Biometric Security Technology

INTRODUCTION

The word biometrics comes from the Greek words “bios” (life) and “metrikos” (measure). Strictly speaking, it refers to a science involving the statistical analysis of biological characteristics. Thus, we should refer to biometric recognition of people, as those security applications that analyze human characteristics for identity verification or identification. However, we will use the short term “biometrics” to refer to “biometric recognition of people”.

MAIN FOCUS OF THE ARTIClE

This article presents an overview of the main topics related to biometric security technology, with the central purpose to provide a primer on this subject. Biometrics can offer greater security and convenience than traditional methods for people recognition. Even if we do not want to replace a classic method password or handheld token) by a biometric one, for sure, we are potential users of these systems, which will even be mandatory for new passport models. For this reason, it is useful to be familiarized with the possibilities of biometric security technology.

BIOMETRIC TRAITS

Biometric traits can be split into two main categories:

• Physiological biometrics: it is based on direct measurements of a part of the human body. Fingerprint (Maltoni et al., 2003), face, iris and hand-scan (Faundez-Zanuy, Navarro-Mérida, 2005) recognition belong to this group. 
• Behavioral biometrics: it is based on measurements and data derived from an action performed by the user, and thus indirectly measures some characteristics of the human body. Signature 

However, this classification is quite artificial. For instance, the speech signal (Faundez-Zanuy and Monte, 2005) depends on behavioral traits such as semantics, diction, pronunciation, idiosyncrasy, etc. (related to socio-economic status, education, place of birth, etc.) (Furui, 1989). However, it also depends on the speaker’s physiology, such as the shape of the vocal tract. On the other hand, physiological traits are also influenced by user behavior, such as the manner in which a user presents a finger, looks at a camera, etc. 

Verification and Identification

• Identification: In this approach no identity is claimed from the user. The automatic system must determine who the user is. If he/ she belongs to a predefined set of known users, it is referred to as closed-set identification. However, for sure the set of users known (learnt) by the system is much smaller than the potential number of people that can attempt to enter. The more general situation where the system has to manage with users that perhaps are not modeled inside the database is referred to as open-set identification. Adding a “none-of-the-above” option to closed-set identification gives open-set identification. The system performance can be evaluated using an identification rate. 
• Verification: In this approach the goal of the system is to determine whether the person is the one that claims to be. This implies that the user must provide an identity and the system just accepts or rejects the users according to a successful or unsuccessful verification. Sometimes this operation mode is named authentication or detection. The system performance can be evaluated using the False Acceptance Rate (FAR, those situations where an impostor is accepted) and the False Rejection Rate (FRR, those situations where a user is incorrectly rejected), also known in detection theory as False Alarm and Miss, respectively. There is a trade-off between both errors, which has to be usually established by adjusting a decision threshold. The performance can be plotted in a ROC (Receiver Operator Characteristic) or in a DET (Detection error trade-off) plot (Martin et al., 1989).

Security and Privacy

A nice property of biometric security systems is that security level is almost equal for all users in a system. This is not true for other security technologies. For instance, in an access control based on password, a hacker just needs to break only one password among those of all employees to gain access. In this case, a weak password compromises the overall security of every system that user has access to. Thus, the entire system’s security is only as good as the weakest password (Prabhakar, Pankanti & Jain, 2003). This is especially important because good passwords are nonsense combinations of characters and letters, which are difficult to remember (for instance, “Jh2pz6R+”).