The National Science and Technology Council's Subcommittee on Biometrics & Identity Management recognizes the impact of ongoing challenges, technical evaluations, and technology advancements in the area of biometrics. The following questions and answers have been offered by this valuable resource.
Q: What are "biometrics"?
Biometrics is a general term used to describe a characteristic or a process. As a characteristic, a biometric is a measurable biological (anatomical and physiological) and behavioral characteristic that can be used for automated recognition. As a process, a biometric is an automated method of recognizing an individual based on measurable biological (anatomical and physiological) and behavioral characteristics.
Q: What are the common biometrics?
Biometrics commonly implemented or studied include the fingerprint, face, iris, voice, signature, and hand geometry. Many other modalities are in various stages of development and assessment.
Q: Which biometric technology is the best?
There is not one biometric modality that is best for all implementations. Many factors must be taken into account when implementing a biometric device, including location, security risks, task (identification or verification), expected number of users, user circumstances, existing data, etc. It is also important to note that biometric modalities are in varying stages of maturity. For example, fingerprint recognition has been used for over a century, while iris recognition is a little more than a decade old. It should be noted that maturity is not related to which technology is the best, but can be an indicator of which technologies have more implementation experience.
Q: How are biometrics collected?
Biometrics are typically collected using a device called a "sensor." These sensors are used to acquire the data needed for recognition and to convert the data to a digital form. The quality of the sensor used has a significant impact on the recognition results. For example, sensors could be digital cameras (for face recognition) or telephones (for voice recognition).
Q: What are biometric templates?
A biometric template is a digital representation of an individual's distinct characteristics, representing information extracted from a biometric sample. Biometric templates are what are actually compared in a biometric recognition system. Templates can vary between biometric modalities as well as vendors. Not all biometric devices are template-based. For example, voice recognition is based on "models."
Q: What is the difference between recognition, verification, and identification?
Recognition is a generic term and does not necessarily imply either verification or identification. All biometric systems perform recognition to "again know" a person who has been previously enrolled.
Verification is a task where the biometric system attempts to confirm an individual's claimed identity by comparing a submitted sample to one or more previously enrolled templates.
Identification is a task where the biometric system attempts to determine the identity of an individual. A biometric is collected and compared to all the templates in a database. Identification is "closed-set" if the person is known to exist in the database. In "open-set" identification, sometimes referred to as a "watch list," the person is not guaranteed to exist in the database. The system must determine whether the person is in the database.
Q: Where are biometric technologies currently being deployed?
Biometrics are being used in many locations to enhance security and convenience. Examples of deployments within the U.S. government include the FBI's Integrated Automated Fingerprint Identification System (IAFIS), the US-VISIT program, the Transportation Workers Identification Credentials (TWIC) program, and the Registered Traveler (RT) program. These deployments are intended to strengthen security and convenience in their respective environments.
Many companies are also implementing biometric technologies to secure areas, maintain time records, and enhance user convenience. For example, for many years, Disney World has employed biometric devices for season ticket holders to expedite and simplify the process of entering its parks.
Q: Can I interact with a biometric device without touching something?
This depends on the specific modality being used. For example, with today's current technology, an individual would be required to touch a fingerprint sensor for the system to obtain the biometric sample, whereas face imaging for face recognition and iris imaging for iris recognition are contactless and would not require the user to touch the system.
Biometrics is a security tool available for use. An environment or circumstance may or may not need a biometric system, depending on the application. To determine if a biometric is needed, one must understand the operational requirements of the situation. Biometrics should not be forced; each circumstance should be evaluated to determine the benefits that a biometric may provide.
Q: What if my biometric system doesn't work?
On any biometric system, secondary procedures need to be implemented. It is important to remember that biometrics are a component of an overall system architecture; contingency plans will vary from application to application.
Q: What are the different biometrics modalities and what are their advantages/disadvantages?
Fingerprint advantages:
- Easy to use with some training.
- Some systems take up little space.
- Large amounts of existing data allow background and/or watch-list checks.
- Proven effective in many large-scale systems over years of use.
- Unique to each finger of each individual, and the ridge arrangement remains permanent during one's lifetime.
Fingerprint disadvantages:
- Negative public perceptions (privacy concerns of criminal implications, and health or societal concerns associated with touching a sensor used by countless individuals).
- Collection of high-quality, nail-to-nail images requires training and skill (but current flat-reader technology is very robust).
- An individual's age and occupation may cause some sensors difficulty in capturing a complete and accurate fingerprint image.
Iris advantages:
- No contact required.
- Protected internal organ is less prone to injury.
- Believed to be highly stable over lifetime.
Iris disadvantages:
- Difficult to capture for some individuals.
- Easily obscured by eyelashes, eyelids, lenses, and reflections from the cornea.
- Public myths and fears about "scanning" the eye with a light source.
- Acquisition of an iris image requires more training and attentiveness than most biometrics.
- Lack of existing data deters ability to use for background or watch-list checks.
- Cannot be verified by a human.
Face advantages:
- No contact required.
- Commonly available sensors (cameras).
- Large amounts of existing data to allow background and/or watch-list checks.
- Easy for humans to verify results.
Face disadvantages:
- Face can be obstructed by hair, glasses, hats, scarves, etc.
- Sensitive to changes in lighting, expression, and pose.
- Faces change over time.
- Propensity for users to provide poor-quality video images yet expect accurate results.
Hand geometry advantages:
- Easy to capture.
- Believed to be a highly stable pattern over the adult lifespan.
Hand geometry disadvantages:
- Use requires some training.
- Not sufficiently distinctive for identification over large databases (usually used for verification of a claimed enrollment identity).
- System requires a large amount of physical space.
Speaker/voice advantages:
- Public acceptance.
- No contact required.
- Commonly available sensors (telephones, microphones).
Speaker/voice disadvantages:
- Difficult to control sensor and channel variances that significantly impact capabilities.
- Not sufficiently distinctive for identification over large databases.
Other advantages/disadvantages exist as well. Many other biometric modalities exist and are in various stages of research or commercialization. Examples include gait (the manner of walking), retina and other vascular pattern recognition, ear structure, odor, and palm prints.
Q: Why are there so many different biometric modalities?
Different applications and environments have different constraints. For instance, adequate fingerprint samples require user cooperation whereas a face image can be captured by a surveillance camera. Furthermore, fingerprints are not available for many of the suspects on watch lists. There are also multiple biometric modalities for technical and financial reasons. Wide varieties of modalities are being researched and are available on the market.
Q: Are biometrics safe to use?
Biometrics are typically passive and designed to be safe to use. Biometric systems usually implement ordinary computing and video technology, such as that encountered in a person's day-to-day activities.
Q: How do biometric systems determine "matches"?
Biometric systems can be described, albeit in an oversimplified manner, by a three-step process. The first step in this process involves an observation, or collection, of the biometric data. This step uses various sensors, which vary between modality, to facilitate the observation. The second step converts and describes the observed data using a digital representation called a template. This step varies between modalities and also between vendors. In the third step, the newly acquired template is compared with one or more templates stored in the database. The results of this comparison are a "match" or a "non-match" and are used for actions such as permitting access, sounding an alarm, etc.
Q: What are the common uses of biometrics?
Common examples of biometric use involve controlling access to physical locations (laboratories, buildings, etc.) or logical information (personal computer accounts, secure electronic documents, etc). Biometrics can also be used to determine whether or not a person is already in a database, such as for social service or national ID applications.
Q: Where can biometrics be used?
Biometrics can be used in environments where recognition of an individual is required. Applications vary and range from logical access to a personal computer to physical access of a secure laboratory. They can be used in a variety of collection environments as identification systems.
Biometrics are also used for accountability applications, such as recording the biometric identities of individuals boarding an aircraft, signing for a piece of equipment, or recording the chain of evidence. Of course, biometrics perform more reliably in controlled environments, such as offices and laboratories, than in uncontrolled environments, such as outdoors.
Q: What benefits/cost savings do biometrics provide?
The usefulness of biometrics varies from application to application. To determine its true benefit, one must first develop and understand the operational requirements of the application. Biometrics can provide an automated means for identification of an individual or verification of a claimed identity. Before making a decision, one must ensure that this task will meet the determined operational needs. Biometrics can potentially provide cost savings through relocating security resources or diminishing the expenses associated with password maintenance, or it could cause extra costs by highlighting problems that were previously missed. The cost savings vary from application to application as well.
Q: How do I select a biometric technology?
The effectiveness of a biometric technology is dependent on how and where it is used. Each biometric modality has its own strengths and weaknesses that should be evaluated in relation to the application before implementation. Key factors for selecting a biometric technology include evaluating the environment, throughput needs, population size and demographics, ergonomics, interoperability with existing systems, user considerations, etc. (for instance, an access-control system to a coal mine, where individuals will have very worn and dirty fingerprints, will not be a suitable environment for a fingerprint reader). The careful evaluation of the key factors plays a crucial role in the success of the selected technology.
Q: Will biometrics solve all security problems?
No. Biometrics should be one part of an overall security system implementation plan. A biometric system alone cannot solve a security problem.
