Biometrics - the ultimate security?

By on
Biometrics - the ultimate security?

The question for those selling and installing such systems is can they live up to the expectations fused into the public consciousness at the cineplex?

Despite its limitations biometric systems are finding their way into solutions that control everything from access to amusement parks and workplaces to marketing and in-store promotions.

Biometrics are moving from Hollywood hype to being integrated into systems to improve performance, extend their application and deliver greater returns with marginal investment.

And in cases such as smart cards, biometrics may move from augmenting technologies to replacing them, their proponents say.

Speculative fiction inspires and informs developers although the real-world uses are often more mundane.

For instance, IP technologies deployed by security maker Zylotech and its integrator Intravision would be at home on the set of Minority Report and yet it counts culture vultures at the National Gallery in Canberra, says its sales general manager Tim Dobbin.

The previous manual method of using a hand-held clicker couldn't attain the 96 percent accuracy of the video.

Zylotech integrated SmartCatch software from its vendor partner NEC with its deployment of the video management platform and the gallery's security cameras.

The software employs algorithms to interpret motion captured with the four Vivotek IZ7151 IP cameras, which have 18-times optical zoom and progressive-scan charge-couple device sensor, Dobbin says. At the gallery, the software even detects the walking path of those entering.

Vision grabbed and analysed by SmartCatch is run through filters that detect loitering, tailgating, speed, unattended objects and even turnstile hopping. And it discriminates between humans and vehicles.

"We can push that video to any enabled screen anywhere in the world," Dobbin says. The vision once unencrypted is viewed in real-time or sent as a snapshot or video stream for viewing later to an iPhone or PDA.

And if there's an evacuation, the technology assures a more accurate count at the emergency rallying point.

NEC's NeoFace software takes recognition to the next level, capturing and comparing faces against a database of images, says NEC product manager Lance Heather.

NEC says its "adaptive region mixed matching" technology differs from other products because it doesn't rely on ratios between parts of the face such as eyes and nose but on regions on the face with a high degree of similarity.

As such, wearing sunglasses won't throw off its results although like all face recognition systems they rely on quality, full-frontal captures.

It is used in high-risk, sensitive locations such as airports, maritime port authorities and military installations and in private organisations such as casinos and shops, Heather says.

Universal Studios Japan has used it for nearly 10 years to control access to the park. Such access-control applications put smart card sellers at risk, he says.

The software works with a white-list of people who need access or a blacklist of those who are banned from a premises. Uses include identifying known shoplifters, keeping problem gamblers out of casinos, border control and clocking on and off work in place of an access card.

And it can be used in terror investigations to identify suspects' meetings.

Face recognition systems are sophisticated enough that they can detect some demographic information about the user and could direct marketing messages to them while they are in the shop.

These systems need accurate databases of face images, which private organisations such as casinos tend not to share with each other. Heather says projects such as Queensland's smart driver's licence would provide high-quality data for matching.

NSW's Roads and Traffic Authority at the Biometrics Institute conference in Sydney in May ruled out an Enemy of the State approach to database sharing that would see images captured for one purpose used surreptitiously for another, a process known as "function creep".

"Access to the RTA's photo images is very restricted," the authority's general manager of strategy and systems in driver and vehicle services David Putt told delegates.

"Law enforcement can only access those images under certain prescriptive criteria. And in terms of facial recognition, they won't have access. So there'll be no linking CCTV (security cameras) to RTA facial recognition to determine people's identity."

The most common form of biometric data shared today is the fingerprint. Interpol maintains a global database and encourages member nations to share their images through the promotion of a common protocol and technology provided by Sagem.

Biometrics work best when combined with other forms or "factors" of identification to authenticate people, says Arcot Systems chief technology officer, Jim Reno.

At last month's CA World in Sydney and Melbourne he explained how factors such as one-use tokens, passwords, digital certificates, smart cards and multiple biometrics such as iris and fingerprints combine with software authentication in ArcotID, a small file that sits on the client computer to aid secure login to e-commerce sites, for example.

Arcot has a solution that monitors how a transaction is exercised and whether it varies from the norm. For instance, if a user typically accesses a bank website from a Windows Vista machine but the latest access is from a Linux box, the credibility of that transaction would be scored lower and possibly flagged for investigation or denied access, he says.

The issue with all biometrics, says RSA principal IT security consultant Greg Singh, is that accuracy is a trade-off with accessibility: there needs to be some wiggle room in biometric data or else even small changes to the finger or how it was applied to the scanner, for example, would lead to too many false negative readings and access denials making it too difficult to use in the real world.

Nationally, there is no unified database and each government and law enforcement agency has its own systems and access to different types of data from photos to fingerprints and DNA.

CrimTrac, a federal agency established in 2000 with a grant of $50 million to consolidate data-sharing efforts, is embarking on an ambitious biometrics project that includes DNA to match families, trace missing persons, track criminals and apply national face recognition processes.

In April, NSW was the final state to enter into the CrimTrac-managed National Crime Investigation Database that holds more than 400,000 DNA samples collected from felons and evidence found at crime scenes. DNA is the next great biometrics pioneer, says NEC's Heather.

He says a scenario such as that painted in Gattaca, where people are traced and identified based on blood samples, is just around the corner.

"DNA is going to be the real breakthrough in quick identification especially in disaster and law enforcement," Heather says. The Victorian bushfires were recent examples when people could have had their identities reconstructed from their DNA data.

NEC is developing portable DNA units that despatched worldwide to verify identity, he says. And within two years, such DNA data will be common on passports, he says.

Privacy remains one barrier to sharing biometric information. Privacy was a challenge for Centrelink when it installed a voice-recognition system for its 6.5 million customers, says project manager Ross Summerfield.

Its solution based on Intervoice proprietary interactive voice response and Nuance text-to-speech systems outdid Hollywood in many ways.

"Who thinks security is a consideration with a speaker verification or identification system?" he asked the biometrics conference. "What about privacy, is that a consideration?

"Let me tell you, the voice experts are mostly not security experts. The vendors there had absolutely no concept of security."

Centrelink, the Commonwealth agency that handles transfer payments, eventually came to an accommodation that it "could live with", says Summerfield, to secure its 32 million phone calls and 18 million online transactions a year.

Testing the claims of biometrics technology makers is high on the Biometrics Institute's agenda, says founder and technical committee chair Ted Dunstone. It is working on a vulnerability assessment program to systematically test members' technology, he says.

"You could shoot yourself in the foot by putting systems out there that aren't as secure as they should be," Dunstone says, citing the ease with which fingerprint readers are hacked. "Nobody tests these systems."

The institute's efforts, backed by the Department of Prime Minister and Cabinet, resulted in its 2004 privacy code for the use of biometrics that echoes national privacy legislation.

Multi page
Got a news tip for our journalists? Share it with us anonymously here.
Tags:

Log in

Email:
Password:
  |  Forgot your password?
By using our site you accept that we use and share cookies and similar technologies to perform analytics and provide content and ads tailored to your interests. By continuing to use our site, you consent to this. Please see our Cookie Policy for more information.