Fullscreen HTML5Med Res (??MB)HTML4

In the recent futuristic sci-fi film “Gattaca” an astronaut candidate was going for an interview. He was asked to place his hand on a scanner and, after a second or so, was told he could leave. “What about the interview?”, he asked. “You’ve just had it” was the reply. Far fetched? Perhaps. A long way off? Perhaps. But then again, perhaps not. With biorecognition technology, it could be a lot closer than you think. – Checking to see if you really is YOU! By JON REID* 14  Silicon Chip D o you use keys to enter your workplace? That is now old technology. In the not-too-distant future you can expect to have some sort of biological scan to enable you to enter your workplace, club or other organisation, to do a financial transaction or even use your workplace computer. All this comes under the heading of biometrics or biorecognition. Some people regard the digital age as dehumanising. But the joke is on them: the human body lies at the heart of plans to wire banks, streamline government payments, secure the workplace and even to protect computers, driver’s licenses and credit cards. So the age of the body-part password is upon us. Our unique biological characteristics, such as hand geometry, eye structure, fingerprints, voice patterns, even our odour – are being mapped and digitised as part of the booming new biometric business. Biometric technology operates much as portrayed in recent films such as “Mission Impossible”. Computer scanners confirm a person’s identity by scanning a biological feature, then matching it with a digital file containing those exact characteristics. Identifiable traits can be physical, such as a hand contour or retina patterns. They can be behavioural, such as voice modulation, or even typing methods. Some can seem a little outlandish; features being tested for singularity among the planet’s six billion people include knuckle creases, body odours and even acoustic head resonances The HP4 hand scanner. Note the finger guides which ensure the user places his or her hand in the right spot. (have you tapped your head lately?) So, are we ready to have the patterns of our fingers, eyes and speech stored in central databases and traded like commodities by direct marketers, insurance companies and government agencies? It is already being done. Currently in NSW, bailees submit to biometric fingerprint scanning at their local police stations for identification. If the bailee is wanted or needs to be detained by police, the doors can be automatically locked. In the USA, travellers between the state of Montana and Canada are verified by voice recognition before access back and forth is granted. At Los Angeles international airport, US residents do not have to wait in long queues for passport verification; they simply place their hand into a reader and then they may pass through. At the recent Gartner Group’s IT Expo Bill Gates made the comment that “biometric technologies – those that use human characteristics such as fingerprint, voice and face recognition, will be among the most important IT innovations of the next several years”. Authentication One of the most important ethical issues of this technology is to acknowledge that its purpose is not only to confirm a person’s identity, but more importantly, to authenticate that person’s eligibility to access a particular service. Essentially, there are three components to authentication: Identification: this is a one-time process to establish an individual as a unique, named person. Confirmation of Eligibility: again, this is a one-time process to confirm that the named individual is eligible for the benefit or service to be accessed. Authentication Credential: this is something that identifies the individual as eligible and permits them to access the service or benefit on a recurring basis. Traditionally, these credentials have been in the form of cards, passwords or PINs. Now bi- The V-20 finger scanner in use. Here the finger is placed on the optical window and recognition normally takes less than a second. January 2001  15 This Fingerscan has both finger sensing and card swiping for increased security. ometrics are being used, with greatly enhanced results. Privacy To some people the need to identify themselves is intrinsically distasteful and demeaning. It is symbolic of the power that any organisation they are dealing with has over them. Having to present a biometric is considered by some as not just a form of moral submission to authority but also physical submission. To them, biometric identification represents the ultimate invasion of personal privacy. Certain biometric techniques do require touching a communal reader, which may be unacceptable to some, due to cultural norms or religious beliefs. Others are apprehensive about interacting with a machine because they are not familiar with the technology or are afraid that biometrics may cause them discomfort or harm. As noted earlier, the biometric techniques that have gained the most user acceptance are fast, easy to use and perceived as the least intrusive, such as fingerscan, hand geometry and facial recognition systems. There is no evidence that any biometric system has adversely affected or injured any user. In addition, no commercially used systems present health risks, leave marks or take physical samples from users. Use of biometric identification is interpreted by some as a questioning of their reputation and trustworthiness. They perceive a requirement to give a biometric as a reversal of the pre16  Silicon Chip sumption of innocence – shifting the burden of proof. Without pre-existing evidence of wrongdoing, organisations are requiring them to sacrifice their personal privacy. These privacy concerns are heightened by the fact that fingerprints are strongly associated with law enforcement. As a result, finger scanning may be seen not only as an invasion of privacy but also as an indignity and an embarrassment. Some people feel they are being treated like criminals. However, this concern does not appear to be shared by the majority of people. For example, one Australian survey found that 87% of respondents thought finger scanning was a legitimate identification requirement, 91% believed that the use of finger imaging was justified to control entry to high security areas, 77% to verify the identity of persons cashing personal cheques for large amounts, and 76% to identify persons using credit cards for major purchases. More than four out of five (83%) respondents rejected the view that using finger imaging to verify a person’s identity was akin to treating them like presumed criminals. Applications Biometrics was originally developed (in the 1950s), for secure access control, initially to sensitive military sites and intelligence organisations. Today, this remains a core application for the technology, due to the unique benefits it offers. First, security can be greatly enhanced, as the system is not assumptive. All other access technologies assume that, if a person possesses the correct key, card, token, code or password, then he/she must be that person. Biometrics is reality-based, in that it requires the physical presence of the person in question. Second, the costs, time and complexity of managing an access control system are greatly reduced, as no infrastructure needs to be issued – people require only their fingertip to gain access. Third, security levels are maintained, as unauthorised or accidental ‘handing-on’ of cards, keys, etc cannot occur. Time and Attendance In the past decade, employers have recognised the unique benefits of replacing traditional work-reporting practices (time clocks, attendance books, etc) with biometric devices. Because it requires the physical presence of the correct individual, it eliminates the potential for an employee to clock on or off for a colleague or for them to overstate the number of hours worked – some employers have reduced their total payroll by about 2%. As an example, Woolworths Australia uses Fingerscan devices for its 75,000 employees in almost 500 stores – and has done so for over three years. Another application is providing access to the rear of ATMs across Australia by Armaguard. IT Security Information Security Biometrics is now replacing managed password and other access methods to IT systems containing sensitive or secure data. Oracle, the world’s largest database company, has recently released an optional software module which enables access to its databases via a Fingerscan device – the only biometric device it has ever endorsed. Other manufacturers such as Key-tronic have incorporated biometric scanners into their keyboards. Compaq have recently released the first laptop with a built-in scanner. Securing workstations and servers with fingerprint login instead of passwords also reduces the amount of time wasted by computer help desks. In some cases the savings can more than 20% of total time spent by the help desk. Available technology Biometric equipment is currently available in Australia in the following formats: * Fingerscan * Iris Scanning * Handscan * Vein Scan * Voice Scan * Facial Scan * Eye Scan * Retina scan * Signature Scan * Odour Scan Fingerscan Fingerscan does not take a fingerprint, which is prohibited by privacy legislation in Australia (other than used by police). Instead, it takes a 3-dimensional optical scan of a person’s finger-tip, looking at such features as colour, width, height of ridges in the skin, etc. The scanning is performed by a CCD camera. A person is ‘enrolled’ by placing their finger a number of times against a glass square – this process takes about 30 seconds. A unique file, or ‘template’ of that person’s finger is then stored in the device’s memory. To verify their identity, a person simply calls up their ‘template’, and places their finger, once again, against the glass. A comparison is made between the stored file and the live finger and verification is made in less than a second. An electronic log of all transactions is recorded, to provide an irrefutable audit trail of events. The Fingerscan is usually mounted against a wall or suitable vertical surface. Earlier units consisted of a All of the information on authorised persons can be held in a central data base with virtually un-limited numbers. Some systems are so clever they automatically upgrade the data base if the person’s scan reveals changes (eg weight loss!). microprocessor board with an inbuilt communications front end. Today it uses miniature embedded 486-based computers. The Fingerscan V20 has an Ethernet 10BaseT interface, a multi-language screen and is capable of remote administration via modem. It can also connect to common alarm panels. Moreover, it is secure from illegal penetration and override from the unsecured side as the unit is not capable of switching the correct signals to the alarm panel if the unit is ripped off the wall. Handscan This technique uses a three-dimensional image of the hand and measures the shape, width and length of fingers and knuckles. A user places a designated hand on a reader, aligning the fingers with positioned guides. First, each employee is “enrolled” in the system. Three hand images, measuring more than 90 three-dimensional characteristics, are taken and averaged to become the initial master record or “template” for that employee’s hand. The enrolment process takes between 30 seconds and two minutes for each employee. After that, every time an employee uses the Hand Reader, the template is updated by recomputing the measurements to include the most recent hand image. By continually updating the template, the Hand Reader automatically adjusts for the normal changes in a person’s hand, caused by gaining or losing weight, aging, etc. More than 32,000 templates can be stored in each Hand Reader. The time/attendance software contains a template management system, which stores the templates on a central database. Employees are assigned to the Hand Reader(s) that they are authorised to use. Since many Hand Readers can be networked to the central computer, a virtually unlimited number of templates can be stored. Hand placement is simple, and the Hand Reader provides visual feedback, with a series of LEDs, to help users position their hands correctly. The need to reposition a hand disappears after the person has used the reader a few times. Once an employee learns proper hand placement, verification takes less than a second. The scanner disregards surface details, such as fingerprints, lines, scars and dirt, as well as fingernails, which may grow or be cut from day to day. Hand scanning is widely used in Australia in security situations. The most well known application of this technology was at the 1996 Summer Olympic Games in Atlanta, USA. Hand geometry was used to identify about 150,000 athletes, staff and other participants. Handscan is currently installed at more than 50,000 sites worldwide. Costs of biometric equipment Finger scanning units can be purchased commercially for approximately $2000 to $3000 each while hand scanners are sold for about $2500 to $3500 per unit, depending on the options required. Retina scanners still are rather expensive at about $5500 to $8000. Voice scanning hardware can be purchased from $300. Further information can be obtained from the following web site: www. bio-recognitionsystems.com.au SC *Jon Reid is CEO of Bio Systems who can supply, install a full range of Bio Equipment. Phone (02) Fax (02) 9487-5771. Recognition support and Recognition 9489-9379; January 2001  17