Biometric Authentication Systems

Presented By

Hiren JoshiResearch Assistant

Dept. of Computer ScienceSaurashtra University

Rajkot

1

ABSTRACT

This paper provides a broad overview of the subject of biometrics mentioning about the different

types of methods, how they are used, how their performance is measured and how beneficial can

they prove to be. A biometric system is essentially a pattern recognition system, which makes a

personal identification by determining the authenticity of a specific physiological or behavioral

characteristic possessed by the user. In this paper we have aimed to give a detailed explanation

of this definition of the biometric technology system.

2

1. INTRODUCTION 1.1 What are biometrics and why should we be concerned with them?

Biometrics are best defined as measurable physiological and / or behavioral characteristics that can be utilized to verify the identity of an individual. They include fingerprints, retinal and iris scanning, hand geometry, voice patterns, facial recognition and other techniques. They are of interest in any area where it is important to verify the true identity of an individual. Initially, these techniques were employed primarily in specialist high security applications; however we are now seeing their use and proposed use in a much broader range of public facing situations.

1.2 But what was wrong with cards and pins?

With the increased use of computers as vehicles of information technology, it is necessary to restrict access to sensitive/personal data. This method of identification is preferred over traditional methods involving passwords and PIN numbers for various reasons: (i) The person to be identified is required to be physically present at the point-of-

identification.(ii) Identification based on biometrics techniques obviates the need to remember a password

or carry PINs, biometrics techniques can potentially prevent unauthorized access to or fraudulent use of ATMs, cellular phones, smart cards, desktop PCs, workstations, and computer networks.

PINs and passwords may be forgotten, and token-based methods of identification like passports and driver's licenses may be forged, stolen, or lost. Thus biometric systems of identification are enjoying a renewed interest.

2. TYPES OF BIOMETRICS Various types of biometric systems are being used for real-time identification. Out of the number of biometrics, some of them are rather impractical even if technically interesting. The ‘popular’ biometrics seem to gravitate at present around following methodologies:

1) Fingerprint identification,2) Hand scan, 3) Iris recognition, 4) Retina scan, 5) Face recognition, 6) Speaker identification, 7) Signature scan,8) Multimodal

3

3. FINGERPRINT BIOMETRICS 3.1 Fingerprint Verification:

Among all the biometrics techniques, fingerprint-based identification is the oldest method, which has been successfully used in numerous applications.Everyone is known to have unique, immutable fingerprints. A fingerprint is made of a series of ridges and furrows on the surface of the finger. The uniqueness of a fingerprint can be determined by the pattern of ridges and furrows as well as the minutiae points. Minutiae points are local ridge characteristics that occur at either a ridge bifurcation or a ridge ending as seen in fig. 1.Minutiae-based techniques first find minutiae points and then map their relative placement on the finger. The basic idea is to measure the relative positions of minutiae, in the same sort of way you might recognize a part of the sky by the relative positions of stars. However, there are some difficulties when using this approach. It is difficult to extract the minutiae points accurately when the fingerprint is of low quality. Also this method does not take into account the global pattern of ridges and furrows.The most common procedure was the ink-and-roll method.Fingerprint identification through biometrics is the computerized process of manual fingerprint acquisition and storage.

3.2 Classification:

Large volumes of fingerprints are collected and stored everyday in a wide range of applications including forensics, etc. An automatic recognition of people based on fingerprints requires that the input fingerprint be matched with a large number of fingerprints in a database (FBI database contains approximately 70 million fingerprints!).To reduce the search time and computational complexity, it is desirable to classify these fingerprints in an accurate and consistent manner so that the input fingerprint is required to be matched only with a subset of the fingerprints in the database. An algorithm has been developed to classify fingerprints into five classes, namely, whorl, right loop, left loop, arch, and tented arch as shown in figures below(fig. 2,fig. 3,4,5 . The algorithm separates the number of ridges present in four directions (0 degree, 45 degree, 90 degree, and 135 degree).

4

Fig.2: Whorl Fig. 3: Right Loop Fig. 4: Left Loop

Fig. 5: Arch Fig. 6: Tented Arch3.3 Fingerprint technology:

Fig. 7.

The capture device analyzes a fingerprint image to determine the location of the fingerprint core and the pattern type (i.e., right loop, left arch, etc.).The algorithm estimates the quality of the ridgelines and then extracts the points in which the ridges split, intersect or end (minutia).The software locates a standard axis over the print, positioned so that the center of the axis is on the core of the print and the axis is aligned so that it runs along the centerline of the print as seen in fig. 7.Finally, the mapping of the minutia points is converted into a mathematical code called a template. Matching two minutiae-based templates does not require that all extracted minutiae match. In fact very strong matches can be made when as few a one third of the total minutiae match. Because minutia points do not change over time and due to the fact that not all minutia must be present in order to verify identity, minutia based systems are the preferred method underlying most fingerprint biometric systems. For example, cuts and scars may not affect all minutia points and even partial prints left behind at crime scenes may yield sufficient amount of minutia points to run a comparison against a database. One of the largest criminal databases in the world, the FBI’s IAFIS system with over 40 million records, uses minutia based fingerprint templates.

3.4 Image Capture:

A fingerprint scanner system has two basic jobs -- it needs to get an image of your finger, and it needs to determine whether the pattern of ridges and valleys in this image matches the pattern of ridges and valleys in pre-scanned images. A fingerprint image can be captured using one of three scanners as explained below:

3.4.1 OPTICAL SCANNER:

The heart of an optical scanner is a charge-coupled device (CCD), the same light sensor system used in digital cameras and camcorders. A CCD is simply an array of light-sensitive diodes called photosites, which generate an electrical signal in response to light photons.

5

Each photosite records a pixel, a tiny dot representing the light that hit that spot.Collectively, the light and dark pixels form an image of the scanned scene (a finger, for example)Typically, an analog-to-digital converter in the scanner system processes the analog electrical signal to generate a digital representation of this image. The scanning process starts when you place your finger on a glass plate, and a CCD camera takes a picture. The scanner has its own light source, typically an array of light-emitting diodes, to illuminate the ridges of the finger. The CCD system actually generates an inverted image of the finger, with darker areas representing more reflected light (the ridges of the finger) and lighter areas representing less reflected light (the valleys between the ridges). Before comparing the print to stored data, the scanner processor makes sure the CCD has captured a clear image. It checks the average pixel darkness, or the overall values in a small sample, and rejects the scan if the overall image is too dark or too light. If the image is rejected, the scanner adjusts the exposure time to let in more or less light, and then tries the scan again. If the darkness level is adequate, the scanner system goes on to check the image definition (how sharp the fingerprint scan is). The processor looks at several straight lines moving horizontally and vertically across the image.If the fingerprint image has good definition, a line running perpendicular to the ridges will be made up of alternating sections of very dark pixels and very light pixels. If the processor finds that the image is crisp and properly exposed, it proceeds to comparing the captured fingerprint with fingerprints on file.

3.4.2 CAPACITANCE SCANNER:

Fig. 8.Like optical scanners, capacitive scanners generate an image of the ridges and valleys that make up a fingerprint. But the capacitors sense the print using electrical current. The fig. 8 shows a simple capacitance scanner.The sensor is made up of one or more semiconductor chips containing an array of tiny cells. Each cell includes two conductor plates, covered with an insulating layer. The surface of the finger acts as a third capacitor plate, separated by the insulating layers in the cell structure and, in the case of the fingerprint valleys, a pocket of air. The sensor is made up of one or more semiconductor chips containing an array of tiny cells.Each cell includes two conductor plates, covered with an insulating layer. The cells are tiny -- smaller than the width of one ridge on a finger. The sensor is connected to an integrator, an electrical circuit built around an inverting operational amplifier. Like any amplifier, an inverting amplifier alters one current based on fluctuations in another current.Specifically, the inverting amplifier alters a supply voltage. The alteration is based on the relative voltage of two inputs, called the inverting terminal and the non-inverting terminal. In this case, the non-inverting terminal is connected to ground, and the inverting terminal is connected to a reference voltage supply and a feedback loop. The feedback loop, which is also connected to the amplifier output, includes the two conductor plates. As you may have recognized, the two conductor plates form a basic capacitor, an electrical component that can store up charge. The surface of the finger acts as a third capacitor plate, separated by the insulating layers in the cell structure and, in the case of the fingerprint valleys, a

6

pocket of air. Varying the distance between the capacitor plates (by moving the finger closer or farther away from the conducting plates) changes the total capacitance (ability to store charge) of the capacitor. Because of this quality, the capacitor in a cell under a ridge will have a greater capacitance than the capacitor in a cell under a valley. To scan the finger, the processor first closes the reset switch for each cell, which shorts each amplifier's input and output to "balance" the integrator circuit. When the switch is opened again, and the processor applies a fixed charge to the integrator circuit, the capacitors charge up. The capacitance of the feedback loop's capacitor affects the voltage at the amplifier's input, which affects the amplifier's output. Since the distance to the finger alters capacitance, a finger ridge will result in a different voltage output than a finger valley. The scanner processor reads this voltage output and determines whether it is characteristic of a ridge or a valley. By reading every cell in the sensor array, the processor can put together an overall picture of the fingerprint; similar to the image captured by an optical scanner.

3.4.3 ULTRASOUND SCANNERS:

Ultrasound technology, though considered perhaps the most accurate of the fingerprint technologies, is not yet widely used. It transmits acoustic waves and measures the distance based on the impedance of the finger, the platen, and air. Ultrasound is capable of penetrating dirt and residue on the platen and the finger, countering a main drawback to optical technology.

Even with a few significant drawbacks, but lots of advantages, fingerprint scanners are an excellent means of identification and still have great scope for improvement in the near future

4. HAND SCAN

This biometric approach uses the geometric form of the hand for confirming an individual’s identity. Because human hands are not unique, specific features must be combined to assure dynamic verification. Some hand-scan devices measure just two fingers; others measure the entire hand. These features include characteristics such as finger curves, thickness and length; the height and width of the back of the hand; the distances between joints and overall bone structure. It should be noted that although the bone structure and joints of a hand are relatively constant traits, other influences such as swelling or injury can disguise the basic structure of the hand. This could result in false matching and non-false matching, however the amount of acceptable distinctive matches can be adjusted for the level of security needed.To register in a hand-scan system a hand is placed on a reader’s covered flat surface. This placement is positioned by five guides or pins that correctly situate the hand for the cameras as seen in fig 9. A succession of cameras captures 3-D pictures of the sides and back of the hand. The attainment of the hand-scan is a fast and simple process. The hand-scan device can process the 3-D images in 5 seconds or less and the hand verification usually takes less than 1 second. The image capturing and verification software and hardware can easily be integrated within standalone units. Hand-scan applications that include a large number of access points and users can be centrally administered, eliminating the need for individuals to register on each device.

7

Fig. 9.

5. IRIS RECOGNITION

5.1 The Iris:

Fig. 10.

Iris recognition leverages the unique features of the human iris to provide an unmatched identification technology. So accurate are the algorithms used in iris recognition that the entire planet could be enrolled in an iris database with only a small chance of false acceptance or false rejection.Iris recognition is based on visible (via regular and/or infrared light) qualities of the iris. A primary visible characteristic is the trabecular meshwork as shown in fig. 10. (permanently formed by the 8th month of gestation), a tissue which gives the appearance of dividing the iris in a radial fashion. Other visible characteristics include rings, furrows, freckles, and the corona, to cite only the more familiar. Expressed simply, iris recognition technology converts these visible characteristics into a 512 byte IrisCode(tm), a template stored for future verification attempts. 512 bytes is a fairly compact size for a biometric template, but the quantity of information derived from the iris is massive. From the iris' 11mm diameter, Dr. Daugman's algorithms provide 3.4 bits of data per square mm. This density of information is such that each iris can be said to have 266 unique "spots", as opposed to 13-60 for traditional biometric technologies.

8

5.2 The Algorithms:

Fig. 11.The first step is location of the iris by a dedicated camera no more than 3 feet from the eye. After the camera situates the eye, the algorithm narrows in from the right and left of the iris to locate its outer edge. This horizontal approach accounts for obstruction caused by the eyelids. It simultaneously locates the inner edge of the iris (at the pupil), excluding the lower 90° because of inherent moisture and lighting issues. The monochrome camera uses both visible and infrared light, the latter of which is located in the 700-900nm range.Upon location of the iris, as seen above, an algorithm uses 2-D Gabor wavelets to filter and map segments of the iris into hundreds of vectors (known here as phasors).Understanding in detail the 2-D Gabor phasor encoders requires a degree in advanced mathematics, but they can be summarized as follows:The wavelets of various sizes assign values drawn from the orientation and spatial frequency of select areas, bluntly referred to as the "what" of the sub-image, along with the position of these areas, bluntly referred to as the "where." The "what" and "where" are used to form the IrisCode. Not the entire iris is used: a portion of the top, as well as 45° of the bottom, are unused to account for eyelids and camera-light reflections. Refer fig. 11.Essential to the understanding of the technology is that it provides exceptional detail, well beyond what any pictorial or point-based representation could provide (some filters actually span as much as 70° of the iris). Remember also that for future identification, the database will not be comparing images of irises, but rather hexadecimal representations of data returned by wavelet filtering and mapping.

6. RETINAL SCANNING

6.1 Basics:

Retinal scanning analyses the layer of blood vessels at the back of the eye. Scanning involves using a low-intensity light source and an optical coupler and can read the patterns at a great level of accuracy. It does require the user to remove glasses, place their eye close to the device, and focus on a certain point. Whether the accuracy can outweigh the public discomfort is yet to be seen.

6.2 How it works:

The user looks through a small opening in the device at a small green light.The user must keep their head still and eye focused on the light for several seconds during which time the device will verify his identity. This process takes about 10 to 15 seconds total. There is no known way to replicate a retina, and a retina from a dead person would deteriorate too fast to be useful, so no extra precautions have been taken with retinal scans to be sure the user is a living human being.

6.3 Uses:

Contrary to popular public misconceptions, and reflective of what is seen in the movies, retina scan is used almost exclusively in high-end security applications. It is used for controlling access to areas or rooms in military installations, power plants, and the like that are considered high-risk security areas.6.4 Evaluation:

Retina scan devices are probably the most accurate biometric available today. The continuity of

9

the retinal pattern throughout life and the difficulty in fooling such a device also make it a great long-term, high-security option.Unfortunately, the cost of the proprietary hardware, as well as the inability to evolve easily with new technology make retinal scanning devices a bad fit for most situations. It also has the stigma of consumer's thinking it is potentially harmful to the eye, and in general not easy to use.

7. FACIAL RECOGNITION

Looking in the mirror, we can observe certain distinguishable landmarks on our face. These are the peaks and valleys that make up the different facial features. These landmarks are known as nodal points. There are about 80 nodal points on a human face. Here are a few of the nodal points that are measured by the software: Distance between eyes, Width of nose, Depth of eye sockets, Cheekbones, Jaw-line and the Chin.These nodal points are measured to create a numerical code, a string of numbers, which represents the face in a database. This code is called a faceprint. Only 14 to 22 nodal points are needed for the FaceIt software to complete the recognition process. Facial recognition methods may vary, but they generally involve a series of steps that serve to capture, analyze and compare your face to a database of stored images. The basic steps followed by the FaceIt system to capture and compare images are: (i) Detection - When the system is attached to a video surveillance system, the recognition

software searches the field of view of a video camera for faces. If there is a face in the view, it is detected within a fraction of a second. A multi-scale algorithm is used to search for faces in low resolution. The system switches to a high-resolution search only after a head-like shape is detected.

Fig. 12.

(ii) Alignment - Once a face is detected, the system determines the head's position, size and pose. A face needs to be turned at least 35 degrees toward the camera for the system to register it.

(iii) Normalization -The image of the head is scaled and rotated so that it can be registered and mapped into an appropriate size and pose. Normalization is performed regardless of the head's location and distance from the camera. Light does not impact the normalization process.

(iv) Representation - The system translates the facial data into a unique code. This coding process allows for easier comparison of the newly acquired facial data to stored facial data.

(v) Matching - The newly acquired facial data is compared to the stored data and (ideally) linked to at least one stored facial representation.

The heart of the FaceIt facial recognition system shown in fig. 12 is the Local Feature Analysis (LFA) algorithm. This is the mathematical technique the system uses to encode faces. The system maps the face and creates a faceprint, a unique numerical code for that face. Once the system has stored a faceprint, it can compare it to the thousands or millions of face prints stored in a database. Facial recognition, like other forms of biometrics, is considered a technology that will have many uses in the near future.

8. UNDERSTANDING SIGNATURE VERIFICATION

Signature verification is the process used to recognize an individual’s hand-written signature. Dynamic signature verification technology uses the behavioral biometrics of a hand written

10

signature to confirm the identity of a computer user. This is done by analyzing the shape, speed, stroke, pen pressure and timing information during the act of signing. As a replacement for a password or a PIN number, dynamic signature verification is a biometric technology that is used to positively identify a person from their handwritten signature. There is an important distinction between simple signature comparisons and dynamic signature verification. Both can be computerized, but a simple comparison only takes into account what the signature looks like. Dynamic signature verification takes into account how the signature was made. With dynamic signature verification it is not the shape or look of the signature that is meaningful, it is the changes in speed, pressure and timing that occur during the act of signing. Only the original signer can recreate the changes in timing and X, Y, and Z (pressure). A pasted bitmap, a copy machine or an expert forger may be able to duplicate what a signature looks like, but it is virtually impossible to duplicate the timing changes in X, Y and Z (pressure). There will always be slight variations in a person’s handwritten signature, but the consistency created by natural motion and practice over time creates a recognizable pattern that makes the handwritten signature a natural for biometric identification.

9. VOICE RECOGNITION

Fig. 13.Voice Recognition is a technology, which allows a user to use his/her voice as an input device. Voice recognition may be used to dictate text into the computer or to give commands to the computer. Voice recognition uses a neural net to "learn" to recognize your voice. As you speak, the voice recognition software remembers the way you say each word. In addition to learning how you pronounce words voice recognition also uses grammatical context and frequency of use to predict the word you wish to input. These powerful statistical tools allow the software to cut down the massive language database before you even speak the next word. Also it involves identification of the speaker. The technique is shown in fig. 13.However, voice verification is a difficult area of biometrics, especially if one does not have direct control over the transducers, as indeed you wouldn’t when dealing with the general public. The variability of telephone handsets coupled to the variability of line quality and the variability of user environments presents a significant challenge to voice verification technology, and that is before you even consider the variability in understanding among users.

10. MULTIMODAL BIOMETRICS

A multimodal biometric system uses multiple applications to capture different types of biometrics. This allows the integration of two or more types of biometric recognition and verification systems in order to meet stringent performance requirements. A multimodal system could be, for instance, a combination of fingerprint verification, face recognition, voice verification and smart card or any other combination of biometrics. Preliminary experimental results demonstrate that the identity established by such an integrated system is more reliable than the identity established by a face recognition system, a fingerprint verification system, and a speaker verification system. This enhanced structure takes advantage of the proficiency of each individual biometric and can be used to overcome some of the limitations of a single biometric. A multimodal system can combine any number of independent biometrics and overcome some of the limitations presented by using just one biometric as your verification tool. For instance, it is estimated that 5% of the

11

population does not have legible fingerprints, a voice could be altered by a cold and face recognition systems are susceptible to changes in ambient light and the pose of the subject. A multimodal system, which combines the conclusions made by a number of unrelated biometrics indicators, can overcome many of these restrictions.

11. APPLICATIONS

11.1 Future Applications ~ Some Common Ideas:

There are many views concerning potential biometric applications, some popular examples being:

(i) IT/Network Security -As more and more valuable information is made accessible to employees via LAN and WAN, the risks associated with unauthorized access to sensitive data grow larger. Protecting your network with passwords is problematic, as passwords are easily compromised, lost, or inappropriately shared. Whether driven by security, convenience, or cost-reduction, biometrics are proving to be an effective solution for IT/Network Security. Major challenges in deploying biometrics in this environment include accuracy and performance, integrating biometric match decisions with existing systems, interoperability across proprietary technologies, and secure storage and transmission of biometric data.

(ii) ATM machine use -Potential applications even include ATM and check-cashing security. The software is able to quickly verify a customer's face. After the user consents, the ATM or check-cashing kiosk captures a digital photo of the customer. The FaceIt software then generates a faceprint of the photograph to protect customers against identity theft and fraudulent transactions. By using facial recognition software, there's no need for a picture ID, bankcard or personal identification number (PIN) to verify a customer's identity.

(iii) Workstation and network access- For a long time this was an area often discussed but rarely implemented until recent developments saw the unit price of biometric devices fall dramatically as well as several designs aimed squarely at this application. In addition, with household names such as Sony, Compaq, KeyTronics, Samsung and others entering the market, these devices appear almost as a standard computer peripheral. Many are viewing this as the application which will provide critical mass for the biometric industry and create the transition between sci-fi device to regular systems component, thus raising public awareness and lowering resistance to the use of biometrics in general.

(iv) Access Control - Biometrics have long been used to protect a physical locations. In some cases entry to a facility is protected through a biometric at building entry. More frequently, specific rooms are secured with a biometric, as only certain employees have access to protected areas, and most building have areas considered semi-public.

(v) PC/LAN Logon - Many vendors have software that allows users to logon to PCs and local area networks, especially Windows NT. This reduces the user’s need to remember and change passwords while reducing the administrator’s need to frequently reset and manage passwords.

(vi) Travel and tourism: - There are many in this industry who have the vision of a multi application card for travellers which, incorporating a biometric, would enable them to participate in various frequent flyer and border control systems as well as paying for their air ticket, hotel room, hire care etc., all with one convenient token. Technically this is eminently possible, but from a political and commercial point of view there are still many issues to resolve, not the least being who would own the card, be responsible for administration and so on. These may not be insurmountable problems and perhaps we may see something along these lines emerge. A notable challenge in this respect would be packaging such an initiative in a way that would be truly attractive for users.

(vii) Public identity cards -A biometric incorporated into a multi purpose public ID card would be useful in a number of scenarios if one could win public support for such a scheme.

12

Unfortunately, in this country as in others there are huge numbers of individuals who definitely do not want to be identified. This ensures that any such proposal would quickly become a political hot potato and a nightmare for the minister concerned. You may consider this a shame or a good thing, depending on you point of view. From a dispassionate technology perspective it represents something of a lost opportunity, but this is of course nothing new. It’s interesting that certain local authorities in the UK have issued ‘citizen’ cards with which named cardholders can receive various benefits including discounts at local stores and on certain services. These do not seem to have been seriously challenged.

13

12. CONCLUSION

Biometrics is expected to be incorporated in solutions to provide for Homeland Security including applications for improving airport security, strengthening our national borders, in travel documents, visas and in preventing ID theft. Now, more than ever, there is a wide range of interest in biometrics across federal, state, and local governments. Congressional offices and a large number of organizations involved in many markets are addressing the important role that biometrics will play in identifying and verifying the identity of individuals and protecting national assets.

14

14. BIBLOGRAPHY

References:

Web-sites: (1) www.ibg.com (international biometric group)(2) www.howstuffworks.com (3) www.ibia.com (site of international biometric industry association )(4) www.identix.com(5) www.avanti.com(6) www.ibm.com

Books:(1) Biometrics; The Ultimate Reference

15