The ultimate in authentication?

As many of you will doubtless be aware, biometrics is the term for any method that can be used to identify a person by way of a measurable, physiological and/or behavioural characteristic – such as fingerprints, voice, retina scanning or handwritten signatures ('Recognition is due', Security Management Today, May 2002, pp34-36).

Biometrics, however, are by no means infallible. Although there has been an increased interest in the technology post-September 11, the general public still holds a number of preconceptions that are serving to hinder the mass adoption of such technologies in the wider world.

Biometrics are a 'new thing'
The first preconception is that biometrics are a 'new thing'. The concept of biometric verification of identity is at least as old as the concept of a handwritten signature. A signature clearly contains a mix of physiological and behavioural characteristics which, individually, may be shared but collectively form a unique combination of handwriting style, pressure, direction of strokes, loops and so on.

Meantime, fingerprints – another biometric measuring device – have been used as evidence in criminal prosecutions for over 100 years!

Another preconception is that biometrics are priced out of the market. Historically, it would be true to say that the cost of biometric security has been rather high, but as its use and implementation has increased so costs have fallen. In particular, the price of fingerprint scanners has dropped ten-fold since 1990. Costs are expected to reduce still further as demand for biometrics increases.

Although costs are still high in many areas, these are increasingly being outweighed by other factors. With 500,000 cases of identity theft reported every year in the US alone, clients now seem willing to accept biometrics at the cost of increased privacy and more intrusive methods of identification.

According to a Meridien survey, in 2000 end users spent $127 million on biometric devices, with fingerprint scanners accounting for about 44% of all sales. Facial recognition made up 14% of sales, hand geometry devices 13%, voice recognition systems 10% and iris scanners 8%.

Although costs are still high in many areas, these are increasingly being outweighed by other factors. With 500,000 cases of identity theft reported every year in the US alone, clients now seem willing to accept biometrics as an answer

By 2004, it's predicted that the financial services market alone will spend about $1.8 billion on biometric technology. No small sum.

A further preconception is that biometrics are rarely implemented. The implementation of biometrics is increasing as blue chip giants including Microsoft use the mass interest in Windows XP to help broaden the appeal. Fast user switching is now possible, whereby computer operators are able to switch profiles without shutting down their applications or completely logging off from a shared PC by way of a fingerprint biometric system.

In addition, security personnel at Heathrow Airport – one of the busiest international airports in the world – are about to begin a trial using the EyeTicket JetStream procedure, which was developed in the US to identify travellers as they pass through a given concourse.

In operation, the system asks the travellers selected to look into a special camera that takes a close-up picture of the iris. From this, the system then extracts a 512-byte digital pattern, which is then digitally encoded and compared with images already stored on the Immigration Service databases. If everything matches then the barrier opens immediately.

A panacea for all access ills?
Biometrics are neither a panacea for security issues, nor are they simply an expensive gimmick. Some of the technologies and applications are much more mature than others. And, although issues such as false positives present real risks, biometric solutions may be leveraged for commercial advantage.

The overriding rule for end users must be that careful thought has to be given to any potential biometric system implementation.