By Zoe Moleshead
Biometrics provides enterprises with unique security verification processes, but cost and complexity are preventing the technology from hitting the mainstream.
Biometrics benefits|~||~||~|With the introduction of the e-Gate — a combined smart card and fingerprint verification system — at Dubai Airport, travellers are getting first hand experience of the simplicity and practical usability of biometric devices. The automated entry/exit system is attempting to relieve the workloads of passport control staff and speed passengers’ journeys, while providing Dubai’s Department of Naturalisation & Residency Administration (DNRD) with reassurance that only registered users are entering or exiting the country.“The fingerprint identification is a very significant aspect of the system. Each person can enrol once in the system and because every person’s fingerprint is unique it cannot be duplicated. The gate will only allow those passengers into the system whose fingerprints match the enrolled identifications,” explains Lt. Colonel Khalid Bin Lootah, IT section head, DNRD.With Lt. Colonel Bin Lootah revealing that over 2,500 people completed the registration process for the e-Gate system in its first month of operation, this shows a growing acceptance of biometrics solutions in the region.While users seems to be overcoming their fears about having such personal information stored on databases, organisations are beginning to realise the advanced level of security that can be offered by deploying biometric devices. As such, other regional airports and financial institutions are also reported to be investigating the benefits of implementing such solutions.“Most of the leading banks have been experimenting with biometrics for use with ATM machines, as a means of combating card fraud,” says Waleed Bakr, technical director, Noortech. Similarly, enterprises are recognising the importance of biometric devices in combating sloppy user practises, and eliminating the costly process of reissuing passwords and usernames to employees.“Biometrics emerged because people wanted to replace usernames and passwords, which can be forgotten or written down and given out to people. In a company where information is critical, if a password is insecure then their data is also going to be insecure,” says Divyajot Ahluwalia, product manager, Pixel Digital Systems.Biometrics works by measuring and recording a particular and unique characteristic of a person, be it their finger, hand, face, iris, retina or even their ears or voice. An image of the chosen body part is taken and stored for verification processes at a later date. There are, however, a host of criteria users must consider when selecting a biometrics solution these include, usability, security, availability and acceptability.“Users evaluate biometrics on how secure they are and how easily acceptable they are. By and large, retina and iris scans are the most secure, but very difficult to implement,” comments Ahluwalia.Consequently, fingerprint readers remain the most popular solution, partly because they are the cheapest and simplest device to install, but also because they are increasingly integrated into peripherals, such as mice and keyboards.“70% of biometric installation is in the fingerprint and face recognition category. However, there are also certain voice recognition and hand geometry identification tools in the market, which are relatively easy to use and are installed in areas where face or fingerprint recognition does not work very well,” explains Ahluwalia.Developments in fingerprint readers have also helped to overcome some of the concerns about the insecurity of biometric solutions. Devices, such as Siemens silicon-based biometric mice only recognise ‘live’ fingers.“There have been scams where a fingerprint has been taken off a glass and superimposed into silicon gel and put on a sensor to give verification — that is possible with optic solutions. With a silicon-based device it is not possible for a ‘gummy finger’ ‘ to fool the system,” says Ahluwalia.||**||Solutions|~||~||~|Despite these developments, biometrics has not yet penetrated into the mainstream. Regional enterprises are not clamouring to implement solutions, and this reluctance can be attributed to a number of factors, including cost and complexity of deployment. “Biometrics really hasn’t taken off in the Middle East,” says Radwan Khader, CEO, Synergy Software Systems. “People are aware of biometrics, but most people don’t adopt these solutions because the cost is too high and their need doesn’t justify it. Their need is basic and biometrics is far too sophisticated,” he continues.Additionally, biometrics solutions tend to work more effectively in conjunction with other forms of verification, such as passwords, pin numbers or smart cards. Dual identification is particularly beneficial in large scale deployments, where verification of a finger, hand or face against a large user database can be a time-consuming process. “If an enterprise has 5000 employees and wants to give access via fingerprints, the device has to compare each fingerprint against 5000 others every time, and this is a very slow process — one too many verification. And as the technology becomes more complex — hands or faces — then it is even slower,” says Khader.Consequently, instead of simplifying users’ security responsibilities, biometrics can often add more complexity with additional pieces of information to remember or carry. Furthermore, the cost of deploying two solutions instead of just one makes biometrics even less attractive to the average enterprise.“Anything that is cheap enough people will buy, but there isn’t the commercial business demand for such a high security biometrics. Most people are quite happy with a proximity card and a pin code, and this is secure enough for 98% of commercial users,” comments Synergy’s Khader.Although projects such as DNRD’s e-Gate illustrate the benefits of biometrics when deployed in the right location, for the technology to gain greater momentum in the regional market, users need to incorporate these devices into a larger solution and extend capabilities beyond access control. “People tend to forget that biometrics is just a technology and to make that technology effective you need to have software,” says Khader.As such, enterprises could utilise biometrics devices as part of a wider human resources solution. Noortech, for example, is witnessing greater demand for biometrics as time & attendance solution rather than for security purposes. This is being driven by the fact that biometrics enables enterprises to eliminate so-called ‘buddy punching’.“Companies can use biometrics for time & attendance and scheduling staff. Previously, companies used proximity cards for time & attendance and access control, the problem with cards is that you can give them to colleagues and they can clock you in and out. But users can’t do this with biometrics,” explains Khader.As with most technologies, biometrics is not likely to be deployed on a wide scale until costs fall and the technology matures further. The more sophisticated solutions, such as iris and retina scanning, will continue to penetrate the high end of the market, while fingerprint solutions will garner more users at the low end. However, until users can find a killer reason for implementing biometrics, they will remain a luxury item on most IT budgets, rather than a must have solution.||**||Technologies|~||~||~| There are a whole host of physical characteristics that have been suggested for use in biometrics. Everything from fingers and feet to voice and veins has been assessed at some point. However, accessibility, distinctiveness, acceptability and availability determine whether these characteristics can be practically deployed.Waleed Bakr, technical manager with Noortech, outlines the most commonly used biometrics solutions:Fingerprint VerificationFingerprint verification is potentially capable of high levels of accuracy, however, fingerprint devices can suffer from usage errors, especially when deployed in a large user base. Hand GeometryHand geometry is concerned with the basic outline of the hand’s top and side views (2-dimensional view). Hand geometry offers a good balance of performance characteristics and is relatively easy to use, making it suitable for a large user base. Voice VerificationVoice verification devices can either be inset in telephone handsets or wall-mounted readers. However, many of the devices have suffered in practice due to variability of both transducers and local acoustics. Additionally, the enrolment procedure has often been more complicated than with other biometric solutions.Retinal ScanningAn established technology where the unique patterns of the retina are scanned by a low intensity light source via an optical coupler. Retinal scanning has proven to be quite accurate, but is not particularly convenient for spectacle wearers or people with concerns over intimate contact with a reading device. As such, retinal scanning has user acceptance problems.Iris ScanningIris scanning is the least intrusive of the eye-related biometrics. It uses a conventional CCD camera element and requires no intimate contact between the reader and the user. Additionally, it has the potential for higher than average template matching performance. Ease of use and system integration, however, are not strong points with iris scanning devices.Facial RecognitionA technique that has attracted considerable interest and whose capabilities have been misunderstood. However, facial recognition has had limited success in practical applications. But progress continues to be made in this area and if technical obstacles are overcome, facial recognition may eventually become a primary biometric technology.||**||