A Reassuring Touch

Apr 1, 2005 12:00 PM, By Jacqueline Emigh

After years of trial-and-error experimentation, biometric identification is finally starting to see wide-scale adoption by corporations and government agencies. The technology is cropping up in systems used for everything from password and credit card replacement to military and law enforcement pursuits.

“Biometrics have been under development for a long time, both in the United States and abroad. Among many chief security officers, the technology has made the transition from curiosity item to the top of priority list. A multitude of problems are all pointing to the same solution,” says Zavi Cohen, founder and CEO of Zvetco Biometrics.

Opinions vary widely on the merits of various biometric approaches. But according to some experts, fingerprint technology is the most mature biometric technology available today, characterized by relatively easy usability and high accuracy.

“Fingerprint recognition was really the first to emerge. We are also seeing more facial recognition, and iris scanning has found a niche that is important, too,” says Barry Johnson, president and CEO of Privaris, another biometrics vendor.

Gary Bradt, vice president of Silex America's Biometrics Division, credits the use of increasingly capable sensor technology for rising accuracy in fingerprint recognition — especially in terms of reduced “false positives.”

Other biometric ID technologies in various stages of development include handprint, voice and signature recognition.

On the consumer side, Microsoft — one of the biggest household names in computer systems — stepped into the fingerprint recognition market in March with a biometric keyboard under the lengthy name “Optical Desktop Elite with Fingerprint Reader for Bluetooth.”

Microsoft's new wireless keyboard comes with a built-in fingerprint reader aimed at enabling customers to use biometric information instead of easy-to-forget passwords when trying to enter password-protected Web sites. Other consumer giants turning to biometrics for password replacement include major makers of laptops and digital cameras.

Meanwhile, for security-sensitive applications inside corporations and government agencies, biometrics are starting to be used either as a replacement for passwords, or as an addition to them.

Managing passwords can be time-consuming and costly for organizations, Cohen says. Moreover, passwords can be relatively simple for interlopers to obtain, especially if employees write them down and post them in conspicuous places. Passwords that are easy to guess, such as the names of family members or favorite colors, for instance, are also a security liability.

By combining biometric identifiers with passwords, organizations benefit from an extra measure of security known as “two-factor authentication,” says David Benini, product manager at Aware Inc.

Today's regulatory climate is the biggest single driver toward corporate biometric applications, according to Silex America's Bradt. Silex produces end-to-end fingerprint recognition systems with components that run the gamut from biometrically enabled printers to access control systems for elevator doors.

Health care organizations — not typically early adopters of new technologies — have turned to biometrics as a tool to support their efforts to meet HIPAA regulations related to the privacy of electronic records.

In one early deployment, Jewish Hospital HealthCare Services in Louisville, Ky., has used fingerprint readers and biometric logon software — together with Sentillion Inc.'s Vergence “single sign-on” software — to allow 2,000 employees access to PCs, kiosks, and authorized applications.

When medical staffers want to review multiple records for the same patient, they select the patient in just one application, and the other applications automatically “tune” to this information.

The implementation also includes a centralized auditing capability from Vergence, designed to comply with HIPAA by letting the hospital's information services team track access to computerized medical systems and documents.

More recently, United Bankers' Bank in Bloomington, Minn., installed a fingerprint recognition system from DigitalPersona for password replacement among both employees and online banking customers.

The biometric system at the bank is designed to make sure that the person accessing bank statements or requesting a wire transfer, for example, is actually the person who is authorized to do so.

At the same time, some entrepreneurs are beginning to deploy biometrics for credit card replacement at the retail level. A company called BioPay, for example, counts customers that include a hair salon in Herndon, Va., and a series of Amoco, BP and Liberty gas station franchises.

Consumers conducting purchases with these small businesses are able to leave credit cards, checks and cash at home — authorizing payments instead by scanning their finger images.

Meanwhile, in military and other government applications, employee ID is emerging as a prime application. At the end of February, for instance, the National Institute of Standards and Technology (NIST) finalized PIV FIPS 201, a standard for new “smart card” IDs that are supposed to be rolled out to all federal employees by 2006, under a Presidential directive called HSPD-12 signed last summer.

The final standard calls for biometric fingerprint ID, along with several other layers of security, including a PIN and two types of encryption, for “scrambling” data on the card: digital certificates and private keys.

The fingerprint ID can also be used to help support criminal background checks of federal employees, according to Aware's Benini.

For other ID applications, TransCore has rolled out a new system that combines biometrics and RFID to identify both vehicles and drivers as they enter a facility.

The new system is targeted at military bases, nuclear plants and other facilities requiring high levels of physical security, says Scott Brosi, TransCore's vice president of secure services.

In an initial test with the U.S. military, TransCore's SecurePass RFID system was used in conjunction with keychain-attachable biometric devices from Privaris carried by drivers inside vehicles, says Privaris Chief Operating Officer Mike Kohonoski.

For situations requiring very high security, the system provides a “control” mode that lets guards use RFID and biometric data to perform a visual verification of the car and driver before deciding whether or not to allow access.

In another mode, “automated assist,” SecurePass can be used to identify pre-screened registered vehicles and drivers, and to grant them access without intervention by a human guard.

Still, despite rising numbers of actual deployments, fingerprint ID systems face lingering barriers in the areas of public acceptance.

Experts cite a number of different reasons why acceptance could be higher. Some say that, rightly or wrongly, certain individuals tend to associate fingerprint recognition with the sort of “fingerprinting” traditionally performed on criminal suspects by law enforcement authorities.

Moreover, some people fear that if their fingerprints are “captured,” their identities can be stolen, too.

These fears are related to technological differences between various fingerprint recognition systems, experts say. Some systems take digital images of fingerprints. Others, such as Silex's, capture only the “minutiae” data.

At press time, NIST still had not determined whether the biometric specification in FIPS PIV 201 would require minutiae or actual digital images, according to Benini. But as many see it, overall acceptance of fingerprint ID and other biometric technologies is bound to grow in the future, as the technology becomes more prevalent, less expensive and easier to manage.

Also for the future, many experts expect that biometric technology will become increasingly less obtrusive. “The systems of today are still very crude-looking, indeed, in comparison to what'll be out there a few years from now,” Bradt says.

FOR THE RECORD

About the Companies

For information, circle the Reader Service number (listed below) or visit securitysolutions.com

Aware Inc.	41
BioPay	42
DigitalPersona	43
Privaris	44
Sentillion Inc.	45
Silex America	46
TransCore	47
Zvetco Biometrics	48

Want to use this article? Click here for options!
© 2009 Penton Media Inc.

This month in Access Control

• Targeting The Customer
• Electronic Pedigrees
• One Hero Among Many
• Who? What? When? Where? Why?
• More from September's issue