Biometrics: Brave new world?

• Article 7 of 33
• SC Magazine, January 2007
• View the original article online

Page 1 | Page 2 | Page 3 | Page 4 | All 4 Pages

Mike Nelson, UK MD of Fujitsu, which makes the PalmSecure palm-vein biometric systems, disputes this. “Fingerprinting only works for one-to-one,” he says. “Ten per cent of people can't use fingerprint devices. And iris scanning has acceptability issues.” He insists that palm-vein scanning is more accurate and acceptable to users, as they don't have to touch anything.

In all cases, the hardware and environment used during authentication and “enrolment” - the procedure used to obtain the initial biometric against which all others are compared - can affect accuracy.

A major factor when choosing biometrics is how you're going to use it - as a unique identifier in its own right or as a reinforcement to another method of identification. Often when accessing a location or system, another token, such as a smartcard or PIN, will first identify the person trying to obtain access. The system will then compare a stored biometric to one taken at the point of entry to ensure the person using the token is the person authorised to do so.

As a result, instead of a one-to-many comparison between the measured biometric and those stored in the access database, a simple one-to-one comparison is all the system will require. This reduces the seek time and the chance of false matches. It also means that a less accurate but cheaper and more convenient biometric can be used.

Calling for back-up
It's this combined approach that's making inroads in the real world, both inside enterprises and when dealing with customers. Financial services companies that use biometrics usually deploy them in combination with smartcards. Technology company NCR has deployed fingerprint matching systems in several countries in South America for use in ATMs. “In Columbia and Chile, there's a considerable 'unbanked' market (of people who) are illiterate,” explains Charlie Harrow, product manager for biometrics solutions at NCR's financial solutions division. Using fingerprint biometrics, banks have been able to enrol many of the unbanked as customers. They are able to enter their social security number into an ATM and use its built-in fingerprint scanner to confirm they are who they claim to be.

However, if the aim of using biometrics is to reduce costs, a system that involves supplying a smartcard or magnetic swipe card - which costs money and can be lost or stolen - is clearly not going to be the answer.

Multi-modal biometric authentication gets around the problem of relying on cards for initial identification. Rather than rely on one biometric, multiple measurements reduce the chances of false results. While this does increase costs as well as enrolment and authentication times, it can prove effective if backed by sufficient processing power. The US border authorities, for example, use both fingerprint and face recognition to screen immigrants against watch lists and their own databases, which contain more than 50 million records.

The business case
Despite the growing interest in biometrics, many remain sceptical. Colin Robbins, head of technology consulting at Insight Consulting says the business case for corporate-wide adoption of biometrics is often difficult to make. “It's hard enough to justify the costs for smartcards. It seems like fantastic technology, but the real business benefit isn't there yet.”

Ken Munro, MD of SecureTest, agrees: “If you have an ID and password system that's done properly, there's no need for biometrics.” He advises that biometrics would be best used on mobile devices. “If someone's using a BlackBerry on your train, they'll have entered their PIN so many times that by the end of the journey, you'll know it too,” he says. But, he adds, IT departments often deploy biometrics because “spending money on kit is easier, even though educating the workforce in how to use IDs and passwords is a better use of that money.”

There is also the possibility of resistance by staff or consumers. Although most systems only store a biometric “template” rather than the actual fingerprint, iris scan or other data, there are still understandable concerns about privacy.

Page 1 | Page 2 | Page 3 | Page 4 | All 4 Pages