18-02-2011, 03:51 PM
[attachment=8796]
Biometrics
IN THE REALM OF computer security, biometrics refers to authentication techniques that rely on measurable physiological and individual characteristics that can be automatically verified. In other words, we all have unique personal attributes that can be used for distinctive identification purposes, including a fingerprint, the pattern of a retina, and voice characteristics. Although the field of biometrics is still in its infancy, it’s inevitable that biometric systems will play a critical role in the future of security. Strong or two-factor authentication—identifying
oneself by two of the three methods of something you know (for example, a password), have (for example, a swipe card), or is (for example, a fingerprint)—is becoming more of a de facto standard
in secure computing environments. Some personal computers today can include a fingerprint scanner where you place your index finger to provide authentication. The computer analyzes your fingerprint to determine who you are and, based on your identity followed by a passcode or
passphrase, allows you different levels of access. Access levels can include the ability to open sensitive files, to use credit card information to make electronic purchases, and so on. If you’ve ever watched hi-tech spy movies, you’ve most likely seen biometric technology.
Several movies have depicted biometric technologies based on one or more of the following unique identifiers:
✓ Face
✓ Fingerprint
✓ Handprint
✓ Iris
✓ Retina
✓ Signature
✓ Voice
✓ Watermarking
But how realistic are they in today’s computing world, and how can they help you? This text answers these questions and provides templates for biometric applications.
Introduction
Biometrics refers to the automatic identification of a person based on his or her physiological or behavioral characteristics. This identification method is preferred over traditional methodsinvolving passwords and PINs (personal identification numbers) for several reasons, including the
person to be identified is required to be physically present at the point of identification and/oridentification based on biometric techniques obviates the need to remember a password or carry atoken. With the increased use of computers as vehicles of information technology, restrictingaccess to sensitive/personal data is necessary. By replacing PINs, biometric techniques can potentiallyprevent unauthorized access to or fraudulent use of the following:
✓ ATMs
✓ Cellular phones
✓ Smart cards
✓ Desktop PCs
✓ Workstations
✓ Computer networks
PINs and passwords may be forgotten, and token-based identification methods such as passportsand driver’s licenses may be forged, stolen, or lost. Thus, biometric systems of identificationare enjoying a new interest. Various types of biometric systems are being used for real-time identification.The most popular are based on face recognition and fingerprint matching; however,other biometric systems use iris and retinal scans, speech, facial feature comparisons and facialthermograms, and hand geometry.
In History
The term biometrics is derived from the Greek words bio (life) and metric (to measure).Among the first known examples of practiced biometrics was a form of memberprintingused in China in the fourteenth century, as reported by the Portuguesehistorian Joao de Barros. The Chinese merchants were stamping children’s palm andfootprints on paper with ink to distinguish the babies from one another.In the 1890s, an anthropologist and police desk clerk in Paris named AlphonseBertillon sought to fix the problem of identifying convicted criminals and turnedbiometrics into a distinct field of study. He developed a method of multiple body
measurements that was named after him (the Bertillonage technique—measuringbody lengths). Police throughout the world used this system until it proved to beexceedingly prone to error as many people shared the same measurements. After thisfailure, the police started using fingerprinting—developed by Richard Edward Henryof Scotland Yard—after the methods used by the Chinese centuries before. biometric system is essentially a pattern-recognition system that makes a personal identification
by determining the authenticity of a specific physiological or behavioral characteristic possessedby the user. An important issue in designing a practical system is to determine how anindividual is identified. Depending on the conext, a biometric system can be either a verification(authentication) or an identification system.
Verification versus IdentificationToday, wehave the technology and processing power to employ advanced, cost-effective, and much
more accurate biometric identification systems. There are two different ways to resolve a person’sidentity: verification and identification. Verification (am I whom I claim to be?) involves confirming
or denying a person’s claimed identity. In identification, one has to establish a person’s identity(who am I?). Each approach has its own complexities and could probably be solved best by aspecific biometric system, including the following:
✓ Physical biometrics:
■ Fingerprint—Analyzing fingertip patterns (see Figure 1-1)
■ Facial recognition/face location—Measuring facial characteristics
■ Hand geometry—Measuring the shape of the hand
■ Iris scan—Analyzing features of colored ring of the eye (see Figure 1-2)
■ Retinal scan—Analyzing blood vessels in the eye
■ Vascular patterns—Analyzing vein patterns
■ DNA—Analyzing genetic makeup
■ Biometric data watermarking (which is really a method rather than a physicalattribute) is used to store/hide biometric information.
✓ Behavioral biometrics:
■ Speaker/voice recognition—Analyzing vocal behavior
■ Signature/handwriting—Analyzing signature dynamics
■ Keystroke/patterning—Measuring the time spacing of typed word
Hand Geometry Medium High
Voice Medium High
Retina High Low
Iris Medium Medium
Signature Medium Medium
Face Low High
from the most accepted to the least accepted:
1. Iris scan
2. Keystroke/patterning
3. Signature/handwriting
4. Speaker/voice recognition
5. Facial recognition/face location
6. Fingerprint
7. Hand geometry
8. Retinal scan to the least effective:
1. Hand geometry
2. Iris scan
3. Retinal scan
4. Fingerprint
5. Speaker/voice recognition
6. Facial recognition/face location
7. Signature/handwriting
8. Keystroke/patterning
Applications
Biometrics is a rapidly evolving technology that is being widely used in forensics, such as criminal
identification and prison security, and that has the potential to be used in a large range of civilian
application areas. Biometrics can be used to prevent unauthorized access to ATMs, cellular
phones, smart cards, desktop PCs, workstations, and computer networks. It can be used during
transactions conducted by telephone and Internet (electronic commerce and electronic banking).
In automobiles, biometrics can replace keys with keyless entry devices.
APPLIED BIOMETRICS
This book covers the hottest topics in biometrics development for applications, including the following
in regards to applied methodology and program development:
✓ Fingerprint identification
✓ Hand geometry
✓ DNA analysis
✓ Speaker recognition
✓ Face location
✓ Retina scanning
✓ Iris scanning
✓ Keyboard recognition
✓ Multibiometrics
✓ Data hiding
✓ Sample solutions
It also provides a sample installation and usage of each biometric technology in the data arena
where it’s most practical. During the sample installation and usage specific features of the product
being used are noted. This becomes an important factor in determining which product is right for
you. For example, one product may provide good protection and make accessing Web sites easier,
while another product may allow access to specific applications to be controlled.
The text also shows how the biometric technology is used to control logon access and, where
possible, how it can be used for items such as e-mail and file encryption. For executive and information
technology (IT) managers, the following biometric concerns are also covered:
✓ What form of device is most appropriate for your use?
✓ Should the devices be shared or used individually?
✓ How large and how skilled a support staff is needed?
✓ Should users be coming in from multiple places? Over multiple channels, such as a local
area network (LAN), Web, wireless, or virtual private network (VPN)?
✓ What other forms of IT security should be in place (Public Key Infrastructure [PKI],
security portal, firewall, and so on)? How will they interact?
✓ Will users be switching access modes?
✓ Will different users and groups require different security policies for different applications
and transactions?
✓ How should all this be administered?
✓ Is this for inside the firewall, outside the firewall, or mixed use?
If you have decided to invest in biometrics, you’ll find some tips to help you leverage your
investment. Can the biometric product(s) be used for multiple purposes, such as the following?
✓ Site identification/access
✓ Building identification/access
✓ Secured location identification/access
✓ Equipment identification/access
✓ Mobile device protection
PRACTICAL USAGES
Throughout this book, you’ll find example scenarios in which biometrics is both a sound practice
and a solid investment that can ultimately help ensure security while reducing cost. Additionally,
you’ll find some futuristic examples of how biometrics may be used to provide new services while
maintaining high security.
According to Charles Lynch, Jr. (Vice President of Sales and Marketing for Datastrip, Inc.), vertical
markets using biometrics include the following:
✓ Government—Passports, national identification (ID) cards, voter cards, driver’s
licenses, social services, and so on
✓ Transportation—Airport security, boarding passes, and commercial driver’s licenses
✓ Healthcare—Medical insurance cards, patient/employee identity cards
✓ Financial—Bankcards, ATM cards, credit cards, and debit cards
✓ Retail and gaming—Retail programs, such as check cashing, loyalty rewards and promotional
cards, and gaming systems for access management and VIP programs
✓ Security—Access control and identity verifications, including time and attendance
✓ Public justice and safety—Prison IDs, county probation offices’ use for identification of
parolees, county courthouses’ use for ID systems
✓ Education—Student/teacher identity verification and access control. Biometrics are
now being implemented in large-scale ID systems around the globe. Many new passport
and national ID card systems use some type of biometric encoded in a bar code or smart
chip.
✓ Driver’s licenses—Technologies being recommended by American Association of Motor
Vehicle Administrators (AAMVA), the organization that oversees DMV standards, include
biometrics and two-dimensional bar codes. Georgia, North Carolina, Kentucky, and others
already utilize biometrics on their respective state driver’s licenses.
Outside of the government and military arena, corporate America is stepping up to biometrics
for applications ranging from employee IDs to time and attendance. The bulk of the biometrics
marketplace still consists of traditional systems used to compare fingerprints to vast, centralized
databases of criminals’ fingerprints.
Where possible, this text also depicts some potential future developments for the technologies
discussed.
Facts, Characteristics, and HowBiometrics Can Work for You
The most popular use of biometrics for network security is for secure workstation logons. Each
workstation requires software support for biometric identification of the user, as well as a hardware
device, depending on the biometric being used. The cost of hardware devices is one factor
note
that may lead to the widespread use of voice biometric security identification that can leverage
common sound cards and microphones, especially among companies and organizations on a low
budget. Hardware devices such as computer mice with built-in thumbprint readers will be the
next step. These devices will be more expensive to implement on several computers, because each
machine would require its own hardware device. A biometric mouse, with the software to support
it, is available in the United States for approximately $120. The advantage of voice recognition
software is that it can be centralized, reducing the cost of implementation per machine. At the top
of the price range, a centralized voice biometric package can cost up to $50,000 but may be able to
manage the secure logon of up to 5000 machines.
According to the International Biometric Industry Association (IBIA), the following are important
details about current biometrics and the industry
Biometrics
IN THE REALM OF computer security, biometrics refers to authentication techniques that rely on measurable physiological and individual characteristics that can be automatically verified. In other words, we all have unique personal attributes that can be used for distinctive identification purposes, including a fingerprint, the pattern of a retina, and voice characteristics. Although the field of biometrics is still in its infancy, it’s inevitable that biometric systems will play a critical role in the future of security. Strong or two-factor authentication—identifying
oneself by two of the three methods of something you know (for example, a password), have (for example, a swipe card), or is (for example, a fingerprint)—is becoming more of a de facto standard
in secure computing environments. Some personal computers today can include a fingerprint scanner where you place your index finger to provide authentication. The computer analyzes your fingerprint to determine who you are and, based on your identity followed by a passcode or
passphrase, allows you different levels of access. Access levels can include the ability to open sensitive files, to use credit card information to make electronic purchases, and so on. If you’ve ever watched hi-tech spy movies, you’ve most likely seen biometric technology.
Several movies have depicted biometric technologies based on one or more of the following unique identifiers:
✓ Face
✓ Fingerprint
✓ Handprint
✓ Iris
✓ Retina
✓ Signature
✓ Voice
✓ Watermarking
But how realistic are they in today’s computing world, and how can they help you? This text answers these questions and provides templates for biometric applications.
Introduction
Biometrics refers to the automatic identification of a person based on his or her physiological or behavioral characteristics. This identification method is preferred over traditional methodsinvolving passwords and PINs (personal identification numbers) for several reasons, including the
person to be identified is required to be physically present at the point of identification and/oridentification based on biometric techniques obviates the need to remember a password or carry atoken. With the increased use of computers as vehicles of information technology, restrictingaccess to sensitive/personal data is necessary. By replacing PINs, biometric techniques can potentiallyprevent unauthorized access to or fraudulent use of the following:
✓ ATMs
✓ Cellular phones
✓ Smart cards
✓ Desktop PCs
✓ Workstations
✓ Computer networks
PINs and passwords may be forgotten, and token-based identification methods such as passportsand driver’s licenses may be forged, stolen, or lost. Thus, biometric systems of identificationare enjoying a new interest. Various types of biometric systems are being used for real-time identification.The most popular are based on face recognition and fingerprint matching; however,other biometric systems use iris and retinal scans, speech, facial feature comparisons and facialthermograms, and hand geometry.
In History
The term biometrics is derived from the Greek words bio (life) and metric (to measure).Among the first known examples of practiced biometrics was a form of memberprintingused in China in the fourteenth century, as reported by the Portuguesehistorian Joao de Barros. The Chinese merchants were stamping children’s palm andfootprints on paper with ink to distinguish the babies from one another.In the 1890s, an anthropologist and police desk clerk in Paris named AlphonseBertillon sought to fix the problem of identifying convicted criminals and turnedbiometrics into a distinct field of study. He developed a method of multiple body
measurements that was named after him (the Bertillonage technique—measuringbody lengths). Police throughout the world used this system until it proved to beexceedingly prone to error as many people shared the same measurements. After thisfailure, the police started using fingerprinting—developed by Richard Edward Henryof Scotland Yard—after the methods used by the Chinese centuries before. biometric system is essentially a pattern-recognition system that makes a personal identification
by determining the authenticity of a specific physiological or behavioral characteristic possessedby the user. An important issue in designing a practical system is to determine how anindividual is identified. Depending on the conext, a biometric system can be either a verification(authentication) or an identification system.
Verification versus IdentificationToday, wehave the technology and processing power to employ advanced, cost-effective, and much
more accurate biometric identification systems. There are two different ways to resolve a person’sidentity: verification and identification. Verification (am I whom I claim to be?) involves confirming
or denying a person’s claimed identity. In identification, one has to establish a person’s identity(who am I?). Each approach has its own complexities and could probably be solved best by aspecific biometric system, including the following:
✓ Physical biometrics:
■ Fingerprint—Analyzing fingertip patterns (see Figure 1-1)
■ Facial recognition/face location—Measuring facial characteristics
■ Hand geometry—Measuring the shape of the hand
■ Iris scan—Analyzing features of colored ring of the eye (see Figure 1-2)
■ Retinal scan—Analyzing blood vessels in the eye
■ Vascular patterns—Analyzing vein patterns
■ DNA—Analyzing genetic makeup
■ Biometric data watermarking (which is really a method rather than a physicalattribute) is used to store/hide biometric information.
✓ Behavioral biometrics:
■ Speaker/voice recognition—Analyzing vocal behavior
■ Signature/handwriting—Analyzing signature dynamics
■ Keystroke/patterning—Measuring the time spacing of typed word
Hand Geometry Medium High
Voice Medium High
Retina High Low
Iris Medium Medium
Signature Medium Medium
Face Low High
from the most accepted to the least accepted:
1. Iris scan
2. Keystroke/patterning
3. Signature/handwriting
4. Speaker/voice recognition
5. Facial recognition/face location
6. Fingerprint
7. Hand geometry
8. Retinal scan to the least effective:
1. Hand geometry
2. Iris scan
3. Retinal scan
4. Fingerprint
5. Speaker/voice recognition
6. Facial recognition/face location
7. Signature/handwriting
8. Keystroke/patterning
Applications
Biometrics is a rapidly evolving technology that is being widely used in forensics, such as criminal
identification and prison security, and that has the potential to be used in a large range of civilian
application areas. Biometrics can be used to prevent unauthorized access to ATMs, cellular
phones, smart cards, desktop PCs, workstations, and computer networks. It can be used during
transactions conducted by telephone and Internet (electronic commerce and electronic banking).
In automobiles, biometrics can replace keys with keyless entry devices.
APPLIED BIOMETRICS
This book covers the hottest topics in biometrics development for applications, including the following
in regards to applied methodology and program development:
✓ Fingerprint identification
✓ Hand geometry
✓ DNA analysis
✓ Speaker recognition
✓ Face location
✓ Retina scanning
✓ Iris scanning
✓ Keyboard recognition
✓ Multibiometrics
✓ Data hiding
✓ Sample solutions
It also provides a sample installation and usage of each biometric technology in the data arena
where it’s most practical. During the sample installation and usage specific features of the product
being used are noted. This becomes an important factor in determining which product is right for
you. For example, one product may provide good protection and make accessing Web sites easier,
while another product may allow access to specific applications to be controlled.
The text also shows how the biometric technology is used to control logon access and, where
possible, how it can be used for items such as e-mail and file encryption. For executive and information
technology (IT) managers, the following biometric concerns are also covered:
✓ What form of device is most appropriate for your use?
✓ Should the devices be shared or used individually?
✓ How large and how skilled a support staff is needed?
✓ Should users be coming in from multiple places? Over multiple channels, such as a local
area network (LAN), Web, wireless, or virtual private network (VPN)?
✓ What other forms of IT security should be in place (Public Key Infrastructure [PKI],
security portal, firewall, and so on)? How will they interact?
✓ Will users be switching access modes?
✓ Will different users and groups require different security policies for different applications
and transactions?
✓ How should all this be administered?
✓ Is this for inside the firewall, outside the firewall, or mixed use?
If you have decided to invest in biometrics, you’ll find some tips to help you leverage your
investment. Can the biometric product(s) be used for multiple purposes, such as the following?
✓ Site identification/access
✓ Building identification/access
✓ Secured location identification/access
✓ Equipment identification/access
✓ Mobile device protection
PRACTICAL USAGES
Throughout this book, you’ll find example scenarios in which biometrics is both a sound practice
and a solid investment that can ultimately help ensure security while reducing cost. Additionally,
you’ll find some futuristic examples of how biometrics may be used to provide new services while
maintaining high security.
According to Charles Lynch, Jr. (Vice President of Sales and Marketing for Datastrip, Inc.), vertical
markets using biometrics include the following:
✓ Government—Passports, national identification (ID) cards, voter cards, driver’s
licenses, social services, and so on
✓ Transportation—Airport security, boarding passes, and commercial driver’s licenses
✓ Healthcare—Medical insurance cards, patient/employee identity cards
✓ Financial—Bankcards, ATM cards, credit cards, and debit cards
✓ Retail and gaming—Retail programs, such as check cashing, loyalty rewards and promotional
cards, and gaming systems for access management and VIP programs
✓ Security—Access control and identity verifications, including time and attendance
✓ Public justice and safety—Prison IDs, county probation offices’ use for identification of
parolees, county courthouses’ use for ID systems
✓ Education—Student/teacher identity verification and access control. Biometrics are
now being implemented in large-scale ID systems around the globe. Many new passport
and national ID card systems use some type of biometric encoded in a bar code or smart
chip.
✓ Driver’s licenses—Technologies being recommended by American Association of Motor
Vehicle Administrators (AAMVA), the organization that oversees DMV standards, include
biometrics and two-dimensional bar codes. Georgia, North Carolina, Kentucky, and others
already utilize biometrics on their respective state driver’s licenses.
Outside of the government and military arena, corporate America is stepping up to biometrics
for applications ranging from employee IDs to time and attendance. The bulk of the biometrics
marketplace still consists of traditional systems used to compare fingerprints to vast, centralized
databases of criminals’ fingerprints.
Where possible, this text also depicts some potential future developments for the technologies
discussed.
Facts, Characteristics, and HowBiometrics Can Work for You
The most popular use of biometrics for network security is for secure workstation logons. Each
workstation requires software support for biometric identification of the user, as well as a hardware
device, depending on the biometric being used. The cost of hardware devices is one factor
note
that may lead to the widespread use of voice biometric security identification that can leverage
common sound cards and microphones, especially among companies and organizations on a low
budget. Hardware devices such as computer mice with built-in thumbprint readers will be the
next step. These devices will be more expensive to implement on several computers, because each
machine would require its own hardware device. A biometric mouse, with the software to support
it, is available in the United States for approximately $120. The advantage of voice recognition
software is that it can be centralized, reducing the cost of implementation per machine. At the top
of the price range, a centralized voice biometric package can cost up to $50,000 but may be able to
manage the secure logon of up to 5000 machines.
According to the International Biometric Industry Association (IBIA), the following are important
details about current biometrics and the industry
