Biometrics Security System

A SEMINAR REPORT ON ‘BIOMETRIC SECURITY SYSTEM’ SUBMITTED TO RAJASTHAN TECHNICAL UNIVERSITY (IN PARTIAL FULFILLMENT FOR THE AWARD OF THE DEGREE) OF BACHELOR OF TECHNOLOGY IN INFORMATION TECHNOLOGY

SESSION 2009-2010

Submitted By: GAZAL GUPTA B.Tech. IV YEAR ROLL NO: - 06EJGIT020

Guided By:Mr.Surendra Yadav (H.O.D)

JAGANNATH GUPTA INSTITUTE OF ENGINEERING & TECHNOLOGY JAIPUR 1

PREFACE

The objective of the seminar engineering is to learn something from practical concepts. Engineering is not only a theoretical study but it is a implementation of all we study for creating something new and making things more easy and useful through practical study. It is an art, which can be gained with systematic study, observation and practice. In the college circulation we usually get the theoretical knowledge to increase the productivity or efficiency of the industry. The Report describe about my detailed analysis on the requirement of biometric, detail analysis of face detection & finger print recognition ,biometric applications, combination of biometric with smart cards which can a very useful step in the security of the transaction taken today’s life software and the future use of biometric security systems

2

ACKNOWLEDGEMENT

Firstly I would like to express my sincere gratitude to the Almighty for His solemn presence throughout the seminar study. I would also like to express my special thanks to the Surendra Yadav (H.O.D.) for providing an opportunity to undertake this seminar. I am deeply indebted to our seminar coordinator Mrs. Shipra Choudhary, Lecturer in the Department of Information Technology and Engineering for providing me with valuable advice and guidance during the course of the study. I would like to extend my heartfelt gratitude to the Faculty of the Department of Information Technology and Engineering for their constructive support and cooperation at each and every juncture of the seminar study. Finally I would like to express my gratitude to Jaganath Gupta Institute of Engineering and Technology for providing me with all the required facilities without which the seminar study would not have been possible.

Gazal Gupta VIII SEM 06EJGIT020 Information Technology.

3

BIOMETRICS SECURITY SYSTEM TABLE OF CONTENTS Page No.

1.

2.

ABSTRACT

4

BIOMETRICS -AN INTODUCTION

5

1.1

INTRODUCTION

5

1.2

DEFINITIONS OF BIOMETRIC

6

1.3

WHAT IS A BIOMETRIC?

6

BIOMETRIC TECHNOLOGY

8

2.1

10

THE BIOMETRIC MODEL

3.

BIOMETRIC TYPES

12

4.

DETAIL ANALYSIS OF BIOMETRIC SECURITY

16

SYSTEM USING FACE DETECTION

5.

4.1

DEFINITION & RELATION

16

4.2

AS A PATTERN

16

4.3

APPLICATION

17

4.4

IMPLEMENTATION OF TRACK EYE

19

4.5

CONTINUOSLY ADAPTIVE MEAN SHIFT ALGORITHM

20

4.6

HAAR FACE DETECTION METHOD

21

DETAIL ANALYSIS OF BIOMETRIC SECURITY SYSTEM USING FACE DETECTION 4

22

6.

7.

5.1

FEATURE OF FINGERPRINT

23

5.2

HOW DOES FINGERPRINT IDENTIFICATION WORKS

24

5.3

COMPONENTS OF A FINGERPRINT SYSTEM

25

5.4

FINGERPRINT CAPTURE & DETECTION

27

5.5

METHOD OF FINGERPRINT DETECTION

28

5.6

CLASSIFYING FINFERPRINTS

29

SELECTING BIOMETRIC TECHNOLOGY

31

6.1

EASE OF USE

32

6.2

ACCURACY

33

6.3

COST

BIOMETRIC APPLICATIONS

36

7.1 INDIAN INITIATIVES 7.2 GLOBAL DEVELOPMENTS 8

COMBINING BIOMETRIC WITH SMART CARD 8.1 ENHANCED PRIVACY

38

8.2 PERSONAL DATABASE 8.3 PERSONAL FIREWALL 8.4 ENHANCED SECURITY 9.

THE FUTURE OF BIOMETRICS

41

10.

CONCLUSION

43

11.

BIBLIOGRAPHY

44

5

ABSTRACT With the increasing use of electronics and electronic commerce in our day-to-day lives, the importance of fraud-proof identification and recognition systems for use in security applications has grown .The improved understanding of biological systems and the ability to model them using computer algorithms has led to utilization of biometrics in authentication systems. Voice, Iris, Face, Signature, Hand Geometry are the biometrics that have been studied and applied to various kinds of identification and authentication systems. Biometrics is a means of using parts of the human body as a kind of permanent password. Technology has advanced to the point where computer systems can record and recognize the patterns, hand shapes, ear lobe contours, and a host of other physical characteristics. Using this biometrics, laptop and other portable devices can be empowered with the ability to instantly verify your identity and deny access to everybody else.

6

CHAPTER 1 BIOMETRICS - AN INTRODUCTION 1.1 INTRODUCTION Biometrics is a rapidly evolving technology that facilitates the automatic identification of an individual based on his or her physiological or behavioral characteristics. These characteristics are referred to as biometric identifiers and are unique to each and every one of us. Physiological or physical identifiers do not change overtime and include a person’s fingerprint, facial features, iris, and retina patterns, along with geometric shape of your hand. Behavioral identifiers do change over time or with mood and include a person’s voice, signature and the way one types at keyboard.

As networking grows, so does the number of electronic transactions used for both conducting business and gathering information. This fact has led to realization that the traditional methods involving passwords and pin numbers used to gain entry in these networks, no longer provides adequate security against unauthorized access to sensitive and / or personal data.

Users PIN and passwords can be forgotten and token-based ids such as smart cards, employee badges, passports and drivers license can be lost, stolen or forged. Biometric identification systems provide a solution to these problems, since they require the user to be physically present at the point of identification and unique biometric identifiers are based on who you are, as opposed to what you know or have in your possession. 7

1.2 DEFINITIONS OF BIOMETRIC 1. Biometrics refers to the method of automatically identifying or verifying identity based upon behavioral or physical traits. It is the science and technology of measuring and statistically analyzing biological data, data that is represented in humans by patterns unique to every individual. [1] 2. Biometrics identification technologies that measure the human body. Biometrics include finger scan (finger print), Iris scan, retina scan, voice verification, hand geometry and signature verification. [2] 3. Biometrics identification devices rely on unique physical characteristics, such as fingerprints, hand shape, or facial appearance to screen and verified individual’s authority for access and other kind of transactions. [3]

4. Biometrics is a science of measuring the unique physical characteristics of a person such as voice, a face or a fingerprint. These personal features are analyzed and stored as bioprints in a reference database, on a smart card or an embedded chip. They are used to verify the identity of the person by comparing them to the previously stored bioprints. [4] 1.3 WHAT IS A BIOMETRIC? The security field uses three different types of authentication: -Something you know—a password, PIN, or piece of information -Something you have—a card key, smart card, or token -Something you are—a biometric. 8

Of these, a biometric is the most secure and convenient authentication tool. It can't be borrowed, stolen, or forgotten, and forging one is practically impossible.

Biometrics

measure

individual’s

unique

physical

or

behavioral

characteristics to recognize or authenticate their identity. Common physical biometrics include fingerprints; hand or palm geometry; and retina, iris, or facial characteristics. Behavioral characters include signature, voice, keystroke pattern, and gait. Of this class of biometrics, technologies for signature and voice are the most developed.

Figure 1 : Process involved in using a biometric system for security

Capture the chosen biometric; Process the biometric and enroll the biometric template; Store the template; Live-scan the chosen biometric; Process the biometric and extract the biometric template; Match the scanned biometric against stored templates; Provide a matching score to business applications; Record a secure audit trail with respect to system use.

9

CHAPTER 2 BIOMETRIC TECHNOLOGY 2.1 THE BIOMETRIC MODEL

DATA COLLECTION

SIGNAL

DECISION

PROCESSING BIOMETRICS

DECISION PATTERN MATCHING

PRESENTATION

DATA STORAGE SENSOR

QUALITY CONTROL FEATURE EXTRACTION

DATABASE

SMARTCARD

TRANSMISSION IMAGE STORAGE COMPRESSION

TRANSMISSION

EXPANSION

Figure 2 : The biometric model

A generic biometric model consists of five subsystems, namely data collection, transmission, signal processing, decision-making, and data storage.

Data collection involves use of sensors to detect and measure individual’s physiological or behavioral characteristics. The measured biometric must be unique and repeatable over multiple measurements. 10

Biometric System Components and Process 2.1

Components Three major components are usually present in a biometric system:  A mechanism to scan and capture a digital or analog image of a living person’s biometric characteristic.  Software for storing, processing and comparing the image.  An interface with the applications system that will use the result to confirm an individual’s identity.

2.2 Process Two different stages are involved in the biometric system process – Enrollment and Verification.

2.2.1 Enrollment. As shown in Figure 3.1, the biometric image of the individual is captured during the enrollment process (e.g., using a sensor for fingerprint, microphone for voice verification, camera for face recognition, scanner for eye scan). The unique characteristics are then extracted from the biometric image to create the user’s biometric template. This biometric template is stored in a database or on a machine-readable ID card for later use during an identity verification process.

11

Figure 2.2 Schematic of an Enrollment Process

2.2.2 Verification.

Figure 3.2 illustrates the identity verification process. The biometric image is again captured. The unique characteristics are extracted from the biometric image to create the users “live” biometric template. This new template is then compared with the template previously stored and a numeric matching score is generated, based on the percentage of duplication between the live and stored template. System designers determine the threshold value for this identity verification score based upon the security requirements of the system.

Figure 3.2 Schematic of a verification process 12

Secure identification systems use biometrics for two basic purposes: to identify or authenticate individuals. Identification (1-to-many comparison) verifies if the individual exists within a known population. Identification confirms that the individual is not enrolled with another identity and is not on a predetermined list of prohibited persons. Identification will typically need a secured database containing a list of all applying individuals and their biometrics. The biometric for the individual being considered for enrollment would be compared against all stored biometrics. For many applications, an identification process is used only at the time of enrollment to verify that the individual is not already enrolled.

Authentication (1-to-1 comparison) confirms that the credential belongs to the individual presenting it. In this case, the device that performs the authentication must have access only to the individual’s enrolled biometric template, which may be stored locally or centrally.

13

CHAPTER 3 BIOMETRIC TYPES 1. Fingerprint Verification There is variety of approaches to fingerprint verification. Some of them try to emulate the traditional police method of matching minutiae, others are straight pattern matching devices, and some adopt a unique approach all of their own, including moiré Fringe patterns and ultrasonic. Some of them can detect when a live finger is presented, some cannot. There is a greater variety of fingerprint devices available than any other biometric at present.

Figure 3: Verification by finger scanning and its comparison with database

Potentially capable of good accuracy, fingerprint devices can also suffer from usage errors among insufficiently disciplined users such as might be the case with large user bases. One must also consider the transducer user interface and how this would be affected by large scale usage in a variety of environments. Fingerprint verification may be a good choice for in house systems where adequate explanation and training can be provided to users and where the system is operated within a controlled environment. It is not 14

surprising that the workstation access application area seems to be based almost exclusively around fingerprints, due to the relatively low cost, small size (easily integrated into keyboards) and ease of integration.

2. Voice Verification [5] Voice authentication is not based on voice recognition but on voice-toprint authentication, where complex technology transforms voice into text. Voice biometrics has the most potential for growth, because it requires no new hardware—most PCs already contain a microphone. However, poor quality and ambient noise can affect verification. In addition, the enrollment procedure has often been more complicated than with other biometrics, leading to the perception that voice verification is not user friendly. Therefore, voice authentication software needs improvement. One day, voice may become an additive technology to finger-scan technology. Because many people see finger scanning as a higher authentication form, voice biometrics will most likely be relegated to replacing or enhancing PINs, passwords, or account names. 3. Retinal Scanning An established technology where the unique patterns of the retina are scanned by a low intensity light source via an optical coupler. Retinal scanning has proved to be quite accurate in use but does require the user to look into a receptacle and focus on a live of the eye related biometrics. It utilizes a fairly conventional ccd camera element and requires no intimate contact between user and reader. In addition it has the potential for higher than average template matching performance. It has been demonstrated to work with spectacles in place and with a variety of ethnic groups and is one 15

of the few devices, which can work well in identification mode. Ease of use and system integration have not traditionally been strong points with the iris scanning devices, but we can expect to see improvements in these areas as new products are introduced.

4. Signature Verification Signature verification analyzes the way a user signs his/her name. Signing features such as speed, velocity, and pressure are as important as the finished signature's static shape. Signature verification enjoys a synergy with existing processes that other biometrics do not. People are used to signatures as a means of transaction-related identity verification, and most would see nothing unusual in extending this to encompass biometrics. Signature verification devices are reasonably accurate in operation and obviously lend themselves to applications where a signature is an accepted identifier. Surprisingly, relatively few significant signature applications have emerged compared with other biometric methodologies. But if your application fits, it is a technology worth considering.

5. Facial Recognition Face recognition analyzes facial characteristics. It requires a digital camera to develop a facial image of the user for authentication. This technique has attracted considerable interest, although many people don't completely understand its capabilities. Some vendors have made extravagant claims—which are very difficult, if not impossible, to substantiate in practice—for facial recognition devices. Because facial scanning needs an extra peripheral not customarily included with basic PCs, it is more of a niche market for network authentication. However, the casino industry has 16

capitalized on this technology to create a facial database of scam artists for quick detection by security personnel.

6. Hand Geometry Hand geometry involves analyzing and measuring the shape of the hand. These biometric offers a good balance of performance characteristics and are relatively easy to use. It might be suitable where there are more users or where users access the system infrequently and are perhaps less disciplined in their approach to the system.

Accuracy can be very high if desired and flexible performance tuning and configuration can accommodate a wide range of applications. Organizations are using hand geometry readers in various scenarios, including time and attendance recording. Ease of integration into other systems and processes, coupled with ease of use, and makes hand geometry an obvious first step for many biometric projects.

7. Software Analysis Smart protector allows software products to be simply and effectively protective against piracy. Part of application code, completely developed in VB 6.0 is recompiled and transferred at run time executed into a smart card where, due to physical protection, it is in accessible .Smart protector makes it possible also for developers who are not expert of smart card technology to set up, in a very short time, protected and non duplicable software applications.

17

CHAPTER 4 DETAIL ANALYSIS OF BIOMETRIC SECURITY SYSTEM USING FACE DETECTION

Face detection is a computer technology that determines the locations and sizes of human faces in arbitrary (digital) images. It detects facial features and ignores anything else, such as buildings, trees and bodies. 4.1 Definition and relation to other tasks:Face detection can be regarded as a specific case of object-class detection; In object-class detection, the task is to find the locations and sizes of all objects in an image that belong to a given class. Examples include upper torsos, pedestrians, and cars. Face detection can be regarded as a more general case of face localization; In face localization, the task is to find the locations and sizes of a known number of faces (usually one). In face detection, one does not have this additional information. Early face-detection algorithms focused on the detection of frontal human faces, whereas newer algorithms attempt to solve the more general and difficult problem of multi-view face detection. That is, the detection of faces that are either rotated along the axis from the face to the observer (in-plane rotation), or rotated along the vertical or left-right axis (out-of-plane rotation), or both. 4.2 Face detection as a pattern-classification task:Many algorithms implement the face-detection task as a binary pattern classification task. That is, the content of a given part of an image is transformed into features, after which a classifier trained on example faces decides whether that particular region of the image is a face, or not. 18

Often, a window-sliding technique is employed. That is, the classifier is used to classify the (usually square or rectangular) portions of an image, at all locations and scales, as either faces or non-faces (background pattern). 4.3 Applications:Face detection is used in biometrics, often as a part of (or together with) a facial recognition system. It is also used in video surveillance, human computer interface and image database management. Some recent digital cameras use face detection for autofocus. Also, face detection is useful for selecting regions of interest in photo slideshows that use a pan-and-scale ken burns effect so

4.4Implementation of Track Eye:The implemented project is on three components: 1. Face detection: Performs scale invariant face detection 2. Eye detection: Both eyes are detected as a result of this step 19

3. Eye feature extraction: Features of eyes are extracted at the end of this step

4.5 Face Detection:Two different methods were implemented in the project. They are: 1. Continuously Adaptive Means-Shift Algorithm 2. Haar Face Detection method 4.6 Continuously Adaptive Mean-Shift Algorithm:Adaptive Mean Shift algorithm is used for tracking human faces and is based on robust non-parametric technique for climbing density gradients to find the mode (peak) of probability distributions called the mean shift algorithm. As faces are tracked in video sequences, mean shift algorithm is modified to deal with the problem of dynamically changing color probability distributions. The block diagram of the algorithm is given below:

20

CHAPTER 5 DETAIL ANALYSIS OF BIOMETRIC SECURITY SYSTEM USING FINGERPRINT RECOGNITION Fingerprints are a distinctive feature and remain invariant over the lifetime of a subject, except for cuts and bruises. As the first step in the authentication process, a fingerprint impression is acquired, typically using an inkless scanner. Several such scanning technologies are available. Figure 5A shows a fingerprint obtained with a scanner using an optical sensor. A typical scanner digitizes the fingerprint impression at 500 dots per inch (dpi) with 256 gray levels per pixel. The digital image of the fingerprint includes several unique features in terms of ridge bifurcations and ridge endings, collectively referred to as minutiae.

The operational issues in an automated fingerprint identification system (AFIS) are somewhat different from those in a more traditional passwordbased system. First, there is a system performance issue known as the “fail to enroll” rate to be considered. Some people have very faint fingerprints, or no fingers at all, which makes the system unusable for them. A related issue is a “Reject” option in the system based on input image quality. A poor quality input is not accepted by the system during enrollment and authentication. Note that non-cooperative users, improper usage, dirt on the finger can cause poor quality inputs, or bad input scanners. This has no analog in a password system. Then there is the fact that in a biometric system the matching decision is not clear-cut. A password system always provides a correct response—if the passwords match, it grants access but otherwise refuses access. However, in a biometric system, the overall accuracy depends on the

21

quality of input and enrollment data along with the basic characteristics of the underlying feature extraction and matching algorithm.

5.1

FEATURES OF A FINGERPRINT

A fingerprint is composed of valley and ridge lines. They follow a pattern. The general shape of this pattern may be classified according to 5 classes. The second sets of features of a fingerprint are cores and deltas. The core is located by a square while the delta is located by a triangle as shown in figure 5.2.

Figure 5.2 shows core by squares and delta by a triangle

The AFIS allows a classification using more than one criterion versus a search based only on a single fingerprint pattern, reducing the number of fingerprints inspected. The pattern classification divides all fingerprint templates into five sets. Interestingly, the distribution of fingerprints in these 5 classes is not homogeneous among all people: 22

 Left loop class represents 34% of the total Number of fingerprints  Right loop class represents 31% of the total Number of fingerprints  Whorl class represents 27 % of the total number Of fingerprints  Arch class represents 4% of the total number Of fingerprints

Figure 5.3 Fingers can then be sorted in the pattern classifications after computing the core and the delta:  Tented arch class represents 3% of the total Number of fingerprints  Less than 1% for unusable fingerprints (scar, Illness of the skin, etc)

5.2

HOW DOES FINGERPRINT IDENTIFICATION WORK?

The first step in fingerprint identification is collecting the fingerprint, named enrollment. In this step, the applicant acquires the reference fingerprint for later authentication. The reference fingerprint is called the template of the fingerprint. 23

Most often in order to ensure that a good template is obtained, the fingerprint needs to be captured more than once. Twice is most common but at times an additional capture may be requested. After the capture of the template, it can be stored in a database, on a token with 2D barcode, or in a smart card.

At this point, the applicant is registered and the next stage is to compare the fingerprint with the template to the fingerprint read by the sensor. After reading the fingerprint, the authentication system extracts the minutiae in the same way as it did during the enrollment process. Since the fingerprint is never captured in the same position, the verification algorithm must perform rotation and translation of the captured fingerprint in order to adjust the fingerprint minutiae with the template minutiae.

The matching process calculates a score of the probability of a successful fingerprint read. Once every minutia is processed, a total score is computed and compared to a threshold score, which leads to the decision of a fingerprint ‘hit’ or ‘no hit’.

5.3

Components of a Fingerprint System

There are two ways a matching algorithm can be implemented, using either identification matching or authentication matching. In identification matching, one fingerprint is compared to many fingerprints using an Automated Fingerprint Identification System (AFIS) that is comprised of several computers and a database storage system. In authentication matching, where there is a “one to one” fingerprint comparison, there needs

24

to be only one fingerprint terminal and a token loaded that contains the fingerprint template. The matching could be done on token, in the terminal Or in both the terminal and token.

5.3.1 The Sensors

Electronic fingerprint sensors are manufactured in different ways using capacitive, optical, thermal, or pressure sensitive (resistive) technology. These different types of sensors are able to produce an image of the fingerprint when the ridge is darker than the valley. The most common sensors currently on the market are capacitive and optical sensors. Optical sensors provide the best image quality but are expensive and can be fooled by some fake fingers. Sensors based on capacitive technology provide a balance of image quality and cost although, some fake fingers can also fool this technology. However, the most common fake fingers made of silicon cannot fool a capacitive sensor because the fake finger does not possess electrical properties.

25

Figure 5.4 Components of a fingerprint system 26

5.4 Fingerprint capture and detection:1. Live scan devices

A fingerprint scanner

Fingerprint being scanned

Fingerprint image acquisition is considered the most critical step of an automated fingerprint authentication system, as it determines the final fingerprint image quality, which has drastic effects on the overall system performance. There are different types of fingerprint readers on the market, but the basic idea behind each capture approach is to measure in some way the physical difference between ridges and valleys. All the proposed methods can be grouped in two major families: solid-state fingerprint readers and optical fingerprint readers. The procedure for capturing a fingerprint using a sensor consists of rolling or touching with the finger onto a sensing area, which according to the physical principle in use (capacitive, optical, thermal, acoustic, etc.) captures the difference between valleys and ridges. When a finger touches or rolls onto a surface, the elastic skin deforms. The quantity and direction of the pressure applied by the user, the skin conditions and the projection of an irregular 3D object (the finger) onto a 2D flat plane introduce distortions, noise and inconsistencies in the captured fingerprint 27

image. These problems result in inconsistent, irreproducible and nonuniform contacts] and, during each acquisition, their effects on the same fingerprint results are different and uncontrollable. The representation of the same fingerprint changes every time the finger is placed on the sensor plate, increasing the complexity of the fingerprint matching, impairing the system performance, and consequently limiting the widespread use of this biometric technology.

3D fingerprint In order to overcome these problems, lately, non-contact (or touch less) 3D fingerprint scanners have been developed. Employing the detailed 3D information, 3D fingerprint scan acquisition provides a digital analogy to this cumbersome analog process of pressing or rolling the finger. By controlling the distance between neighboring points, the resolution is scaled to 500/1000 PPI 5.5 Methods of fingerprint detection Since the late nineteenth century, fingerprint identification methods have been used by police agencies around the world to identify both suspected criminals as well as the victims of crime. The basis of the traditional fingerprinting technique is simple. The skin on the palmar surface of the hands and feet forms ridges, so-called papillary ridges, in patterns that are unique to each individual and which do not change over time. Even identical 28

twins (who share their DNA) do not have identical fingerprints. Fingerprints on surfaces may be described as patent or latent. Patent fingerprints are left when a substance (such as paint, oil or blood) is transferred from the finger to a surface and are easily photographed without further processing. Latent fingerprints, in contrast, occur when the natural secretions of the skin are deposited on a surface through fingertip contact, and are usually not readily visible. The best way to render latent fingerprints visible, so that they can be photographed, is complex and depends, for example, on the type of surface involved. It is generally necessary to use a ‘developer’, usually a powder or chemical reagent, to produce a high degree of visual contrast between the ridge patterns and the surface on which the fingerprint was left. Developing agents depend on the presence of organic materials or inorganic salts for their effectiveness although the water deposited may also take a key role. Fingerprints are typically formed from the aqueous based secretions of the eccrine glands of the fingers and palms with additional material from sebaceous glands primarily from the forehead. The latter contamination results from the common human behaviors of touching the face and hair. The resulting latent fingerprints consist usually of a substantial proportion of water with small traces of amino acids, chlorides, etc., mixed with a fatty, sebaceous component which contains a number of fatty acids, triglycerides, etc. Detection of the small proportion of reactive organic material such as urea and amino acids is far from easy. Crime scene fingerprints may be detected by simple powders, or some chemicals applied at the crime scene; or more complex, usually chemical techniques applied in specialist laboratories to appropriate articles removed from the crime scene. With advances in these more sophisticated techniques some of the more advanced crime scene investigation services from around the world are now reporting that 50% or more of the total crime scene fingerprints

29

5.6 Classifying fingerprints Before computerization replaced manual filing systems in large fingerprint operations, manual fingerprint classification systems were used to categorize fingerprints based on general ridge formations (such as the presence or absence of circular patterns in various fingers), thus permitting filing and retrieval of paper records in large collections based on friction ridge patterns independent of name, birth date and other biographic data that persons may misrepresent. In the Henry system of classification, there are three basic fingerprint patterns: Loop, Whorl and Arch. They constitute 60-70, 25-35 and 5 percent of all fingerprints, respectively. There are also more complex classification systems that further break down patterns to plain arches or tented arches. Loops may be radial or ulnar, depending on the side of the hand the tail points towards. Whorls also have sub-group classifications including plain whorls, accidental whorls, double loop whorls, peacock's eye, composite, and central pocket loop whorls.

Loop (Right Loop)

Arch

Arch (Tented Arch)

Whorl 30

CHAPTER 6 SELECTING BIOMETRIC TECHNOLOGY

Biometric technology is one area that no segment of the IT industry can afford to ignore. Biometrics provides security benefits across the spectrum, from IT vendors to end users, and from security system developers to security system users. Different technologies may be appropriate for different applications, depending on perceived user profiles, the need to interface with other systems or databases, environmental conditions, and a host of other application-specific parameters.

Table 1: Comparison of biometrics [2]

Hand Characteristic Fingerprints Geometr Retina Iris y Ease of Use

High

Error incidence

Dryness, dirt, age

Accuracy

High

Cost User acceptance

* Medium

Face

Mediu m Lightin Hand Poor g, age, injury, Glasses Lighting glasses, age hair Very Very High High High High * * * * Mediu Mediu Medium Medium m m High

Low

Medium

Signature Voice High

High

Noise, Changing colds, signature weath s er High

High

*

*

Medium High

Required High security level

Medium High

Very High

Mediu Mediu Medium m m

Long-term stability

Medium High

High

Mediu Mediu Medium m m

High

*The large number of factors involved makes a simple cost comparison impractical. 31

6.1 EASE OF USE Some biometric devices are not user friendly. For example, users without proper training may experience difficulty aligning their head with a device for enrolling and matching facial templates. 6.2 ACCURACY Vendors often use two different methods to rate biometric accuracy: falseacceptance rate or false-rejection rate. Both methods focus on the system's ability to allow limited entry to authorized users. However, these measures can vary significantly, depending on how you adjust the sensitivity of the mechanism that matches the biometric. For example, you can require a tighter match between the measurements of hand geometry and the user's template. This will probably decrease the false-acceptance rate, but at the same time can increase the false-rejection rate. So be careful to understand how vendors arrive at quoted values of FAR and FRR.

False accept rates (FAR) indicate the likelihood that an impostor may be falsely accepted by the system.

False reject rates (FRR) indicate the likelihood that the genuine user may be rejected by the system.

Because FAR and FRR are interdependent, it is more meaningful to plot them against each other, as shown in figure. Each point on the plot represents a hypothetical system's performance at various sensitivity settings. With such a

32

Plot, you can compare these rates to determine the crossover error rate. The lower the CER, the more accurate the system.

Figure 9: Crossover error rate attempts to combine two measures of biometric accuracy

Generally, physical biometrics is more accurate than behavioral biometrics.

6.3 COST

Cost components include:Biometric capture hardware Back-end processing power to maintain the database Research and testing of the biometric system Installation, including implementation team salaries Mounting, installation, connection, and user system integration costs User education, often conducted through marketing campaigns

33

CHAPTER 7 BIOMETRICS APPLICATIONS

7.1 INDIAN INITIATIVES

Bioenable Technology, Pune, is a software company that develops biometric products to cater to tough Indian working conditions and environments. The firm has developed intelligent biometric solutions for physical access control, banking transaction, timing, and attendance applications.

Siemens Information System Limited (SISL), Bangalore, has developed a text-independent autonomous speech recognition system to identify and authorize a speaker by analyzing his voice. Central forensic laboratories, Chandigarh, use this system to track down and identify criminals by comparing their voice samples using SISL software. Other innovations of SISL include fingerprint identification and management system (FIMs), language-independent speech recognition system, and optical character recognition system.

Axis Software, Pune, deals in fingerprint, iris and face recognition technology and is planning to add voice recognition technology to its range of voice authentication products and systems. The axis system stores biometric records in an encrypted template in digital form. The record by itself is of no use to a stealer and cannot be reconstructed to reveal a persons identity to someone else.

34

Jaypeetex, Mumbai, has introduced biometric technologies for security, access control, timing, and attendance applications.

Biometric society of India (INBIOS), affiliated to international society of computational biology (ISCB), provides innovative professional solutions and services dedicated to bioinformatics.

7.2 GLOBAL DEVELOPMENTS Internet security: Litronix, USA, a leading provider of public key infrastructure (PKI) based internet security solutions, has developed biometric identification techniques for use in electronic data applications such as digital network and smart cards. The smart card, integrating voice and handwritten functions, incorporates the appropriate biometric template to deliver the final match and authorization. The company plans to incorporate capture, manipulation, enrollment and extraction features in smart card reader also.

Windows Biometrics: Microsoft has announced plans to integrate biometric authentication technology in future versions of its windows operating systems. For this it has acquired I/O software Inc.s biometric API technology (BAPI) and secures suites core authentication technology. The software will enable windows users to log on and conduct secure ecommerce transactions using a combination of fingerprint, iris pattern, and voice recognition instead of password.

Net Nanny Software International has developed biometric software to provide extra security to Windows NT networks. The biopassword log on 35

feature for Windows NT will back client/server biometrics application to recognize a users typing pattern and use it to authenticate the user to the network. The software uses a mathematical algorithm to record pressure, speed, and rhythm as a user name and password.

Biometric smart cards: Polaroid and Atmel have developed secure identity cards that merge ultra-secure smart cards, fingerprint verification, biometric identification, and digital imaging. These cards will be used in ecommerce, online, remote access, and any it environment where authentication is required.

Biometrics cellular: fujistu microelectronics has developed an innovative fingerprint identification system that combines sweep sensor technology with advanced algorithms to provide a powerful, dependable, easy to use authentication for vices. A single fingerprint sweep across the sensor captures features to rapidly authenticate users of cell phones and PDAs.

36

CHAPTER 8 COMBINING BIOMETRICS WITH SMART CARDS

Smart cards are widely acknowledged as one of the most secure and reliable forms of electronic identification. To provide the highest degree of confidence in identity verification, biometric technology is considered to be essential in a secure identification system design. This section summarizes the key benefits of a secure ID system that combines smart cards and biometrics. 8.1

Enhanced Privacy Using smart cards significantly enhances privacy in biometric ID

systems. The smart card provides the individual with a personal database, a personal firewall and a personal terminal. It secures personal information on the card, allowing the individual to control access to that information and removing the need for central database access during identity verification. 8.2 A Personal Database. How and where an ID system keeps personal information about its members is an important privacy consideration, affecting a system’s real and perceived privacy behavior. Most ID systems store personal information for all system members in a central database. This centralization leads many to be concerned that their personal information is less protected, or at a minimum, more vulnerable to compromise. Smart cards store and safeguard personal information on the individual’s card. The use of smart card IDs can promote confidence in an ID system by offering each member a unique secure, portable and personal database, separating their information from other members’ data. With a smart card ID 37

the cardholder maintains physical possession of private information. This enhances the trust relationship with the system, as the cardholder now shares in the decision of who is allowed to use their personal information for identity verification and in the responsibility to protect it. The smart card personal database is portable and can be used in a variety of devices and networks. An ID system can take advantage of this portability by using closed local networks or standalone devices to carry out different identification tasks, rather than relying on a centralized system. By enabling local identity verification, smart card based secure ID systems can help alleviate concerns that the system is centrally tracking ID older activities. Unlike other ID card technologies that act as simple data containers, smart cards are unique in acting more like data servers, where data is not directly accessed but must be requested from the server (in this case the smart card’s microprocessor). When used in combination with biometrics, a smart card ID becomes even more personal and private. A biometric provides a strong and unique binding between the cardholder and the personal database on the card, identifying the cardholder as the rightful owner of this card. The biometric cannot be borrowed, lost, or stolen like a PIN or password, and so strengthens the authentication of an individual’s identity.

8.3 A Personal Firewall. In smart card based ID systems, the card is not just a data repository but also an intelligent guardian — a personal firewall — for the cardholder’s information. When information is requested from the ID card, a smart card can verify that the requestor is authorized to perform such an inquiry. A smart card ID also has the ability to behave differently based who is checking the ID. For example, most individuals will cooperate with a 38

uniformed officer who requests to see an ID. But is this officer a valid officer? And what portion of the personal information is he or she authorized to see? With a smart card ID, the card would authenticate the officer through a portable card reader and release only the information that is relevant to the officer’s responsibilities. The same ID card could be used to prove legal age when purchasing from a bar. In this case, the smart card ID would just confirm age, but not divulge any other personal information. Once personal information is released, it is very hard to control what happens to the information, including how it might be used. It is an important privacy consideration for individuals to clearly understand when and to whom personal information is released by an ID system. The release of personal information is hard to control when carried out by a centralized database somewhere on a network, without the information owner’s knowledge or consent. A smart card based ID system gives the cardholder control over who can access personal information stored on the card. A biometric further enhances this control, ensuring that only the rightful cardholder can authorize access to personal information.

8.4

Enhanced Security Biometric technologies are used with smart cards for ID system

applications specifically due to their ability to identify people with minimal ambiguity. A biometric based ID allows for the verification of “who you claim to be”(information about the cardholder printed or stored in the card) based on “who you are” (the biometric information stored in the smart card), instead of, or possibly in addition to, checking “what you know” (such as a PIN). As shown in Figure 10.1, this increases the security of the overall ID system and improves the accuracy, speed, and control of cardholder authentication. 39

Figure 10.1 Impacts of Smart Cards and Biometrics on Security

As the importance of accurate identification grows, new technologies are being added to ID systems to improve their security.

40

CHAPTER 9 THE FUTURE OF BIOMETRICS There are many views concerning potential biometric applications, some popular examples: ATM machine use:

Most of the leading banks have been experimenting with biometrics for ATM machine use and as a general means of combating card fraud. Surprisingly, these experiments have rarely consisted of carefully integrated devices into a common process, as could easily be achieved with certain biometric devices. Previous comments in this paper concerning user psychology come to mind here and one wonders why we have not seen a more professional and carefully considered implementation from this sector. The banks will of course have a view concerning the level of fraud and the cost of combating it via a technology solution such as biometrics. They will also express concern about potentially alienating customers with such an approach. However, it still surprises many in the biometric industry that the banks and financial institutions have so far failed to embrace this technology with any enthusiasm.

Travel and tourism :

There are many in this industry who have the vision of a multi application card for travelers which, incorporating a biometric, would enable them to participate in various frequent flyer and border control systems as well as paying for their air ticket, hotel room, hire care etc., all with one 41

convenient token.

Technically this is eminently possible, but from a political and commercial point of view there are still many issues to resolve, not the least being who would own the card, be responsible for administration and so on. These may not be insurmountable problems and perhaps we may see something along these lines emerge. A notable challenge in this respect would be packaging such an initiative in a way that would be truly attractive for users.

Public identity cards :

A biometric incorporated into a multi purpose public ID card would be useful in a number of scenarios if one could win public support for such a scheme. Unfortunately, in this country as in others there are huge numbers of individuals who definitely do not want to be identified. This ensures that any such proposal would quickly become a political hot potato and a nightmare for the minister concerned. You may consider this a shame or a good thing, depending on you point of view. From a dispassionate technology perspective it represents something of a lost opportunity, but this is of course nothing new. It’s interesting that certain local authorities in the UK have issued ‘citizen’ cards with which named cardholders can receive various benefits including discounts at local stores and on certain services. These do not seem to have been seriously challenged, even though they are in effect an ID card.

42

CHAPTER 10 CONCLUSION The ultimate form of electronic verification of a person’s identity is biometrics; using a physical attribute of the person to make a positive identification. People have always used the brain’s innate ability to recognize a familiar face and it has long been known that a person’s fingerprints can be used for identification. The challenge has been to turn these into electronic processes that are inexpensive and easy to use.

Banks and others who have tested biometric-based security on their clientele, however, say consumers overwhelmingly have a pragmatic response to the technology. Anything that saves the information-overloaded citizen from having to remember another password or personal identification number comes as a welcome respite.

Biometrics can address most of the security needs, but at what cost? Surprisingly, the benefits quickly outweigh the costs. As prices have come down, the interest level and the knowledge about how to effectively utilize these systems have increased. So the investment is decreasing and the recognizable benefits are increasing. Biometrics, when properly implemented, not only increase security but also often are easier to use and less costly to administer than the less secure alternatives. Biometrics can’t be forgotten or left at home and they don’t have to be changed periodically like passwords. 43

BIBLIOGRAPHY

[1] Biometrics: Journal of International Biometric Society [2] The Biometrics Consortium ……………..May 2002 [3] Electronics For You ……………………June 2002 [4] www.biometric.com [5] www.bioventric.com [6] http://homepage.ntlworld.com/avanti [7] http://www.ibia.org [8] http://www.wikipedia.org

44