Communication and Information Technologies

Tutor Marked Assignment

Dynamic Holiday Limited Biometric Authentication Report

Introduction

This report aims to give a brief overview of the alternatives to the current authentication system being used at Dynamic Holidays Limited. Specifically it will detail the technologies behind both fingerprint and iris scanning, doing a comparison of each in turn, and then ultimately leading to a recommendation as to which would suit the company better.

Biometric Overview

Biometrics, or the singular biometric, is the measurement of living things and in most contexts details the measurement of human beings for security and authentication purposes. This stems from the Greek bios (life) and metron (measure). In a security environment, biometrics are utilised to ensure that the correct people have access to the products and services to which they are entitled. The field of biometrics covers a wide scope of technologies, including but not limited to facial, iris, fingerprint and DNA recognition.

Within the field of biometrics, there are generally two sources of identification classifications: physiological and behavioural. Physiological characteristics are those that we are born with and do not usually change (iris and fingerprints), especially once we have reached adulthood. This excludes the nature of physical injury or various other medical or traumatic interventions. Behavioural characteristics are ingrained within us as we grow and develop (gait and signature) and usually only changed when we make a concerted effort to do so.

The clear advantage to biometric identification is that everyone carries their ID with him or her wherever they go. Short of physical injury, you cannot lose your “token” and it cannot be stolen from you, in the traditional sense. However, with the advancement in technologies there are some downsides within a security context. Certain measures can be taken to copy or clone a person’s “token” and it is up to the IT community to come up with ways to tackle this problem, by finding new ways to ensure an individual’s ID is more secure and less open to cloning or copying.

Broadly speaking, biometrics expands into the following:

1) Gait – which is the manner in which someone walks or runs
2) Fingerprint – which is the physical shape and size of the ridges on a person’s fingers and thumbs
3) Iris Pattern – which is the specific pattern of the iris and its colouration and spacing within the eyeball
4) Signature – which is the handwritten marking used by people that details their last name and initials
5) Login Details – which is either the self-assigned or otherwise assigned username and password used to access a system
6) Scent – which is the use of a system to detect a person’s odour
7) Facial – which is the measurement of a person’s identifying features like the size and shape of the individual extremities (eyes, ears, nose and mouth) along with the distance and angles between each of those extremities
8) Voice – which is the tone, pitch and frequency of a person’s speech pattern.
Furthermore, biometrics can be characterised according to seven principles as detailed in figure 1. (Maltioni et al, 2003)

Figure 1. Seven Characteristics of Biometrics

Fingerprint

As a biometric identifier, fingerprinting is one of the oldest in existence. Both private companies and public entities, like law enforcement, for the identification and verification of individuals, have used it extensively.

Fingerprint security systems work on the basis that every person has a unique and identifiable set of fingerprints on each finger and thumb (even twins). The ridges and valleys that are present have formed with the combined influence of DNA and environmental factors.

Current systems utilise either an optical scanner (where the finger is placed on a pad that scans the fingerprint like a copier) or a capacitive scanner (where the fingerprint is drawn across a “sweep” type scanner).

With the optical scanner, an image is created with the use of light photons, which can illuminate the ridges, and valleys of the fingerprint. Depending on the varying degree of the reflected light, an inverted image is utilised by the system to create a comparative image, which it will then contrast with an image on its database.

As for the capacitive scanner, it also creates a comparative image, albeit in a slightly different manner. These scanners utilise an electrical current based around an integrator, an electrical circuit and an inverting operational amplifier. The manner in which it works in basic terms, is that depending on whether each of the cells detects a valley or ridge, is detected by the varying voltage outputs when carried across those same ridges and valleys. When the combined results are analysed by the scanner an image is created.

Because the capacitive scanner requires a physical fingerprint to allow for the transfer of voltage rather than simply detecting light and dark, it becomes apparent that it is preferable as the chances of “tricking” the system become much harder.

In terms of the actual analysis of the fingerprint data, most systems only account for the “minutiae” which are specific features. This is because analysis of the entire fingerprint would be far too resource intensive and so take far too long. This would make it both costly and impractical.

Iris

Iris scanning as a system utilises the idea of a person’s unique iris pattern. The iris is a person’s coloured ring of muscle that surrounds the pupil, and is genetically determined. In the same way that we all have unique fingerprints, we also have unique irises, including the twins amongst us.

With this system, a specialised camera is used under both normal and infrared lighting conditions. These two captured images are then analysed by a computer to discard any superfluous data (like eyelashes) and then using an algorithm compiles a template, a 512-digit number called an IrisCode, which it links to your personal data and then stores in a database.

Once your iris image is captured and stored in the database, along with your details, all you have to do is simply have your iris scanned whenever you want access and the system will compare it to the image on the database. If it is a match, the system will allow access.

Comparison (Fingerprint v Iris)

For this section, I will detail both the advantages and disadvantages of both systems. I will then detail a comparison based on convenience, reliability and acceptability.

Iris recognition (Advantages):
• Highly accurate
• Fast verification time
• No issues with stolen identity as biological degradation makes it unlikely
• Hygienic and low maintenance

Iris recognition (Disadvantages):
• Can be considered intrusive
• Highly data intensive
• The technology behind these systems is costly

Fingerprint (Advantages):
• Highly accurate
• The technology behind these systems is economical
• Is highly standardised and widely used/developed
• User friendly
• Not data or resource intensive at the database level

Fingerprint (Disadvantages):
• Some people are uncomfortable with the association with criminality
• Simple issues can result in false results (eg dirty fingers/scrapes/burns)
• Not necessarily appropriate for children as the shape/size of their fingerprints changes with growth (although this is mainly a long term issue)
• Image capture at the source level can be data intensive if a decent image quality is to be guaranteed

Convenience

Both systems are extremely convenient and can be installed, and used relatively easily by both staff and customers.

Iris scanners because they are contactless require no cleaning, and are very low maintenance. This makes them more convenient in a high volume customer area, for both staff and customers.

The iris scanner is also not weather reliant. In other words, if it is cold, and people are wearing gloves there is no need to remove anything.

Reliability

The iris scanner is far more accurate and reliable as it scans for far more detail than the fingerprint scanner. In addition, it is less reliant on the person keeping the system updated, as there are no changes with age.

The iris scanner is also less susceptible to issues like dirt, or the varying health conditions suffered by many people like dry skin.

This means the system is more secure for the company and less prone to identity theft for the customers.

Acceptability

Generally speaking, people seem more accepting of the idea of an iris scan than they are fingerprints. This is because, rightly or wrongly, people have a preconceived notion of the idea that fingerprinting is seen as something linked with law enforcement and criminality.

Both company and customer needs are met with the iris scanner as it is generally more accepted.

Recommendation (Fingerprint v Iris)

Based on the information provided in the previous section regarding both the advantages and disadvantages along with the comparison of convenience, reliability and acceptability I believe that the company should invest in iris scanner technology.
I have come to this conclusion because I believe on balance that the rewards overall outweigh the costs.
This is due to the following points:

• The iris scanner is far more accurate than the fingerprint scanner both for enrolment and verification
• The iris scanner has a lower maintenance overhead long term because it is contactless
• People will be more accepting of the iris scanning system
• The iris scanning system does not need constant updating due to age etc.
• The iris scanning system is far less data and resource intensive meaning savings can be had long term
• The iris scanner can be used in all weather

Conclusion

This report has aimed to educate the management team regarding the alternative use of either iris or fingerprint technology to replace the existing wristband system.

In detailing the technology, and how each of the systems can best enhance the experience of both the company and the customers, I believe an informed decision can be made as to whether to change the systems and which of the two alternatives is best.

Additionally the advanced addendum below gives those with technical knowledge an insight into the advances currently being made in the relevant fields of biometrics.

Technical Information (Advanced Addendum)

This addendum is included for those recipients who require a more detailed and intricate knowledge of the systems involved.

Overall Information

Biometric security systems are based on a five-point architecture: storage, sensors, feature extractor, matcher, and decision maker. See figure 2. (Wong and Walker, 2012)

Figure 2. Biometric System Architecture

The sensors (either input or contactless) are used for the capture of the data. The feature extractor utilises the raw data from the sensors to convert it into a template and is a form of non-reversible compression. This aids in the resources necessary to process the information and assists with the security of the access data being used. The storage (either locally or networked based) houses the database with which the templates can be accessed and compared for verification purposes. It should be noted that the links and the storage media must be setup with secure measures in place to ensure the integrity of the data. The matcher then does a comparison between the sample and the stored information and a resultant template detailing the similarities is produced. Finally, the decision maker will, based on the similarities found by the matcher, decide on the suitability of the original sample given as to whether to grant or deny access to the specified individual.

Fingerprint Information

Fingerprint scanners utilise either optical (CCDs and CMOS-based) or solid-state (capacitive) sensors for the capture of data. During the scanning process, and the detection of the singularities, the image is converted into a “ridge orientation image” and is represented by the positioning of the lines and their associated angles between these lines and the horizontal axis (known as theta θ). See figure 3. (Wong and Walker, 2012)

Figure 3. Ridge Orientation Image

Iris Information

Based on the landmarks of the iris and the associated algorithms, identification and verification can take place using iris scanners. Patterns of the iris, along with other characteristics, can be described and mapped by use of the 256 bytes of data (polar co-ordinates) and control bytes (used to exclude extraneous information – eyelashes etc.). This IrisCode comparison amounts to the Hamming Distance (HD) and dependant on the results, either comparative with the statistical data or not, will result in a match or non-match. See figure 4. (FBI pg.116) For the IrisCode example with the relevant iris comparison.

Figure 4. Localised Irides with IrisCodes and Pictorial Representation of IrisCode

Error Information

Within the scope of biometric systems, there is an element of error and risk assessment. All of the data sources carry with them an ability to either given false positives or negatives. This depends on the threshold set by the administrator of the system. These are technically known as false match or false non-match respectively. The assessment of any system is based on the FMR (False Match Rate) and it’s FNMR (False Non-match Rate) probability. This statistical data threshold is set and measured over a period of time and gauges the EER (equal error rate) where the FMR and the FNMR correspond at a particular threshold setting. Figure 5. (Wong and Walker, 2012) details the variation according to the given threshold.

Figure 5. EER/FMR/FNMR Graph

Bibliography

Biometrics Center of Excellence, (2016). Iris Recognition. [online] Available at: https://www.fbi.gov/about-us/cjis/fingerprints_biometrics/biometric-center-of-excellence/files/iris-recognition.pdf [Accessed 2 Mar. 2016].

HowStuffWorks, (2002). How Fingerprint Scanners Work. [online] Available at: http://computer.howstuffworks.com/fingerprint-scanner.htm/printable [Accessed 2 Mar. 2016].

Explainthatstuff.com, (2016). How do iris scans work? Who invented them? - Explain that Stuff. [online] Available at: http://www.explainthatstuff.com/how-iris-scans-work.html [Accessed 2 Mar. 2016].

Oneiricocelotutm.blogspot.co.uk, (2016). Iris Recognition vs Fingerprint. [online] Available at: http://oneiricocelotutm.blogspot.co.uk/2011/12/iris-recognition-vs-fingerprint.html [Accessed 2 Mar. 2016].

Wong, P. and Walker, M. (2012). T215 Communication and Information Technologies Block 4 Protecting and Prying. 2nd ed. Amersham: Halstan & Co. Ltd., Part 6 Biometrics.

Walker, M. (2012). T215 Communication and Information Technologies Block 4 Protecting and Prying. 2nd ed. Amersham: Halstan & Co. Ltd., Part 8 Writing longer reports.

[TOTAL WORD COUNT: 2240]

Question 2

Executive Summary

Dynamic Holiday Limited requires an authentication system to replace the current wristband RFID system.

Viable options that have been proposed include fingerprint and iris recognition systems. The existing system is no longer fit for purpose and the customers have a long-standing complaint that has spurred the company into considering the available alternatives.

An overview has been given regarding the field of biometrics, and then more specifically the systems surrounding fingerprint and iris scanners has been explained, including the pros and cons of both. Using the requested criteria of convenience, reliability and acceptability a comparison has also been done to give a better understanding of the two systems and their compatibility with the needs of both the company and the customers.

This leads the report to give a justified recommendation based on the evidence provided as to which system the company should employ in the future. This is taken from a combination of the pros and cons and the matching of the convenience, reliability and acceptability criteria given by the company.

Lastly, there is a final technical section, which has been created for the advanced members of the management tea, to make them aware of the current and future developments in the field of biometrics and how each of the systems works. Overall, it includes the information pertinent to the field of biometrics as a whole, how the fingerprint and iris systems capture data, and then details the error algorithm information.

The conclusion then details the findings of the report in a more succinct manner and the manner in which the final decision was made when making the recommendations to the management team.

[TOTAL WORD COUNT: 272]

Question 3

Overall Information

This section was included because it gives a technical breakdown of the system processes into their individual parts. It also details the various methods of transfer and storage of the data and the manner in which the system utilises that data to make a comparison for the purposes of authentication and verification.

Fingerprint Information

This section was included to give a more in-depth look at the algorithm data, and the manner in which the mathematics of the assigning of the data, collected by the fingerprint scanner works.

Iris Information

This section was included because it gives a more detailed description of the IrisCode system that is used by the iris scanners. It also gives further information about the algorithms in play, and the manner in which the coding system utilised the distance measuring factors like HD.

Error Information

This section was included to provide an overview of the details surrounding statistical analysis. It also provides details about how those statistics are used to build a framework for the recognition systems, and the manner in which thresholds can affect the accuracy and usability of the systems.

[TOTAL WORD COUNT: 187]

Question 4

Checklist for ‘Dynamic Holiday Limited Biometric Authentication Report’

Grading for ‘Dynamic Holiday Limited Biometric Authentication Report’

References

Chavez, C. (2014). Samsung Galaxy S5's fingerprint scanning home button detailed in new report. [online] Phandroid.s3.amazonaws.com. Available at: http://phandroid.s3.amazonaws.com/wp-content/uploads/2014/02/fingerprint_scan.jpg [Accessed 3 Mar. 2016].

Thumbs.dreamstime.com, (2016). Iris Eye Scan. [online] Available at: http://thumbs.dreamstime.com/z/iris-eye-scan-1018945.jpg [Accessed 3 Mar. 2016].

Wong, P. and Walker, M. (2012). T215 Communication and Information Technologies Block 4 Protecting and Prying. 2nd ed. Amersham: Halstan & Co. Ltd., Part 6 Biometrics p. 163

Wong, P. and Walker, M. (2012). T215 Communication and Information Technologies Block 4 Protecting and Prying. 2nd ed. Amersham: Halstan & Co. Ltd., Part 6 Biometrics p. 166

Wong, P. and Walker, M. (2012). T215 Communication and Information Technologies Block 4 Protecting and Prying. 2nd ed. Amersham: Halstan & Co. Ltd., Part 6 Biometrics p. 177

Biometrics Center of Excellence, (2016). Iris Recognition. [online] Available at: https://www.fbi.gov/about-us/cjis/fingerprints_biometrics/biometric-center-of-excellence/files/iris-recognition.pdf, p. 116 [Accessed 2 Mar. 2016].

Wong, P. and Walker, M. (2012). T215 Communication and Information Technologies Block 4 Protecting and Prying. 2nd ed. Amersham: Halstan & Co. Ltd., Part 6 Biometrics p. 189