Security – Biometric Technology

No two people are the same. With this in mind, researchers are developing methods that enable the unique characteristics of eyes, faces and voices to be converted into data keys that enhance security and convenience.

When Henri-Léon Scheffer killed a dental assistant in Paris in 1902 he made a mistake that no criminal before him had ever had to worry about: he left fingerprints on a pane of glass at the scene of the crime. Chief of police Alphonse Bertillon used dactyloscopy—a relatively new fingerprinting method at the time—to arrest Scheffer. This was one of the first triumphs of biometrics—the science of statistically analyzing living organisms.

A hundred years later, fingerprinting is not only a tool used for tracking down criminals, but also a key for gaining access to any number of systems. Biometrics offers an alternative to the ever-growing list of passwords and PIN codes that can be stolen, misused or simply forgotten. With biometrics, the user's body itself serves as an "open sesame" function. An example of this is the fingerprint sensor attached to the Siemens ID Mouse. The sensor is used as a means of granting access to the user's PC. About the size of a fingernail, the silicon sensor measures the direct current capacity—and thus the exact distance—between the surface of the chip and the finger at some 65,000 points. This generates a digital grayscale picture. Associated software determines the characteristic features of the finger lines (minutia) and compares them with the authorized user's previously stored data.

Over the past few years, biometric researchers have taken a very close look at human beings and have developed a series of recognition techniques. These techniques measure not only the physiological features of faces, irises or hands, for example, but also behavior-related characteristics such as handwriting or voice dynamics. "Siemens may not be active to the same extent in all fields, but as an integrator it can incorporate all biometries into applications," explains Dr. Wolfgang Küpper, head of Biometrics at Siemens Corporate Technology (CT) in Munich. The technique for fingerprint recognition described above was developed a few years ago at CT and is now being marketed by Infineon Technologies as a sensor solution. More recently, biometric experts at CT have turned their attention to speaker recognition (see article A Question of Identity). "The technology is ideal for telephone applications," says Küpper. "It eliminates the need for a biometric sensor and cuts costs."

But problems such as loud background noises can still pose problems. "In this area, we are benefiting from the latest developments in noise suppression," say Küpper. He points out that, for instance, "Microphone arrays and adaptive filtering techniques are being tested. Another key point is that we will be able to identify speakers definitively only when we know what they're actually saying."

Speaker recognition thus has a lot in common with automatic speech recognition, as the latter deals with things such as recognizing names from a cell phone's number directory. Here, two approaches are being pursued. One has the user choosing an expression that is long enough for authentication to take place. The other is to have a system that can ask the user to repeat certain words or random numbers, which makes the recognition procedure even more secure. The user's unique characteristics are then identified from the acoustic signal. Küpper prefers to use non-linear template matching as a means of comparing these characteristics with previously stored information. This procedure requires less memory and computing capacity than other processing models, making it particularly suitable for cell phones. Nevertheless, for the first generation of cell phones equipped with such a feature, the voice recognizer will be used more for fun and convenience than as a security device.

Different Strokes. While voice is the ideal tool for accessing cell phones, contracts and other written documents demand a very different vehicle. Here, the ideal biometric is the user's signature. But until recently, the only way to varify a signature was to take a close look at it—which doesn't exactly amount to much of a challenge for experienced forgers. Biometric processes, on the other hand, also take into account dynamic factors such as speed, acceleration, pressure and the places at which the pen is pressed down or lifted up. Graphic trays and displays can serve as sensors—and in the future we will even see special pens with contact sensors.

But the sensor is not the only decisive factor. "The recognition algorithm is just as important," says Küpper. Siemens has developed a "stroke-based" process for this. Here, stroke refers to a continuous signature produced without lifting the pen. The characteristics of the individual lines, such as their direction and the speed at which they're written, form an overall pattern that can be compared with that of the original signature, which can be securely stored on a chip card.

Siemens researchers have also been taking a hard look at face recognition. In the context of a European research project known as HISCORE, they have developed a camera system that can register faces three-dimensionally. The system projects a colorful pattern of lines onto the user's face. The forehead, eye sockets, nose and chin deform the color strips and produce a distinct characteristic pattern for each person. Three-dimensional information is contained in the deflections of the color pattern in a manner similar to the contours of a map. A video camera records the pattern and a computer then uses the color data to ascertain the features of the person in question and compare them with reference data. In doing so, standard procedures for 2D face recognition are linked with depth information. The advantage of 3D data is that it is not affected by variables such as light and the position of the head. This makes it a more robust method than its 2D counterpart, which is based on color or black-and-white images. Pilot projects that will demonstrate these advantages are being prepared.

Hands-on Experience. Compared to face recognition, recognizing hands is a piece of cake. A simple video camera with grayscale values is all that's needed to record characteristic features. Information such as contours and the length and thickness of fingers is then filtered out. Siemens CT has integrated such a process into a system for gesture recognition. This system identifies the user by means of a simple gesture. In the future, it may be possible to combine 3D face recognition with 3D hand-gesture recognition, resulting in systems with extremely high levels of reliability.

How biometric security works

In principle, a distinction is made between two types of security checks: verification and identification. A verification system examines the claimed identity of the user by comparing the information it records at that moment with previously stored reference data (which the user can carry on a chip card, for example). With identification systems, on the other hand, the biometric data acquired in a security check is compared with the reference data (usually stored centrally) of all previously registered users, and the best match is then determined.

Regardless of the method, however, the more secure a system is designed to be, the more likely it is that an authorized user will be rejected. This is referred to as the false rejection rate (FRR). Conversely, the more fault-tolerant a system is, the more likely it is that an unauthorized user will be accepted. This means that the false acceptance rate (FAR) is higher. Such fault rates cannot be calculated in theory, but instead need to be determined in the context of specific scenarios. FARs and FRRs are thus important parameters for measuring the performance of a biometric system.

It is very hard to carry out a genuine comparison of how different biometric systems perform, as there is no test standard at present. However, according to the German Parliament's Office of Technology Assessment, several national and international committees are in the process of "defining criteria for the evaluation of biometric systems in the future." Reliable evaluations based on reliable criteria are indispensable for those who use biometrics. Siemens considers itself to be well equipped in this regard, as biometrics expert Dr. Wolfgang Küpper explains: "Our experience in evaluating the most diverse biometries in various application scenarios means our customers can avoid costly investments in the wrong systems."