Wednesday, October 15, 2008

Biometrics: What it Is and What it Isn't


Few emerging technologies have had such widespread implications or spurred such debate as biometrics. That's not too surprising actually, given that biometrics is so pertinent to an issue that's important to all of us in this digital age - security. But what exactly is it?
Generally speaking, biometrics is the science of determining the identity of a living person by analyzing one or more of his or her physiological characteristics. Given that so much of your physiology is completely unique to you, and assuming there is a 100 per cent accurate, quantifiable method of measuring or gauging one or more of your attributes, biometrics is theoretically the most convenient, most foolproof security technology available.
One of the oldest and most common forms of biometrics, digital fingerprinting, works thusly: You scan your print under a light source - either a laser or, much more commonly, an LED - and the information generated by that scan is then stored in a CCD (Charged Couple Device - the same thing found in digital cameras) or the less expensive CMOS (Complementary Metal Oxide Semiconductor).
For security reasons, the process does not save a photo or graphic image of the print itself. It instead utilizes a complex and closely guarded series of algorithms to convert the location, size, and shape of all your print's ridges and valleys and other particulars into digital (ones and zeroes) format. The resulting template is then compared with the templates generated in future scans to make a positive or negative identification. This is a routine common to most forms of biometrics.
But digital fingerprinting, like virtually all forms of biometrics to date, isn't completely failsafe. Fingerprints can be altered, either deliberately or accidentally. They tend to get dirty and sometimes worn, thereby impacting the appearance of the print. And the image of the print can change from instance to instance, depending on the level of pressure being exerted by the user when being measured.A far more serious problem is that of "spoofing." Spoofing is the practice of deliberately deceiving biometrics devices by utilizing counterfeit samples. In fingerprint scanning, reports of scanner-tricking "fake fingers" made of pliable substances such as gelatine, wax, or silicone have been rampant for quite some time.
Indeed, one of the most worrisome reports hails from a 2005 US Department of Defense-funded Clarkson University study that proved how easily some optical camera-based fingerprint scanning technologies are defeated. Researchers collected several fingers from cadavers and fashioned casts from live fingers using dental materials and Play-Doh. They tested in excess of sixty faked samples, and were ultimately rewarded with a 90 per cent false verification rate.
Yet it's these very issues - spoofing and erroneous results - that in many ways fuel the industry and keep biometrics researchers as busy as they are. One of the most topical "unspoofable" biometrics concepts in recent months is currently in development by Japanese researchers Masakatsu Nishigaki and Daisuke Arai at Shizuoka University, Japan. It's based on something called "saccades," the rapid, involuntary reflex movements of the human eyeball, and it may be just the ticket if the research team can unearth a pattern that consistently differentiates one person's saccades from another's.
Spoofable or unspoofable, biometrics is already commonplace in today's society, and the technology will be even more prevalent in the future. Facial scans, hand geometry scans, and voice authentication routines are just some of the methods currently in use. Apply for a driver's license in some parts of the world and you may need to submit to an eye or fingerprint scan. Passport Canada wants to introduce biometrics into passports, as do most credit card companies. Indeed, you may soon pay for retail purchases and conduct much of your interactive life with quick analyses of some portion of your physiology.

No comments: