Benefits of Biometrics versus Traditional Authentication Methods
The most frequently used authentication technologies are passwords and PIN (Personal Identification Number). They secure access to personal computers (PCs), networks, and applications; control entry to secure areas of building; and authorize automatic teller machine (ATM) and debit transactions. Handheld tokens (such as cards and key fobs) have replaced passwords in some higher-security applications.
What benefits does biometrics provide compared to these authentication methods?
Increased Security
Biometrics can provide a greater degree of security than traditional authentication methods, meaning that resources are accessible only to authorized users and kept protected from unauthorized users. Passwords and PINs are easily guessed or compromised; tokens can be stolen. Many users select obvious words of numbers for passwords or PIN authentication, such that an unauthorized user may be able to break into an account with little effort.
By contrast, biometrics data cannot be guessedor stolen in the same fashion as a password or token. Although some biometric systems can be broken under certain conditions, today’s biometric systems are highly unlikely to be fooled by a picture of a face, an impression of fingerprint, or a recording of a voice.
Increased Convenience
As computer users are forced to manage more and more passwords, the likelihood of passwords being forgotten increases, unless users choose a universally password, reducing security further. Tokens and cards can be forgotten as well, though keeping them attached to keychains reduces the risk.
Biometrics offer much greater convenience than systems based on remembering multiple passwords or on keeping possession of an authentication token. For PC applications in which a user must access multiple resources, biometrics can greatly simplify the authentication process – the biometric replaces multiple passwords, in theory reducing the burden on both the user and the system administrator.
How Biometric Matching Works
· A user initially enrolls in biometric systems by providing biometric data, which is converted into a template.
· Templates are stored in biometric systems for the purpose of subsequent comparison.
· In order to be verified or identified after enrollment, the user provides biometric data, which is converted into a template.
· The verification template is compared with one or more enrollment templates.
· The result of a comparison between biometric templates is rendered as score or confidence level, which is compared to a threshold used for a specific technology, system, user or transaction.
· If the score exceeds the threshold, the comparison is a match, and that result is transmitted.
· If the score does not meet the threshold, the comparison is not a match and that result is transmitted.
Enrollment and Template Creation
The following are the key terms and process involved in enrollment and template creation:
Enrollment
The process by which a user’s biometric data is initially attained, assessed, processed and stored in the form of a template for ongoing use in a biometric system is called enrollment.Subsequent verification and identification attempts are conducted against the template(s) generated during enrollment. Quality enrollment is a critical factor in the long-term accuracy of biometrics systems. Low-quality enrollments may lead to high error rates, including false match rate and false non-match rate.
Presentation
After a user provides whatever personal information is required to begin enrollment, such as name or user ID, he or she presents biometric data. Presentation is the process by which a user provides biometric data to an acquisition device – the hardware used to collect biometric data. Depending on the biometric system, presentation may require looking in the direction of a camera, placing a finger on a platen. A user may also have to remove eyeglasses or remain still for a number of seconds in order to provide biometric data. Presentation of biometric data can take as little as one second or more than one minute. The manner in which a user presents biometric data to a system is also essential to long-term performance. Users must be cognizant of the manner in which they present biometric data in order to be verified and identified successfully.
Biometric data
The biometric data users provide is an unprocessed image or recording of a characteristic. This unprocessed data is also referred to as raw biometric data or as a biometric sample. Raw biometric data cannot be used to perform biometric matches. Instead, biometric data provided by the user during enrollment and verification is used to generate biometric templates, and in almost every system is discarded thereafter.
Depending on the biometric data system, a user may need to present biometric data several times in order to enroll. For example, most finger-scan systems require the user to place each finger two or four times to gather sufficient data for template creation. The enrollment process may also gather data from more than one finger (or iris, or retina) to create multiple enrollment templates.
Enrollment requires the creation of an identifier such as username or ID. This identifier is normally generated by the user or administrator during entry of personal data such as name and department. When the user returns to verify, he or she enters the identifier, then provides biometric data. Once biometric data has been attained, biometric templates can be created by a process of feature extraction.
Feature extraction
The automated process of locating and encoding distinctive characteristics from biometric data in order to generate a template is called feature extraction. Feature extraction takes place during enrollment and verification – any time a template is created. The feature extraction process includes filtering and optimizing of images and data in order to accurately locate features. For example, voice-scan technologies generally filter certain frequencies and patterns, and finger-scan technologies often thin ridges present in a fingerprint image to the width of a single pixel. Vendor’s feature extraction processes are generally patented and are always held secret. Since quality of feature extraction directly affects a system’s ability to generate templates, it is extremely important to the performance of a biometric system.
Template
A template is a small file derived from the distinctive features of a user’s biometric data, used to perform biometric matches. Biometric systems store and compare biometric templates not biometric data.
There are a number of important facts about biometric template:
· Most templates occupy less than 1 kilobyte, and some technologies templates are small as 9 bytes; template sizes also differ from vendor to vendor. Such small sizes allow for very rapid matching, allow biometrics to be stored on devices such as tokens and smart cards, and facilitate rapid transmission and encryption.
· Templates are proprietary to each vendor and each technology. There is no common biometric template format – a template created in vendor A’s system cannot be used through vendor B’s technology.
· One of the most interesting facts about most biometric technologies is that unique templates are generated every time a user presents biometric data. Two immediately successive placements of a finger on a biometric device generate entirely different templates. These templates, when processed by a vendor’s algorithm, are recognizable as being from the same person, but are not identical. In theory, a user could place the same finger on a biometric device for years never generate identical templates. This is due to minute changes in positioning, distance, pressure and various other factors that affect biometric presentation.
Depending on when they are generated, templates can be referred to as enrollments templates or match templates. Enrollment templates are created upon the user’s initial interaction with a biometric system and are stored for usage in future biometric comparisons. Match templates are generated during subsequent verification attempts or identification attempts, compared to the stored template, and generally discarded immediately after the comparisons. As opposed to enrollment templates, match templates are normally derived from a single sample – for example, a template derived from a single facial image can be compared to the enrollment template, which may represent an amalgam of several facial images.
Biometric Matching
The comparison of biometric templates to determine their degree of similarity or correlation is called matching. The process of matching biometric templates results in a score, which, in most systems, is compared against a threshold. If the score exceeds the threshold, the result is a match; if the score falls below the threshold, the result is a nonmatch.
The matching process involves the comparison of a verification template, created when the user provides biometric data, with the enrollment template(s) stored in a biometric system. In verification systems, a verification template is matched against a user’s enrollment template or templates (a user may have more than one biometric template enrolled – for example multiple fingerprints or iris patterns). In identification systems, the verification template can be matched against dozens, thousands, even millions of enrollment templates. The following are steps involved in matching.
Scoring
Biometric match/no-match decisions are based on a score – a number indicating the degree of similarity or correlation resulting from the comparison of enrollment and verification templates and generate scores. There is no standard scale used to biometric scoring: some biometric systems employ a scale of 1 to 100; others use a scale of -1 to 1. These scores can be carried out to several decimal points and can be logarithmic or linear. Scoring systems vary not only from technology to technology, but from vendor to vendor.
Scoring is a critical biometric concept and accounts for many of the strengths and some of the weaknesses – of biometric systems. Traditional authentication methods such as passwords, PINs and token are binary, offering only a strict yes/no (or no but try again) response. An attempt to verify via password will not succeed if it is close – it is either correct or incorrect.
Biometrics systems, by contrast do not refer absolute match/no-match decisions. Because different templates are generated each time a user interacts with a biometric system there is no 100 percent correlation between enrollment and verification templates.
Threshold
Once a score is generated, it is important to the verification attempt’s threshold. A threshold is a predefined number, generally chosen by a system administrator, which establishes the degree of correlation necessary for comparison to be deemed a match. If the score resulting from template comparison exceeds the threshold, the templates are match. Thresholds can vary from user to user, from transaction to transaction, and from verification attempt to verification attempt. Systems can be either highly secure or not secure at all, depending on their threshold settings. The flexibility offered by the combination of scoring and thresholds allows biometrics to be deployed in ways not possible with passwords, PINs, or tokens. For example, a system can be designed that employs a high security threshold for valuable transactions and a low security threshold for low-value transactions – the underlying comparison is transparent to the user.
Decision
The result of the comparison between the score and the threshold is a decision. The decisions a biometric system can make include match, nonmatch, and inconclusive, although varying degrees of strong matches and nonmathces are possible. Depending on the type of biometric system deployed, a match might grant access to resources, a nonmatch might limit access to resources, while inconclusive may prompt the user to provide another sample. Therefore, for most technologies, there is simply no such things as 100 percent match. This is not to imply that the systems are not secure – biometric systems may be able to verify or identity with error rates of less than 1 in 100,000 or 1 in 1 million. However, claims of 100 percent accuracy are misleading and are not reflective of the technology’s basic.
Biometric comparisons take place when biometric templates are processed by proprietary algorithms. These algorithms manipulate the data contained in the template in order to affect a valid comparison, accounting for variations in placement, background noise and so on. Without the vendor algorithm, there is no way to compare biometric templates – comparing the bits that make up the templates does not indicate whether they came from the same user. The bits must be processed by the vendor as a precondition of comparison.
Comments
Post a Comment