Thumbs up for new fingerprint technology
April 02 2004 at 09:29AM
By Jennifer Stastny
Recently my bag was surreptitiously stolen while I was in a coffee shop with a friend. When I realised it was gone, it wasn't the lost cash that made me miserable so much as the prospect of having to apply for new bank and driver's cards, not to mention having new keys cut for my car (no cracks about not having a spare set, please).
It borders on the absurd that we routinely entrust the safety of our financial and physical assets to puny pieces of plastic and metal that can so easily be lost or taken from us. It would be far more practical to surgically implant an all-purpose identifying microchip safely under the skin - or, if that makes you squeamish, to use a part of the body as an all-purpose access card.
This is what biometrics is all about: converting unique physical and behavioural characteristics of the human body into electronic "keys". Only characteristics that are unique, constant and - most importantly - easy to scan are suitable for biometric identification. Current DNA analysis, for example, is too costly and time-consuming to be an effective biometric tool.
(Sidebar)
Prints: US company Indentix Incorporated, billed as the world's leading multi-biometric security technology company, offers a splice-free, continuous full-hand capture with a system called Performance Rotating Optics.
As a rule, it's not the actual fingerprint whorls and swirls that are measured
Retinal scans, though reliable, are also pricey and require that a light is shone through the pupil and onto the sensitive retina at the back of the eye - not a pleasant sensation at the best of times. Face geometry, gait analysis and tongue prints are all being punted as The Perfect Biometric Marker of the Future, but at the end of the day it's good ol'-fashioned fingerprinting that has cornered the lion's share of this promising market, generating over R2-billion in revenue worldwide in the past year.
Technically, "fingerprint" biometrics is something of a misnomer. As a rule, it's not the actual fingerprint whorls and swirls that are measured. It's the "minutiae", those minuscule points where the fingerprint ridges terminate and split, that matter. To obtain these minutiae readings, an optical fingerprint scanner will capture a high-resolution greyscale bitmap of a fingerprint (much like the one you see at the back of your driver's licence) and extract the minutiae information from it using a complex set of algorithms. This minutiae signature can then be stored on a smart card or a central database, and the original fingerprint scan discarded.
The main reason for going to all this trouble instead of simply using the fingerprint itself is file space: a 500 dpi (dots per inch) fingerprint scan can hog up to 240 Kb of memory, whereas a signature of 30 to 40 minutiae points typically takes only about 256 bytes. It's also reassuring for the person whose fingerprint is being scanned that there's no real reason to keep the original print (although apparently most government departments do). Once extracted, minutiae signatures can be used for what in biometric terms is known as identification or verification.
Identification is the process of answering the question, "Who are you?" It involves comparing a fingerprint - or, rather, the minutiae signature derived from it - with a database of previously captured minutiae signatures for a possible match. A successful match will inform the system who you are, based on the profile attached to the original minutiae signature in the database.
In South Africa, biometric fingerprint identification is slowly inching out employee discs and swipe cards in the field of access control. Defencetek, a branch of CSIR that develops information systems for the Defence Force, has been using fingerprint scanning to restrict access to secure areas and company computers since 2001. It won't be long before even small companies will ask new employees to stop by HR to have their fingerprint enrolled into the system, rather than sending the office assistant to have an extra key cut.
'The thing to remember is, any security system can be defeated'
Biometric identification is also becoming increasingly popular for payroll management, especially in companies that have a large complement of casual and remote staff. When take-away health-food chain Kauai Juice traded in its unwieldy card-based punch-in system for a biometric model about two years ago, each branch was equipped with an optical fingerprint scanner connected to a computer with its own small, updatable database of casual workers. After being enrolled to the database, staff members need simply scan their fingertips each time they clock in or out.
Such biometric time management significantly eases the administrative load for branch managers like Nuraan Snyman, who says it used to take her "forever" to reconcile staff working hours using the old punch-in card system. In addition to this, it reduces the possibility of time fraud through "buddy-punching", according to Cape Town-based Transmetrix, the company that developed Kauai Juice's biometric system.
If identification answers the question "Who are you?", verification answers the question "Are you who you say you are?" by performing a one-on-one comparison of two sets of minutiae - one of which is usually stored on a smart card - rather than a one-to-many comparison against a database.
Fingerprint biometrics using smart cards is already being used for distributing old age pension, child support and disability grants in four of South Africa's provinces. Each claimant is issued a smart card containing his or her photograph, minutiae signatures, and a transaction record of previous payments. Once a month, the claimant goes to a mobile pay point where the machine reads the smart card and compares it with a live scan of the claimant's fingerprint. (There are 90 of these pay points servicing 648 locations in the Eastern Cape alone.) A match verifies that the person is who the card says he or she is and the money is paid out. A log of the transaction is also written to the smart card to prevent multiple claims from being made in the absence of a real-time central database.
But what's stopping some desperate soul from lopping off granny's finger the moment she breathes her last and using it to collect her pension payout? "There have been some attempts like that," admits Hannes Koegelenberg of FACE Technologies, the company that developed the State's smart card biometric system.
"But pulse meters have been built into the fingerprint scanners to detect whether the finger is alive or not. The pay point is also manned by a paymaster who ensures that the person making the claim is the same person whose photograph is on the card."
But even under the watchful eye of a paymaster, someone with sufficient determination and know-how may be able to fool both fingerprint scanner and pulse meter by making "gummy prints" - gelatine replicas of authorised prints that are placed over the fingertips.
"The thing to remember is, any security system can be defeated," points out Transmetrix's Charlie Stewart. "Biometrics simply raises the stakes to the point that the cost of defeating the system outweighs the benefit."
Judging by the current rate of growth in the biometrics industry (worldwide revenues are expected to exceed R4,6-billion by 2008) it won't be long before you'll have to supply your pawprint to do anything from open a bank account to park your car. Every corner café and retail loyalty club will have a database of fingerprints, even if they use a database-free, one-on-one smart card verification system for transactions. What guarantee does the individual have that these bodies will protect these files from theft or misuse? After all, your biometric markers are yours for life; you can't cancel them like a credit card.
At present, there is no guarantee. Employers are not obliged to discard an employee's fingerprint scan after extracting the minutiae signature, even though they may wish to do so out of space considerations. And there is no pressure on them to safeguard their biometric databases any more than they wish to. Perhaps of more concern is that not all biometric markers require a person's cooperation to be scanned. An individual's gait and face geometry, for example, can be analysed without his or her knowledge. It's a case of Big Brother watching, analysing and filing you away for future reference - or, worse, comparing you with a database of criminals for a potential match.
There is no doubt that biometrics will be a part of everyone's life in the near future. As far as protecting my property is concerned, I'd trust my fingerprints above my signature or a set of keys any day. But it seems that technology has again outstripped the slower-moving machine of legislation when it comes to the question of biometrics, and until they are more or less on an even keel, it may be wise to stick to credit cards and car keys. At least they can be cancelled and replaced.
Images captured with the TouchPrint 3800TM Full Hand Scanner include
* Fingerprints
* Interdigital
* Cup
* Thenar
* Hypothenar
* Carpal Crease
* Writer's Edge
# This article originally appeared in the April 2004 issue of the South African edition of Popular Mechanics magazine.
iol.co.za
steve |
