality. In addition, according to this company, scanning facial features is the only method of biometric authentication that does not require consent to perform the verification (and can be carried out by a hidden camera), and therefore has a negative connotation for users.

Voice authentication systems are cost effective for the same reasons as facial recognition systems. In particular, they can be installed with equipment (such as microphones) that comes standard with many PCs.

All this suggests that voice authentication equipment is more suitable for integration into telephony applications than for network login. Typically it allows subscribers to access financial or other systems through telephone communication. The most famous products in this market are Nuance Communications and SpeechWorks.

One of the stages of operation of these devices is voice recognition, i.e., the context of spoken words is first recognized, and then the identity of the person is confirmed.

“Voice authentication systems rely on individual voice characteristics such as pitch, modulation, and frequency to record a sample and subsequently identify it,” said Joe Mannino, chief executive officer of VeriVoice. According to Laura Marino, product manager at Nuance Communications, which makes the Verifier voice authentication system, these metrics are determined by the physical characteristics of the vocal tract and are unique to each person.

Because voice can simply be recorded on tape or other media, some manufacturers, including VeriVoice, build a response request operation into their products. This function prompts the user upon entering to answer a pre-prepared and regularly changing request: for example, this one: “Repeat the numbers 0, 1, 3.”

MINUS RETINA AUTHENTICATION

Only in the field of retinal scanning, one of the most accurate biometric methods, is the industry moving backwards. This is due to the fact that the main manufacturer of such systems, EyeDentify, recalled its model 2001 retinal scanner due to insufficient development: the product had too many moving parts and a rather high price of about $2,000.

According to EyeDentify President Craig Silvey, the retina of the human eye is a unique object for authentication. “Even in twins, the pattern of blood vessels in the fundus is different,” he emphasizes.

EyeDentify's patented scanning technology uses infrared light from the retinal blood vessels to be reflected and collected from different angles. By analogy with other biometric devices, the information received is scrupulously analyzed using appropriate algorithms: in particular, equipment from EyeDentify generates a 96-bit sample that uniquely identifies a person.

Unfortunately, users find the 2001 model, which includes moving mirrors and tapes, too inconvenient. Silvey says the company is developing a retinal scanner that will cost $400 to $500 and can scan with a high degree of accuracy at a distance of 7.5 cm, leaving no doubt about identification. He believes that faster processors and other new technologies will make it possible to create a completely electronic retinal reader with no moving parts.

Jim Carr is deputy editor of Network Magazine. He can be contacted at: [email protected].

Considered manufacturers of biometric devices

The BioAPI Consortium working group is developing a standard Application Program Interface (API) for biometric devices. Information about these developments can be found at: http://www.bioapi.com .

On the Internetional Biometric Group website at: http://www.biometricgroup.com, you can get information about manufacturers and products, as well as current data on the biometric technology market.

Links to biometric technology statements, research reports, projects and publications from Biometric Research at the University of Michigan are provided at: http://www.boimetrics.cse.msu.edu.com .

This article is to some extent a continuation, and to some extent its prequel. Here I will talk about the basics of building any biometric system and about what was left behind the scenes of the last article, but was discussed in the comments. The emphasis is not on the biometric systems themselves, but on their principles and scope.
For those who have not read the article, or have already forgotten, I advise you to look at what FAR and FRR are, since these concepts will be used here.

General concepts

Any human authentication is based on three traditional principles:

1) By property. Property may include a pass, plastic card, key or general civil documents.
2) By knowledge. Knowledge includes passwords, codes, or information (such as mother's maiden name).
3) According to biometric characteristics. I spoke in more detail about what biometric characteristics there are in a previous article.

These three principles can be used individually or used in groups. This methodology gives rise to two main directions of biometrics.

Verification

Verification is the confirmation of a person’s identity through a biometric sign, where the primary authentication took place using one of the first two methods indicated above. The simplest verifier can be called a border guard who verifies your face with your passport. Verification implies significantly greater system reliability. The probability that the system will let through an intruder who does not use a means of overcoming is equal to the FAR of the biometric method used. Even for the weakest biometric systems, this probability is negligible. The main disadvantages of verification are two points. The first is that a person needs to carry a document with him or remember the system password. There is always the problem of losing or forgetting information. Verification is also fundamentally impossible for secretive authentication.

The operation of an access system based on biometric verification can be represented in the following way:

Identification

Biometric identification is the use of a biometric feature in which no additional information is required. The search for an object is carried out across the entire database and does not require a pre-key. It is clear that the main disadvantage of this is that the more people in the database, the greater the likelihood of false access by an arbitrary person. The previous article assessed the likelihood of such access when designing systems. For example, systems on the fingers make it possible to contain a database of no more than 300 people, on the eyes no more than 3000. Plus identification - all the keys will always be with you, no passwords or cards are needed.

Secret identification

Unlike verification, identification can be hidden to a person. How is it possible and should we be afraid of it? I will try to briefly describe the thoughts that exist among people involved in biometrics. In the last article this thought was left unfinished.

Let's consider technologies that can make it possible, at least in some cases, to determine his identity secretly from a person. Firstly, you should immediately discard all contact methods. Placing fingerprint scanners in door handles is not a good idea. They are noticeable, many do not touch their pens, contact scanners get dirty, etc. Secondly, you can immediately discard methods where the maximum range is limited to 10-15 centimeters (for example, arm veins). Thirdly, you can discard all dynamic biometrics, since their FAR and FRR indicators are too low.

There are only two technologies left. These are technologies where cameras act as data scanners: facial recognition (2D, 3D) and iris recognition.
The first of them, recognition by 2D faces, has already been repeatedly tried to be implemented (due to its simplicity), but all the time without success. This is due to the low statistical parameters of the system. If there are only 100 people in the database of wanted individuals, then every 10 passers-by will be declared wanted. Even a policeman in the metro has a much higher efficiency.
The next two technologies are very similar. Both can be used remotely from humans, but both must have sufficient equipment. Both the 3D face scanner and the iris scanner can be placed in places where there are narrow passages. These are escalators, doors, stairs. An example of such a system is the system created SRI International(now their site is dead, but there is almost an analogue from AOptix). I'm not 100% sure that the system from SRI International is working, there are too many errors in the video, but the fundamental possibility of creating it exists. The second system works, although the speed there is too low for a covert system. 3D face scanners work on approximately the same principle: detection in a narrow passage. In the case of 3D faces and eye recognition, the reliability of the work is quite high. If the database contains 100 criminals, then only every 10,000 civilians will have to be checked, which is already quite effective.

The key feature of any hidden biometric is that the person does not need to know about it. You can insert lenses into your eyes, or change the shape of your face with several pads, unnoticed by others, but noticeable by the biometric system. For some reason, I have a suspicion that in the near future the demand for lenses that change the iris will increase significantly. The demand for bandanas has increased in Britain. And the events there are only the first signs of biometrics.

Model of a biometric access system and its parts

Any biometric system will consist of several elements. In some of the systems, individual elements are fused, in others they are separated into different elements.

If the biometric system is used only at one checkpoint, then it doesn’t really matter whether the system is divided into parts or not. On the spot, you can add a person to the database and check him. If there are several checkpoints, then it is irrational to store a separate database at each checkpoint. Moreover, such a system is not dynamic: adding or removing users requires bypassing all scanners.

Biometric scanner

A biometric scanner is part of any biometric system, without which it cannot exist. In some systems, a biometric scanner is simply a video camera, and in others (for example, retinal scanners), it is a complex optical complex. The two main characteristics of a biometric scanner are its operating principle (contact, non-contact) and its speed (the number of people per minute it can serve). For those biometric characteristics whose use has already become the norm, the scanner can be purchased separately from the logical system. If the scanner is physically separated from the comparison algorithm and from the database, the scanner can perform primary processing of the resulting biometric characteristic (for example, for an eye, this is the selection of the iris). This action is performed in order not to overload the communication channel between the scanner and the main database. Also, a scanner that is separate from the database usually has a built-in data encryption system to secure the transfer of biometric data.

Comparison algorithm + database

These two parts of the biometric system usually live next to each other and often complement each other. For some biometric characteristics, the comparison algorithm can perform an optimized search in the database (comparison by fingers, comparison by face). And in some (eyes), for a complete comparison, in any case, he needs to go around the entire database.

The comparison algorithm has many characteristics. Its two main characteristics, FAR and FRR, largely define a biometric system. It is also worth noting:

1) Speed ​​of work. For some comparisons (eyes), the speed can reach hundreds of thousands of comparisons per second on a regular computer. This speed is enough to satisfy any user needs without noticing any time delay. And for some systems (3D face) this is already a fairly significant characteristic of the system, requiring a lot of computing power to maintain speed while increasing the base.
2) Ease of use. In fact, the convenience of any system is largely determined by the ratio FAR, FRR. In the system, we can slightly change their value, so as to place an emphasis on speed or reliability. Roughly speaking, the graph looks something like this:

If we want a high level of reliability, we choose the position on the left side. And if there are few users, then good indicators will be on the right side of the graph, where there will be high convenience characteristics, and therefore high speed.

"Do something"

After comparison, the biometric system must output the comparison results to the control bodies. Then it can be either a command to “open the door” or information “so-and-so has come to work.” But it’s up to the system installers to decide what to do next with this information. But even here, not everything is so simple, we must take into account the possibilities of attack:

Attack on the biometric system

Despite the fact that many biometric systems are equipped with algorithms that can detect an attack on them, this is not enough to take security lightly. The simplest attack on an identification system is multiple scanning. Let’s assume a situation: the company employs about a hundred people. The attacker approaches the biometric pass system and scans it repeatedly. Even for reliable systems, after a couple of thousand scans, it is possible for an intruder to be falsely identified and allowed to enter the facility. To avoid this, many systems track failed scans and block entry after 10-15 attempts. But in cases where the system cannot do this, this task falls on the user. Unfortunately, this is often forgotten.
The second way to attack a biometric system is to spoof the scanned object. If the system has anti-counterfeiting algorithms, it is important to react to them correctly. Usually these algorithms are also probabilistic and have their own FAR and FRR. So don’t forget to monitor attack signals in time and send a guard.
In addition to attacking the system itself, it is possible to attack the system's environment. We once came across a funny situation in this country. Many integrators don't worry too much about data transfer. They use a standard protocol for transmission

Andrey Borzenko

To establish the identity of the detainee,
the policeman had enough
just look into his eyes.
From newspapers

With the development of computer networks and the expansion of automation, the value of information is steadily increasing. State secrets, high-tech know-how, commercial, legal and medical secrets are increasingly being trusted to a computer, which is usually connected to local and corporate networks. The popularity of the global Internet, on the one hand, opens up enormous opportunities for e-commerce, but, on the other hand, creates the need for more reliable security measures to protect corporate data from outside access. Today, more and more companies are faced with the need to prevent unauthorized access to their systems and protect e-business transactions.

Almost until the end of the 90s, the main way to personalize a user was to indicate his network name and password. To be fair, it should be noted that this approach is still followed in many institutions and organizations. The dangers associated with using a password are well known: passwords are forgotten, stored in the wrong place, and finally, they can simply be stolen. Some users write down their passwords on paper and keep these notes near their workstations. Many company information technology teams report that the majority of help desk calls involve forgotten or expired passwords.

It is known that the system can be deceived by introducing someone else's name. To do this, you only need to know some identifying information, which, from the point of view of the security system, is possessed by a single person. An attacker, posing as a company employee, gets at his disposal all the resources available to that user in accordance with his powers and job responsibilities. The result can be various illegal actions, ranging from theft of information to the disabling of the entire information complex.

Developers of traditional identification devices are already faced with the fact that standard methods are largely outdated. The problem, in particular, is that the conventional distinction between physical access control and information access control is no longer tenable. After all, to gain access to a server, sometimes it is not at all necessary to enter the room where it is located. The reason for this is the concept of distributed computing that has become comprehensive, combining both client-server technology and the Internet. Solving this problem requires radically new methods based on a new ideology. Studies show that damage in cases of unauthorized access to company data can amount to millions of dollars.

Is there a way out of this situation? It turns out there is, and has been for a long time. It’s just that to access the system you need to use identification methods that do not work in isolation from their carrier. This requirement is met by the biometric characteristics of the human body. Modern biometric technologies make it possible to identify a person based on physiological and psychological characteristics. By the way, biometrics has been known to mankind for a very long time - even the ancient Egyptians used identification by height.

Biometric Identification Basics

The main goal of biometric identification is to create a registration system that would extremely rarely deny access to legitimate users and at the same time completely exclude unauthorized entry into computer information storages. Compared to passwords and cards, such a system provides much more reliable protection: after all, one’s own body cannot be forgotten or lost. Biometric recognition of an object is based on a comparison of the physiological or psychological characteristics of this object with its characteristics stored in the system database. A similar process constantly occurs in the human brain, allowing you to recognize, for example, your loved ones and distinguish them from strangers.

Biometric technologies can be divided into two broad categories - physiological and psychological (behavioural). In the first case, such features as facial features, eye structure (retina or iris), finger parameters (papillary lines, relief, length of joints, etc.), palm (its imprint or topography), hand shape, vein pattern are analyzed on the wrist or thermal image. Psychological characteristics are a person’s voice, features of his signature, dynamic parameters of writing and features of entering text from the keyboard.

The choice of the method most suitable in a given situation is influenced by a number of factors. The proposed technologies differ in efficiency, and their cost in most cases is directly proportional to the level of reliability. Thus, the use of specialized equipment sometimes increases the cost of each workplace by thousands of dollars.

Physiological features, such as the papillary pattern of a finger, the geometry of the palm, or the pattern (model) of the iris of the eye, are permanent physical characteristics of a person. This type of measurement (check) is practically unchanged, just like the physiological characteristics themselves. Behavioral characteristics, for example, signature, voice or keyboard handwriting, are influenced by both controlled actions and less controllable psychological factors. Because behavioral characteristics can change over time, the registered biometric sample must be updated with each use. Biometrics based on behavioral characteristics are cheaper and pose less of a threat to users; But identification of a person by physiological traits is more accurate and provides greater security. In any case, both methods provide a significantly higher level of identification than passwords or cards.

It is important to note that all biometric authentication tools, in one form or another, use the statistical properties of some qualities of an individual. This means that the results of their application are probabilistic in nature and will change from time to time. In addition, all such tools are not immune to authentication errors. There are two types of errors: false refusal (they didn’t recognize someone else) and false admission (they let someone else through). It must be said that this topic has been well studied in probability theory since the development of radar. The impact of errors on the authentication process is assessed by comparing the average probabilities of false rejection and false admission, respectively. As practice shows, these two probabilities are related by an inverse relationship, i.e. When you try to tighten control, the likelihood of not letting someone else into the system increases, and vice versa. Thus, in each case it is necessary to seek some kind of compromise. However, even according to the most pessimistic assessments of experts, biometrics wins in all comparisons, since it is significantly more reliable than other existing authentication methods.

In addition to efficiency and price, companies should also consider how employees respond to biometrics. An ideal system should be easy to use, fast, unobtrusive, convenient and socially acceptable. However, nothing is ideal in nature, and each of the developed technologies only partially meets the entire set of requirements. But even the most inconvenient and unpopular means (for example, retinal identification, which users try in every possible way to avoid by protecting their eyes) bring undoubted benefits to the employer: they demonstrate the company’s due attention to security issues.

The development of biometric devices is proceeding in several directions, but their common features are an unsurpassed level of security today, the absence of traditional disadvantages of password and card protection systems, and high reliability. The successes of biometric technologies are so far associated mainly with organizations where they are implemented by order, for example, to control access to protected areas or to identify persons who have attracted the attention of law enforcement agencies. Enterprise users do not yet seem to realize the full potential of biometrics. Often, company managers are hesitant to deploy biometric systems for fear that possible inaccuracies in measurements will deny users access to which they are entitled. Nevertheless, new technologies are increasingly penetrating the corporate market. Already today there are tens of thousands of computerized locations, storage facilities, research laboratories, blood banks, ATMs, and military installations, access to which is controlled by devices that scan an individual's unique physiological or behavioral characteristics.

Authentication Methods

As you know, authentication involves checking the authenticity of a subject, which in principle can be not only a person, but also a software process. Generally speaking, the authentication of individuals is possible through the presentation of information stored in various forms. It could be:

• password, personal number, cryptographic key, network address of a computer on the network;
• smart card, electronic key;
• appearance, voice, iris pattern, fingerprints and other biometric characteristics of the user.

Authentication allows you to reasonably and reliably differentiate access rights to information that is in public use. However, on the other hand, the problem of ensuring the integrity and reliability of this information arises. The user must be confident that he is accessing information from a reputable source and that the information has not been modified without appropriate authorization.

Finding a one-to-one match (one attribute) is called verification. This method is fast and places minimal demands on the computer's computing power. But a one-to-many search is called identification. Implementing such an algorithm is usually not only difficult, but also expensive. Today, biometric devices are entering the market that use such individual human characteristics as fingerprints, facial features, iris and retina, palm shape, voice, speech and signature features to verify and identify computer users. At the stage of testing and trial operation there are systems that allow users to be authenticated by the thermal field of the face, the pattern of the blood vessels of the hand, body odor, skin temperature and even the shape of the ears.

Any biometric system allows you to recognize a certain pattern and establish the authenticity of specific physiological or behavioral characteristics of the user. Logically, a biometric system can be divided into two modules: a registration module and an identification module. The first is responsible for training the system to identify a specific person. At the registration stage, biometric sensors scan the necessary physiological or behavioral characteristics of a person and create a digital representation of them. A special module processes this representation in order to highlight the characteristic features and generate a more compact and expressive representation called a template. For an image of a face, such characteristic features may be the size and relative position of the eyes, nose and mouth. A template for each user is stored in the biometric system database.

The identification module is responsible for recognizing a person. During the identification phase, the biometric sensor takes characteristics of the person to be identified and converts these characteristics into the same digital format in which the template is stored. The resulting pattern is compared with the stored one to determine whether the patterns match each other.

For example, in Microsoft Windows, user authentication requires two objects - a user name and a password. When using fingerprints in the authentication process, the username is entered for registration, and the fingerprint replaces the password (Figure 1). This technology uses the user's name as a pointer to retrieve the user's account and check for a one-to-one match between the fingerprint pattern read during registration and the pattern previously stored for that user name. In the second case, the fingerprint template entered during registration must be compared with the entire set of saved templates.

When choosing an authentication method, it makes sense to consider several main factors:

• value of information;
• cost of authentication software and hardware;
• system performance;
• user attitude towards the authentication methods used;
• specificity (purpose) of the protected information complex.

It is obvious that the cost, and therefore the quality and reliability of authentication means, must be directly related to the importance of the information. In addition, an increase in the productivity of a complex is usually also accompanied by an increase in its cost.

Fingerprints

In recent years, fingerprint identification has gained attention as the biometric technology that is likely to be most widely used in the future. According to the Gartner Group (http://www.gartnergroup.com), this technology dominates the corporate market and in the near future it can only compete with iris recognition technology.

Government and civil organizations around the world have long used fingerprints as a primary method of identifying individuals. In addition, fingerprints are the most accurate, user-friendly and cost-effective biometric characteristic for use in a computer-based identification system. This technology in the USA is used, for example, by the departments of transportation of several state administrations, MasterCard, the FBI, the Secret Service, the National Security Agency, the ministries of finance and defense, etc. By eliminating the need for user passwords, fingerprint recognition technology reduces support calls and reduces network administration costs.

Typically, fingerprint recognition systems are divided into two types: for identification - AFIS (Automatic Fingerprint Identification Systems) and for verification. In the first case, the prints of all ten fingers are used. Such systems are widely used in the judiciary. Verification devices usually operate with information about the fingerprints of one, or less often several, fingers. Scanning devices are generally of three types: optical, ultrasonic and microchip-based.

The advantages of fingerprint access are ease of use, convenience and reliability. There are two fundamental algorithms for recognizing fingerprints: by individual details (characteristic points) and by the relief of the entire surface of the finger. Accordingly, in the first case, the device registers only some areas that are unique to a particular fingerprint and determines their relative position. In the second case, the image of the entire print is processed. Modern systems increasingly use a combination of these two methods. This avoids the disadvantages of both and increases the reliability of identification. It takes a little time to register a person's fingerprint on an optical scanner at one time. A tiny CCD camera, either a standalone device or built into the keyboard, takes a photo of your fingerprint. Then, using special algorithms, the resulting image is converted into a unique “template” - a map of microdots of the fingerprint, which are determined by the breaks and intersections of lines present in it. This template (not the fingerprint itself) is then encrypted and recorded in a database to authenticate network users. One template stores from several tens to hundreds of microdots. At the same time, users do not have to worry about the inviolability of their privacy, since the fingerprint itself is not stored and cannot be recreated using microdots.

The advantage of ultrasonic scanning is the ability to determine the required characteristics on dirty fingers and even through thin rubber gloves. It is worth noting that modern recognition systems cannot be fooled even by freshly severed fingers (the microchip measures the physical parameters of the skin). More than 50 different manufacturers are developing such systems.

Using a fingerprint for personal identification is the most convenient of all biometric methods. The probability of error when identifying a user is much lower compared to other biometric methods. The quality of fingerprint recognition and the possibility of its correct processing by the algorithm strongly depend on the state of the surface of the finger and its position relative to the scanning element. Different systems have different requirements for these two parameters. The nature of the requirements depends, in particular, on the algorithm used. For example, recognition by characteristic points produces a high level of noise when the surface of the finger is in poor condition. Recognition over the entire surface does not have this disadvantage, but it requires very precise placement of the finger on the scanning element. A fingerprint identification device (scanner, Fig. 2) does not require much space and can be mounted in a pointing device (mouse) or keyboard.

Facial geometry

Identifying a person by face in everyday life is, without any doubt, the most common method of recognition. As for its technical implementation, it is a more complex (from a mathematical point of view) task than fingerprint recognition, and, in addition, requires more expensive equipment (you need a digital video or photo camera and a video capture card). This method has one significant advantage: storing data about one sample identification template requires very little memory. And all because, as it turned out, the human face can be “disassembled” into a relatively small number of areas that are the same for all people. For example, to calculate a unique pattern corresponding to a specific person, only 12 to 40 characteristic areas are required.

Typically the camera is installed at a distance of several tens of centimeters from the object. Having received the image, the system analyzes various facial parameters (for example, the distance between the eyes and nose). Most algorithms allow you to compensate for the presence of glasses, a hat and a beard on the subject under study. For this purpose, facial scanning in the infrared range is usually used. It would be naive to assume that such systems provide very accurate results. Despite this, in a number of countries they are quite successfully used to verify cashiers and users of deposit safes.

Hand geometry

Along with systems for assessing facial geometry, there is equipment for recognizing the outlines of the palms of the hands. In this case, more than 90 different characteristics are assessed, including the size of the palm itself (three dimensions), the length and width of the fingers, the outlines of the joints, etc. Currently, user identification based on hand geometry is used in legislative bodies, international airports, hospitals, immigration services, etc. The benefits of palm geometry identification are comparable to those of fingerprint identification in terms of security, although the palm print reader takes up more space.

Iris

Quite reliable recognition is provided by systems that analyze the pattern of the iris of the human eye. The fact is that this characteristic is quite stable, does not change throughout a person’s entire life, and is impervious to pollution and wounds. Note also that the irises of the right and left eyes are significantly different in design.

Typically, a distinction is made between active and passive recognition systems. In systems of the first type, the user must adjust the camera himself, moving it for more precise aiming. Passive systems are easier to use because the camera is automatically adjusted. The high reliability of this equipment allows it to be used even in correctional institutions.

The advantage of iris scanners is that they do not require the user to focus on the target because the pattern of iris spots is on the surface of the eye. In fact, a video image of the eye can be scanned even from less than a meter away, making iris scanners suitable for ATMs.

Retina

The retinal identification method received practical application relatively recently - somewhere in the mid-50s of the now past 20th century. It was then that it was proven that even in twins the pattern of retinal blood vessels does not match. In order to register with a special device, you only need to look through the camera’s peephole for less than a minute. During this time, the system manages to illuminate the retina and receive the reflected signal. The retinal scan uses low-intensity infrared light directed through the pupil to the blood vessels at the back of the eye. Several hundred initial characteristic points are extracted from the received signal, information about which is averaged and stored in an encoded file. The disadvantages of such systems include, first of all, the psychological factor: not every person dares to look into an unknown dark hole where something is shining into the eye. In addition, it is necessary to monitor the position of the eye relative to the hole, since such systems are usually sensitive to incorrect orientation of the retina. Retinal scanners have become widespread when organizing access to top-secret systems, since they guarantee one of the lowest percentages of denial of access to registered users and an almost zero percentage of errors.

Voice and speech

Many companies produce software that can identify a person by voice. Here parameters such as pitch, modulation, intonation, etc. are assessed. Unlike appearance recognition, this method does not require expensive equipment - just a sound card and a microphone are enough.

Voice identification is a convenient, but not as reliable method as other biometric methods. For example, a person with a cold may have difficulty using such systems. Voice is formed from a combination of physiological and behavioral factors, so the main challenge associated with this biometric approach is identification accuracy. Currently, voice identification is used to control access to medium-security premises.

Signature

As it turns out, a signature is as unique an attribute of a person as his physiological characteristics. In addition, this is a more familiar identification method for any person, since, unlike fingerprinting, it is not associated with the criminal sphere. One of the promising authentication technologies is based on the unique biometric characteristics of the movement of the human hand while writing. Typically, there are two ways to process signature data: simple comparison with a sample and dynamic verification. The first one is very unreliable, since it is based on the usual comparison of the entered signature with graphic samples stored in the database. Due to the fact that the signature cannot always be the same, this method produces a high percentage of errors. The dynamic verification method requires much more complex calculations and allows real-time recording of parameters of the signature process, such as the speed of hand movement in different areas, the pressure force and the duration of various stages of the signature. This guarantees that even an experienced graphologist cannot forge a signature, since no one is able to exactly copy the behavior of the hand of the owner of the signature.

The user, using a standard digitizer and pen, imitates his usual signature, and the system reads the movement parameters and compares them with those that were previously entered into the database. If the signature image matches the standard, the system attaches information to the document being signed, including the user’s name, email address, position, current time and date, signature parameters containing several dozen characteristics of motion dynamics (direction, speed, acceleration) and others. This data is encrypted, then a checksum is calculated for it, and then the whole thing is encrypted again, forming a so-called biometric tag. To set up the system, a newly registered user performs the document signing procedure five to ten times, which makes it possible to obtain average indicators and a confidence interval. This technology was first used by PenOp.

Signature identification cannot be used everywhere - in particular, this method is not suitable for restricting access to premises or for access to computer networks. However, in some areas, for example in the banking industry, as well as anywhere where important documents are executed, verifying the correctness of the signature can be the most effective, and most importantly - easy and discreet way. Until now, the financial community has been slow to adopt automated methods for credit card signature identification and application verification because signatures are still too easy to forge. This prevents the introduction of signature identification into high-tech security systems.

Prospects

I would like to note that the most effective protection is provided by systems in which biometric systems are combined with other hardware authentication tools, such as smart cards. By combining various methods of biometric and hardware authentication, you can get a very reliable security system (which is indirectly confirmed by the great interest that leading manufacturers are showing in these technologies).

Note that smart cards form one of the largest and fastest growing segments of the market for electronic products for users. Dataquest (http://www.dataquest.com) predicts that smart card sales will exceed half a billion dollars by next year. The use of smart cards requires the presence at each workplace of a special reading (terminal) device connected to a computer, which eliminates the need to involve the user in the process of interaction between the card and the authentication server. The smart card itself provides two levels of authentication. For the system to work, the user must insert the smart card into the reader and then enter the correct personal identification number. On the Russian market, complex solutions combining fingerprint identification and the use of smart cards (Fig. 3) are offered, for example, by Compaq (http://www.compaq.ru) and Fujitsu-Siemens (http://www. fujitsu-siemens.ru).

Rice. 3. Combined system with scanner and smart card.

In addition to large computer companies such as Fujitsu-Siemens, Motorola, Sony, Unisys, the development of biometric technologies is currently carried out mainly by small private companies that have united in a consortium on biometrics - Biometric Consortium (http://www.biometrics.org). One of the most encouraging signs that biometrics is finally entering the mainstream of the IT industry is the creation of the BioAPI (Biometrics API). Behind this development is a consortium of manufacturers formed in 1998 by Compaq, IBM, Identicator Technology, Microsoft, Miros and Novell specifically to develop a standardized specification supporting existing biometric technologies that could be implemented in operating systems and application software. The BioAPI consortium today includes 78 large public and private companies.

Now corporate clients can use biometric products within the framework of standard computer and network technologies, thus avoiding significant material and time costs for the integration of all system components. Standard APIs provide access to a wide range of biometric devices and software products, and allow cross-vendor products to be used together.

This year, the US government has already announced the implementation of the open BioAPI standard in government agencies. The innovations will affect primarily the US Department of Defense, where it is planned to introduce new smart cards that store fingerprints and a sample signature of the owner for several million military and civilian employees.

According to a number of analysts, biometric technologies are still developing quite slowly, but the time is not far when not only desktop and laptop computers, but also mobile phones will be unthinkable without such authentication means. Great expectations are associated with the support of promising biometric technologies by the Microsoft Windows operating system.

Today, biometric security systems are being used increasingly due to the development of new mathematical authentication algorithms. The range of problems that can be solved using new technologies is quite extensive:

• Law enforcement and forensics;
• Access control system (ACS) and restriction of access to public and commercial buildings, private homes (smart home);
• Transfer and receipt of confidential personal and commercial information;
• Carrying out trade, financial and banking electronic transactions;
• Login to an electronic remote and/or local workplace;
• Blocking the operation of modern gadgets and protecting electronic data (cryption keys);
• Maintaining and accessing government resources;

Conventionally, biometric authentication algorithms can be divided into two main types:

• Static – fingerprinting, iris; measuring the shape of the hand, the line of the palms, the placement of blood vessels, measuring the shape of the face in 2D and 3D algorithms;
• Dynamic – handwriting and typing rhythm; gait, voice, etc.

Main selection criteria

When choosing a capable installation for measuring a biological parameter of any type, you should pay attention to two parameters:

• FAR - determines the mathematical probability of the coincidence of key biological parameters of two different people;
• FRR - determines the likelihood of denying access to a person entitled to it.

If manufacturers omitted these characteristics when presenting their product, then their system is ineffective and lags behind competitors in functionality and fault tolerance.

Also important parameters for comfortable operation are:

• Ease of use and the ability to perform identification without stopping in front of the device;
• The speed of reading the parameter, processing the received information and the size of the database of biological reference indicators.

It should be remembered that biological indicators, static to a lesser extent and dynamic to a greater extent, are parameters that are subject to constant changes. The worst performance for a static system is FAR~0.1%, FRR~6%. If a biometric system has failure rates below these values, then it is ineffective and ineffective.

Classification

Today, the market for biometric authentication systems is extremely unevenly developed. In addition, with rare exceptions, security system manufacturers also produce closed-source software that is suitable exclusively for their biometric readers.

Fingerprints

Fingerprint analysis is the most common, technically and software-advanced method of biometric authentication. The main condition for development is a well-developed scientific, theoretical and practical knowledge base. Methodology and classification system for papillary lines. When scanning, the key points are the ends of the pattern line, branches and single points. Particularly reliable scanners introduce a system of protection against latex gloves with fingerprints - checking the relief of papillary lines and/or finger temperature.

In accordance with the number, nature and placement of key points, a unique digital code is generated and stored in the database memory. The time for digitizing and verifying a fingerprint usually does not exceed 1-1.5 seconds, depending on the size of the database. This method is one of the most reliable. For advanced authentication algorithms - Veri Finger SKD, reliability indicators are FAR - 0.00%...0.10%, FRR - 0.30%... 0.90%. This is enough for reliable and uninterrupted operation of the system in an organization with a staff of more than 300 people.

Advantages and disadvantages

The undeniable advantages of this method are:

• High reliability;
• Lower cost of devices and their wide selection;
• Simple and fast scanning procedure.

The main disadvantages include:

• Papillary lines on the fingers are easily damaged, causing system errors and blocking access for authorized employees;
• Fingerprint scanners must have a system to protect against counterfeit images: temperature sensors, pressure detectors, etc.

Manufacturers

Foreign companies that produce biometric systems, devices for access control systems and software for them should be noted:

• SecuGen – mobile compact USB scanners for PC access;
• Bayometric Inc – production of various types of biometric scanners for complex security systems;
• DigitalPersona, Inc – release of combination scanner-locks with integrated door handles.

Domestic companies producing biometric scanners and software for them:

• BioLink
• Sonda
• SmartLock

Eye scan

The iris of the eye is as unique as the papillary lines on the hand. Having finally formed at the age of two, it practically does not change throughout life. The exception is injuries and acute pathologies of eye diseases. This is one of the most accurate methods of user authentication. The devices perform scanning and primary data processing for 300-500 ms; comparison of digitized information on a medium-power PC is carried out at a speed of 50,000-150,000 comparisons per second. The method does not impose restrictions on the maximum number of users. FAR statistics - 0.00%...0.10% and FRR - 0.08%... 0.19% were collected based on the Casia EyR SDK algorithm. According to these calculations, it is recommended to use such access systems in organizations with more than 3,000 employees. Modern devices widely use cameras with a 1.3 MP matrix, which allows you to capture both eyes during scanning, which significantly increases the threshold of false or unauthorized positives.

Advantages and disadvantages

• Advantages:
  • High statistical reliability;
  • Image capture can occur at a distance of up to several tens of centimeters, while physical contact of the face with the outer shell of the scanning mechanism is excluded;
  • Reliable methods that exclude counterfeiting - checking the accommodation of the pupil - almost completely exclude unauthorized access.
• Flaws:
  • The price of such systems is significantly higher than that of fingerprint systems;
  • Ready-made solutions are only available for large companies.

The main players in the market are: LG, Panasonic, Electronics, OKI, which operate under licenses from Iridian Technologies. The most common product that you can encounter on the Russian market are ready-made solutions: BM-ET500, Iris Access 2200, OKI IrisPass. Recently, new companies worthy of trust have appeared: AOptix, SRI International.

Retinal scan

An even less common, but more reliable method is scanning the placement of the capillary network on the retina. This pattern has a stable structure and remains unchanged throughout life. However, the very high cost and complexity of the scanning system, as well as the need to remain motionless for a long time, make such a biometric system available only to government agencies with an increased security system.

Face recognition

There are two main scanning algorithms:

2D is the most ineffective method, producing multiple statistical errors. It consists of measuring the distance between the main organs of the face. Does not require the use of expensive equipment, just a camera and appropriate software are enough. Recently it has gained significant popularity on social networks.

3D - this method is radically different from the previous one. It is more accurate; the subject does not even need to stop in front of the camera to identify it. Comparison with information entered into the database is made thanks to serial shooting, which is performed on the go. To prepare data on a client, the subject turns his head in front of the camera and the program generates a 3D image with which it compares the original.

The main manufacturers of software and specialized equipment on the market are: Geometrix, Inc., Genex Technologies, Cognitec Systems GmbH, Bioscrypt. Among Russian manufacturers, Artec Group, Vocord, ITV can be noted.

Hand scan

Also divided into two radically different methods:

• Scanning the pattern of hand veins under the influence of infrared radiation;
• Hand geometry - the method originated from criminology and has recently become a thing of the past. It consists of measuring the distance between the joints of the fingers.

The choice of a suitable biometric system and its integration into the access control system depends on the specific requirements of the organization’s security system. For the most part, the level of protection against counterfeiting of biometric systems is quite high, so for organizations with an average level of security clearance (secrecy), budget fingerprint authentication systems are quite sufficient.