Other Free Encyclopedias » Online Encyclopedia » Encyclopedia - Featured Articles » Contributed Topics from A-E

Biometrics, A Critical Consideration in Information Security Management - INTRODUCTION, BACKGROUND, BIOMETRICS TECHNOLOGIES, Retina and Iris Scanning, Fingerprint Scanning, Facial Recognition, Voice Recognition, PRACTITIONER IMPLICATIONS

authentication system user

Paul Benjamin Lowry
Brigham Young University, USA

Jackson Stephens
Brigham Young University, USA

Aaron Moyes
Brigham Young University, USA

Sean Wilson
Brigham Young University, USA

Mark Mitchell
Brigham Young University, USA


The need for increased security management in organizations has never been greater. With increasing globalization and the spread of the Internet, information-technology (IT) related risks have multiplied, including identity theft, fraudulent transactions, privacy violations, lack of authentication, redirection and spoofing, data sniffing and interception, false identities, and fraud.

Many of the above problems in e-commerce can be mitigated or prevented by implementing controls that improve authentication, nonrepudiation, confidentiality, privacy protection, and data integrity (Torkzadeh & Dhillon, 2002). Several technologies help support these controls, including data encryption, trusted third-party digital certificates, and confirmation services. Biometrics is an emerging family of authentication technologies that supports these areas.

It can be argued that authentication is the baseline control for all other controls; it is critical in conducting e-commerce to positively confirm that the people involved in transactions are who they say they are. Authentication uses one or more of the following methods of identification (Hopkins, 1999): something you know (e.g., a password), something you have (e.g., a token), and something about you (e.g., a fingerprint). Using knowledge is the traditional approach to authentication, but it is the most prone to problems, because this knowledge can be readily stolen, guessed, or discovered through computational techniques. Physical objects tend to be more reliable sources of identification, but this approach suffers from the increased likelihood of theft. The last approach to authentication is the basis for biometrics. Biometrics refers to the use of computational methods to evaluate the unique biological and behavioral traits of people (Hopkins, 1999) and it is arguably the most promising form of authentication because personal traits (e.g., fingerprints, voice patterns, or DNA) are difficult to steal or emulate.


A given biometric can be based on either a person’s physical or behavioral characteristics. Physical characteristics that can be used for biometrics include fingerprints, hand geometry, retina and iris patterns, facial characteristics, vein geometry, and DNA. Behavioral biometrics analyze how people perform actions, including voice, signatures, and typing patterns.

Biometrics generally adhere to the following pattern: When a person first “enrolls” in a system, the target biometric is scanned and stored as a template in a database that represents the digital form of the biometric. During subsequent uses of the system the biometric is scanned and compared against the stored template.

The process of scanning and matching can occur through verification or identification. In verification (a.k.a. authentication) a one-to-one match takes place in which the user must claim an identity, and the biometric is then scanned and checked against the database. In identification (a.k.a. recognition), a user is not compelled to claim an identity; instead, the biometric is scanned and then matched against all the templates in the database. If a match is found, the person has been “identified.”

The universal nature of biometrics enables them to be used for verification and identification in forensic, civilian, and commercial settings (Hong, Jain, & Pankanti, 2000). Forensic applications include criminal investigation, corpse identification, and parenthood determination. Civilian uses include national IDs, driver’s licenses, welfare disbursement, national security, and terrorism prevention. Commercial application includes controlling access to ATMs, credit cards, cell phones, bank accounts, homes, PDAs, cars, and data centers.

Despite the promise of biometrics, their implementation has yet to become widespread. Only $127 million was spent on biometric devices in the year 2000, with nearly half being spent on fingerprinting; however, future growth is expected to be strong, with $1.8 billion worth of biometrics-related sales predicted in 2004 (Mearian, 2002). Clearly, the true potential of biometrics has yet to be reached, which opens up many exciting business and research opportunities. The next section reviews specific biometrics technologies.


This section reviews the major biometrics technologies and discusses where they are most appropriate for use. We examine iris and retina scanning, fingerprint and hand scanning, facial recognition, and voice recognition.

Retina and Iris Scanning

Considered by many to be the most secure of all biometrics, eye-based biometrics have traditionally been utilized in high-security applications, such as prisons, government agencies, and schools. Eye scanning comes in two forms: iris scanning and retina scanning. The first biometric eye-scanning technologies were developed for retina recognition. Retinal scanners examine the patterns of blood vessels at the back of the eye by casting either natural or infrared light onto them. Retina scanning has been demonstrated to be an extremely accurate process that is difficult to deceive because retinal patterns are stable over time and unique to individuals (Hong et al., 2000).

Iris scanning is a newer technology than retina scanning. The iris consists of the multicolored portion of the eye that encircles the pupil, as shown in Figure 1. Iris patterns are complex, containing more raw information than a fingerprint. The iris completes development during a person’s first two years of life, and its appearance remains stable over long periods of time. Irises are so personally unique that even identical twins exhibit differing iris patterns.

Two differences between retina and iris scanning are the equipment and the procedures. The equipment for retina recognition tends to be bulky and complex and the procedures tend to be uncomfortable. Users must focus on a particular spot for a few seconds and their eyes must be up close to the imaging device. Figure 2 shows an iris scanner sold by Panasonic. Unlike retinal scanning, iris recognition involves more standard imaging cameras that are not as specialized or as expensive. Iris scanning can be accomplished with users situated at a distance of up to one meter away from the camera. Another difference is that retinal scans require people to remove their glasses, whereas iris scans work with glasses. Iris scanners also detect artificial irises and contact lenses.

In terms of accuracy, retina scanning has a proven track record; hence, it is used more in high-security installations. Because iris systems are newer they have less of a track record. Although template-matching rates are fairly high for both technologies, preliminary results indicate that iris recognition excels at rejecting unauthorized users but also frequently denies authorized user (false negatives).

Compared to other biometrics devices, eye-scanning equipment is expensive. Retinal imaging is especially costly because the required equipment is similar to specialized medical equipment, such as a retinascope, whereas iris recognition uses more standard and inexpensive cameras.

Fingerprint Scanning

Fingerprint scanning uses specialized devices to capture information about a person’s fingerprint, which information is used to authenticate the person at a later time. Each finger consists of unique patterns of lines. Fingerprint scanners do not capture entire fingerprints; instead, they record small details about fingerprints, called minutiae (Hong et al., 2000). For example, a scanner will pick a point on a fingerprint and record what the ridge at that point looks like (as seen in Figure 3), which direction the ridge is heading, and so on (Jain, Pankanti, & Prabhakar, 2002). By picking enough points, the scanner can be highly accurate. Although minutiae identification is not the only suitable factor for fingerprint comparison, it is the primary feature used by fingerprint systems. The number of minutiae per fingerprint can vary, but a high-quality fingerprint scan will contain between 60 and 80 minutiae (Hong et al., 2000).

A biometrics system can identify a fingerprint from its ridge-flow pattern; ridge frequency; location and position of singular points; type, direction, and location of key points; ridge counts between pairs of minutiae; and location of pores (Jain et al., 2002). Given their simplicity and multiple uses, fingerprint scanning is the most widely used biometrics application.

One significant point is that vulnerabilities abound throughout the entire process of fingerprint authentication. These vulnerabilities range from the actual scan of the finger to the transmission of the authentication request to the storing of the fingerprint data. Through relatively simple means, an unauthorized person can gain access to a fingerprint-scanning system (Thalheim, Krissler, & Ziegler, 2002): the scanners may be deceived by simply blowing on the scanner surface, rolling a bag of warm water over it, or using artificial wax fingers. Another weakness with some fingerprint scanners is the storage and transmission of the fingerprint information. Fingerprint minutiae are stored as templates in databases on servers; thus, the inherent vulnerability of a computer network becomes a weakness. The fingerprint data must be transmitted to the server, and the transmission process may not be secure. Additionally, the fingerprint templates on a server must be protected by firewalls, encryption, and other basic network security measures to keep the templates secure.

An organization’s size is another critical component in determining the effectiveness of a fingerprint system. Larger organizations require more time and resources to compare fingerprints. Although this is not an issue for many organizations, it can be an issue for large and complex government organizations such as the FBI (Jain et al., 2002).

Variances in scanning can also be problematic because spurious minutiae may appear and genuine minutiae may be left out of a scan, thus increasing the difficulty of comparing two different scans (Kuosmanen & Tico, 2003). Each scan of the same fingerprint results in a slightly different representation. This variance is caused by several factors, including the position of the finger during the scan and the pressure of the finger being placed on the scanner.

Facial Recognition

One of the major advantages of facial recognition over other biometric technologies is that it is fairly nonintrusive. Facial recognition does not require customers to provide fingerprints, talk into phones, nor have their eyes scanned. As opposed to hand-based technologies, such as fingerprint scanners, weather conditions and cleanliness do not strongly affect the outcome of facial scans, making facial recognition easier to implement.

However, more than other physical biometrics, facial recognition is affected by time. The appearance and shape of a face change with one’s aging process and alterations to a face—through surgery, accidents, shaving, or burns, for example—can also have a significant effect on the result of facial-recognition technology.

Thus far, several methods of facial recognition have been devised. One prominent technique analyzes the bone structure around the eyes, nose, and cheeks. This approach, however, has several limitations. First, the task of recognizing a face based on images taken from different angles is extremely difficult. Furthermore, in many cases the background behind the subject must be overly simple and not representative of reality (Hong et al., 2000).

Technology also exists that recognizes a neural-network pattern in a face and scans for “hot spots” using infrared technology. The infrared light creates a so-called “facial thermogram” that overcomes some of the limitations normally imposed on facial recognition. Amazingly, plastic surgery that does not alter the blood flow beneath the skin and rarely affects facial thermograms (Hong et al., 2000). A facial thermogram can also be captured in poorly lit environments. However, research has not yet determined if facial thermograms are adequately discriminative; for example, they may depend heavily on the emotion or body temperature of an individual at the moment the scan is created (Hong et al., 2000).

A clear downside to facial recognition is that it can more easily violate privacy through powerful surveillance systems. Another problem specific to most forms of facial recognition is the requirement of bright lights and a simple background. Poor lighting or a complex background can make it difficult to obtain a correct scan. Beards and facial alterations can also negatively affect the recognition process.

Voice Recognition

Voice recognition differs from most other biometric models in that it uses acoustic information instead of images. Each individual has a unique set of voice characteristics that are difficult to imitate. Human speech varies based on physiological features such as the size and shape of an individual’s lips, nasal cavity, vocal chords, and mouth (Hong et al., 2000).

Voice recognition has an advantage over other biometrics in that voice data can be transmitted over phone lines, a feature that lends to its widespread use in such areas as security, fraud prevention, and monitoring (Markowitz, 2000). Voice recognition has shown success rates as high as 97%. Much of this success can be explained by the way a voice is analyzed when sample speech is requested for validation.

Voice biometrics use three types of speaker verification: text dependent, text prompted, and text independent. Text-dependent verification compares a prompted phrase, such as an account number or a spoken name, to a prerecorded copy of that phrase stored in a database. This form of verification is frequently used in such applications as voice-activated dialing in cell phones and bank transactions conducted over a phone system.

Text-prompted verification provides the best alternative for high-risk systems. In this case, a system requests multiple random phrases from a user to lessen the risk of tape-recorded fraud. The main drawback to this verification process is the amount of time and space needed to create a new user on the system (Markowitz, 2000). This procedure is often used to monitor felons who are under home surveillance or in community-release programs.

Text-independent verification is the most difficult of the three types of voice recognition because nothing is asked of the user. Anything spoken by the user can be used to verify authenticity, a process which can make the authentication process virtually invisible to the user.

One drawback of voice recognition technique is that it is increasingly difficult to manage feedback and other forms of interference when validating a voice. Voices are made up entirely of sound waves. When transmitted over analog phone lines these waves tend to become distorted. Current technologies can reduce noise and feedback, but these problems cannot be entirely eliminated.

Voice-recognition products are also limited in their ability to interpret wide variations of voice patterns. Typically, something used for purposes of authentication must be spoken at a steady pace without much enunciation or pauses. Yet human speech varies so greatly among individuals that it is a challenge to design a system that will account for variations in speed of speech as well as in enunciation.

Despite its imperfections, voice recognition has a success rate of up to 98%. Consequently, whereas about 2% of users will be declined access when they are indeed who they say they are, only about 2% of users will be granted access when they are not who they say they are.


To help practitioners compare these biometrics, we present Table 1 to aid with decisions in implementing biometrics. This table compares the five major areas of biometrics based on budget consciousness, ease of use, uniqueness, difficulty of circumvention, space savings, constancy over time, accuracy, and acceptability by users. Each area is rated as follows: VL (very low), L (low), M (medium), H (high), and VH (very high).


One area in biometrics in which much work still needs to be done is receiver operating characteristics (ROC). ROC deals with system accuracy in certain environments, especially as it relates to false-positive and false-negative results. False positives,also known as false match rates (FMR), occur when an unauthorized user is authenticated to a system. False negatives, also known as false nonmatch rates (FNR), occur when an authorized user is denied access to a system. Both situations are undesirable. Unfortunately, by making one less likely, the other becomes more likely. This difficult tradeoff can be minimized by achieving a proper balance between the two extremes of strictness and flexibility. To this end, most biometrics implementations incorporate settings to adjust the degree of tolerance. In general, more secure installations require a higher degree of similarity for matches to occur than do less secure installations.

Research should also be undertaken to address three areas of attack to which biometrics are most susceptible: (1) copied-biometric attacks, in which obtaining a substitute for a true biometric causes proper authentication to occur via the normal system procedures; (2) replay attacks, in which perpetrators capture valid templates and then replay them to biometrics systems; (3) and database attacks, in which perpetrators access a template database and obtain the ability to replace valid templates with invalid ones.

Cancelable biometrics may reduce the threat of these attacks by storing templates as distortions of biometrics instead of the actual biometrics themselves (Bolle, Connell, & N., 2001). Similar to how a hash function works, the actual biometrics are not recoverable from the distortions alone. When a user is first enrolled in a system the relevant biometric is scanned, a distortion algorithm is applied to it, and the distortion template is created. Thereafter, when a scan of the biometric is taken, it is fed through the algorithm to check for a match.

Other possibilities for reducing attacks on biometrics include using biometrics that are more difficult to substitute, including finger length, wrist veins (under-side), hand veins (back of hand), knuckle creases (while gripping something), fingertip structure (blood vessels), finger-section lengths, ear shape, lip shape, brain scans, and DNA (Smith, 2003). DNA is particularly intriguing because it is universal and perfectly unique to individuals.


A single biometrics system alone likely is not an ideal form of security, just as a lone username-password pair is rarely desirable for secure installations. Instead, we recommend that biometrics be implemented in combinations. This can be accomplished through multifactor authentication that mixes something you know with something you have and something about you, or through hybrid-biometrics systems that take advantage of more than one biometric to achieve better results.

As we have demonstrated, none of the most commonly used biometrics are without flaws. Some are very expensive, others are difficult to implement, and some are less accurate. Yet biometrics hold a bright future. This emerging family of technologies has the capability of improving the lives of everyone as they become a standard part of increasing the security of everyday transactions, ranging from ATM withdrawals to computer log-ins. Well-intentioned and well-directed research will help further the effective widespread adoption of biometric technologies.

Biometrics for User Authentication - Biometrics in Context of Security Goals, Fusion Strategies for Biometrics, Knowledge and Possession [next] [back] Biometric Technologies - INTRODUCTION, BACKGROUND, Fingerprint, Facial Recognition, Iris Scan, Retinal Scan, Voice Recognition, Signature Verification

User Comments

Your email address will be altered so spam harvesting bots can't read it easily.
Hide my email completely instead?

Cancel or

Vote down Vote up

about 6 years ago

not to nice and here not detailed non recoverable biometric system.