• What is biometrics?
• Applicability to Computer Security
• Problems with using Biometrics

• Since the inception of the ubiquitous barcode, there has been speculation over some such utility being applied to people in a similar way or otherwise. The fact that everyone is different - i.e., unique, lends credence and plausibility to the subject, and that is exactly how biometrics works.

Identification with biometrics eliminates this need to remember a password or carry a card etc.

With the increased use of computers for information, restriction of access to sensitive/personal data is more of an issue.

By eliminating transferable access data like passwords, numbers such as P.I.N. numbers etc., biometrics can help prevent unauthorized access to ATMs, cellular phones, smart cards, PCs and networks, and facilities.

Guaranteed user access: numbers and passwords can be forgotten, cards, passports and driver's licenses can be forged, stolen, and lost. Biometrics systems of identification eliminate all of these and are infallible - barring bodily dismemberment - accidental or deliberate. (Requiring life-signs would help stop the latter)

There are already some types of biometric systems being used. Some are based on facial recognition or fingerprint matching. Other systems use eye scans, body thermograms, and/or hand geometry, handwriting analysis, handprint recognition and voice recognition. All of these can be used because they are unique, and consistent.
 
 

• Applicability to Computer Security

Biometrics is being used in forensics, criminal identification, prison security, and some corporate civilian application areas.

It can be used during transactions conducted via telephone and Internet (electronic commerce and electronic banking).

It is already being used in hospitals, airports and laboratories. Primary computer users may soon find all their generic keyboards produced with built in fingerprint recognition. (appropriate!)

PCWeek says "As new systems are developed and prices start to fall, the ID verification industry will be taking biometrics to the mainstream." ^8.

PC Week Labs evaluated two face recognition systems, focusing on the systems' ability to give secure and simple alternatives for password authentication. ^9.

Their results indicate that developers are "on the right track, but the ideal system remains to be built."

To me, this sounds a little theatrical and harsh. The progress being made is phenomenal.

For example, PC Week Labs also tested a developer kit, which allows facial recognition to be added to Windows security applications!

Since most access systems from doorlocks to airlocks to data storage access devices and network management systems are computer-controlled, there can be no question that this aspect of the technology revolution is relevant to the computer industry in general.

As at June 16, 1999, the USA worth of biometric market totaled around $100 million, with astronomical increases predicted. Some figures indicate a current 35% growth, brought about by software improvements, computers becoming better able to handle the "power-hungry biometric applications"⁴ and prices falling to levels more compatible with the average client budget.
 
 

• Problems with using Biometrics

The biometric method of identification does have some disadvantages.

The subject has to be physically present for the identification. (tic)

Cost.

New technology is historically cost-prohibitive, but with advances in the field being hastened by security concerns, companies developing Biometrics tools are now able to look at getting prices down to a useful level. By useful, I mean the point where the options can be included in standard devices such as keypads keyboards and locks. One Florida Company now has their product to the point where the cost barrier is breaking. They have a fingerprint device that can be embedded in keyboards, and should cost around $us100. (I feel this figure is dated - they probably have bettered that already - b)

Potential invasion of privacy.

While there are indisputably some (major) advantages and improvements to be gained through the use of Biometrics, there are concerns being voiced by some regarding the suitability and rights involved. With a card, there is no real personal connection (ok, so there IS a record somewhere, that a particular number is associated with a particular person, but we are talking about person verification, not ID verification!) as could be used in the case of alibis etc., whereas biometrics definitively locates a person. There is no argument. That person was in that spot at that point in time. The machine said so!

So, some (companies) fear Biometrics could be opening the door to abuse of systems leading to more potential for invasion of privacy.

Universality. (Compatibility and Standards)

Also of concern are the issues of whether or not the systems should be united with a single standard. Clients might appreciate the ability to swap or upgrade Biometric System Modules at will.

Finally, as with many new technologies, there is user resistance. Always there is some reluctance to adapt, with diehards claiming status quo & being the last to conform. But the benefits in simplicity, security and convenience will ensure acceptance of this paradigm of "person identification".

Appendix 1

? Post-synoidal Idiosynchratic synchopation 'figures' in the matter of cost:-

With developments pace increasing, prices are falling almost in inverse proportion; note the date of the following article! . . .
http://www.zdnet.com/eweek/news/1124/24bio.html
Biometric companies put finger on cheaper security
By Jim Kerstetter in Las Vegas
11.24.97 10:00 am ET
 

Biometric devices--which use finger and palm prints, voice and face recognition, and retinal scans to identify users--have been in place for years in locations where high-level security is needed. But corporations haven't been eager to roll them out widely because even the most basic of biometric identifiers, fingerprint scanners, can cost $400 or $500.
But heightened security fears, along with new and more affordable products, could finally knock down some of those barriers.
"The security [of biometric devices] is the most reliable out there," said Avi Landman, research and development director at Supercom Ltd., in Kfar Saba, Israel. "But if you are above $500, you limit your market."
Who?Vision, of Sebastian, Fla., has finished a prototype of TactileSense, a fingerprint identification device that can be embedded in keyboards. The device, which should start appearing in some keyboards early next year, will start at $100, officials said.
Most fingerprint devices use a prism or large silicon chip to create an electronic record of a fingerprint. But Who?Vision has created a more affordable plastic polymer that captures the fingerprint and delivers it to a much smaller chip. The software used to store the print runs on Windows 95 or Windows NT.
Digital Persona, of Redwood City, Calif., can match that price. The company will release in the first quarter its U.are.U hardware and software system that, unlike the Who?Vision device, includes a central IT management tool.
The fingerprint scanning device and software cost $179 and rely on a prism that receives the fingerprint image. But company officials say their software does not require a high level of resolution, so the prism can be of a lower quality.
National Registry, of Tampa, Fla., and Seattle keyboard maker Key Tronic Corp. this week will ship the Secure Keyboard Finger Image Scanner, a keyboard with an embedded scanner that works with National Registry's suite of fingerprint management software.
The NRIdentity Secure Authentication Facility for Windows NT manages biometric records from a central point. NRIdentity is to biometric authentication what Security Dynamics Technologies Inc.'s ACE Server is to token authentication, said National Registry CEO John Gustafson. The server integrates with Microsoft Corp.'s Internet Information Server 2.0 and Internet Explorer 4.0. But the biometric device isn't cheap, costing in the range of $400 to $500.
Visionics, in Jersey City, N.J., doesn't require new hardware for its $150 FaceIt PC application, which turns a desktop videoconferencing camera into a security monitor. (See PC Week Labs' review of FaceIT.) FaceIt PC measures the geometric shapes of a user's face before granting access to a desktop and blocks out unwanted users with Digital Encryption Standard cryptography.