What is biometrics?

Biometrics is an automated technique of verifying the identity of an individual based on measurable physiological or behavioral characteristics. Biometrics create actual authentication as the physical identity of the individual is verified. Biometrics technology is a non-intrusive way to match the unique characteristics of live individuals in real time against enrolled templates or records.

What do you mean by an automated technique?

Biometrics systems are an automated technique because the analysis of the physiological or behavioral characteristic is done inside the system without human intervention.

Is biometrics technology safe to use?

Biometrics technology & devices have been around for over two decades. The technologies have varying degrees of intrusiveness but present no risk to public health and safety.

Does biometrics technology really work in the real world?

Biometric technologies have been used and tested under the most demanding real world applications and conditions. It has protected facilities that are vital to national security, protected corporate networks to preserve the integrity of data systems, and allowed controlled authenticated access to corporate network and information assets. The real-world results show that biometrics technology is easy to use, robust and cost effective. Today’s biometrics technology is ready for use in commercial, production, and end-user environments.

What are some of today’s biometrics techniques?

Examples of techniques that measure physiological characteristics or the physical traits of the individual include: Fingerprint Scanning, Facial Recognition, Retinal Scanning, Iris Identification, and Hand Geometry.

Examples of techniques that measure behavioral characteristics or what the individual does behaviorally include: Voice Recognition Analysis, Keystroke Analysis, and Handwritten Signature Scan.

What is the most viable biometrics technique available today and why?

Fingerprint scanning is the most viable and established biometrics technique available today to verify the identity of a PC or network user. It is the easiest to use and the most economical to implement in user authentication techniques.

What is the least intrusive of the biometrics techniques available today?

Voice Recognition Analysis is the least intrusive of the biometrics techniques available today but is not a good choice for PC or network user authentication because:
a person’s voice could be recorded and used for unauthorized PC or network access, an illness, such as a cold, can change the voice making absolute identification difficult or impossible.

What is biometrics based strong authentication?

Biometrics based strong authentication uses a unique, non-transferable, physical characteristic such as a fingerprint as an additional factor for personal identification to verify “who” they say they are. It is a system that recognizes a person based on “who they are” and does not rely on “what a person knows or is able to remember” such as PIN numbers and passwords (Factor 1) or “something you have” such as an ATM card (Factor 2) which can be lost, forgotten or stolen. Strong authentication requires at least two of the three factors to provide a stronger authentication than any single factor. Biometrics can provide the third factor for strong authentication by using a factor that cannot change, you.

Is my actual fingerprint stored in the database?

No! Once the fingerprint is scanned, the image is converted into a mathematical template called a “minutia file” which is a data representation of the fingerprint. This is what is stored and later compared against during verification. Furthermore, the minutia file cannot be reconverted or reverse engineered back to the original fingerprint image. The fingerprint image itself is never stored for your security.

What applications can use fingerprint recognition?

A: Any and all applications that currently use a PIN code, password or a combination of user ID methods. These applications include PC-peripherals for secure workstations, PC network security solutions, E-commerce, entry-access systems, door-locks, time-and-attendance machines, ATMs, toys and games…. the possibilities are only limited by the imagination. The exploding market of portable electronics, such as Palm, CE and personal communicators, demand security that cannot be stolen or inadvertently passed on to an unauthorized user.

What are the benefits of biometrics versus conventional methods such as PIN numbers, passwords, keys, proximity cards, etc.?

Conventional methods such as passwords, keys, or proximity cards can be stolen, lost, or inadvertently passed on to an unauthorized user. Biometric methods cannot be stolen or lost. You will always posses your unique fingerprint and no one can steal that from you. By using biometrics you do not have to memorize many different confusing passwords or PIN codes. Your unique fingerprint can be used to gain entry to many different applications.

Isn’t storing fingerprint images considered an invasion of privacy?

It will not be an invasion of anyone’s privacy because the actual fingerprint image is not stored. The fingerprint scanning system transforms the visual fingerprint image into a mathematical template which is a data representation of the fingerprint. This is what is stored and compared against for verification. This template cannot be reconverted back into the original fingerprint image. Your fingerprint data is safely stored in the database but the actual fingerprint image never is.

What if the user is left handed and prefers to use their left hand & thumb for a fingerprint reader?

As long as the same finger is being used for identification it will not matter. The fingerprint reader system will recognize the user’s preferred finger or thumb.

What happens if someone severely damages or loses a finger or thumb?

Any finger or thumb can be used for identification as backup, as long as the same finger or thumb is used for verification each time.

What is the verification speed of a current fingerprint reader system?

The verification speed is generally less than half a second.

Can you duplicate a fingerprint captured by a fingerprint reader system and use it for unauthorized access to other systems?

A: No, because “minutia files” cannot be used in another system without interpreter software. Although minutia files use the same general concept to capture the unique characteristics of any fingerprint to render a data representation, the actual templates are slightly different among different systems due to the proprietary algorithms used by each system.

What are the actual mechanics of the template?

As a fingerprint is initially scanned, up to 90 minutia points are captured and run against an algorithm to create a 200 - 400 byte binary template vector map. It is this template that is stored and compared during the verification process.

What sort of characteristics make up minutia points?

Common characteristics that minutia points are made up of are: Ridge endings (end of a ridge), Bifurcations (a Y-shaped split of one ridge into 2 ridges), and Dots (the center points of sweat glands).

What are the most common types of fingerprint patterns?

Fingerprint patterns are divided into three main groups consisting of: Aches, Loops and Whorls. Approximately 5% of all fingerprint patterns are Arches, 30% are Whorls and 65% are Loops.

Could someone use a picture of a registered user’s fingerprint to gain access into a biometrics system?

No. The fingerprint verification module looks for a live three-dimensional scan of the fingerprint. In addition to the length and width of unique characteristics of the fingerprint, the verification module looks for the third dimension of depth which is determined by the shadow cast by these unique characteristics; i.e., ridges, whorls, loops, bifurcations, etc. There are still other devices that actually look for an electrical charge from a live fingerprint during the scanning process. The user must make contact with their scanning finger with the metal as well as the sensor platen of the scanner for a proper fingerprint scan.

What is a False Acceptance Rate (FAR)?

FAR is when a non-registered user gains access to a biometrically protected system.

What is False Rejection Rate (FRR)?

FRR is when a registered user does not gain access to a biometrically protected system after one attempt.

Can the fingerprint scanner be adjusted for sensitivity to lower a high FRR?

Most of today’s fingerprint scanning units can be adjusted for dynamic threshold to control the sensitivity of the reader. If the FRR (False Rejection Rate) is too high and the threshold is lowered, the false rejection of registered users may be reduced but the FAR (False Acceptance Rate) of accepting non-registered users will increase. The FRR is inversely proportional to the FAR. Usually, the default threshold settings are the best to use for uniform consistent results.

When you scan your thumb, where does the template store itself on the network? Who has access to the template?

No one ever has access to the stored templates. The templates are only used for verification by the system and cannot be retrieved to be manipulated or modified. The template can reside on either a local workstation or the domain server. The highest level of security and performance is obtained by storing the templates on a server.

How long does the file on a customer fingerprint remain current?

Fingerprint templates are not replaced or updated based on length of time because generally fingerprints do not change. Even in the case of scarring or damage to the skin, the scanning process still captures a very high resolution image to identify multiple minutia points for effective verification.

What are the system software requirements to utilize BioShield?

The system software requirements are:
• Microsoft Internet Explorer 5.5 or later for encryption support.

Operating Systems supported:
• Windows NT 4.0 w/SP 6a
• Windows 2000 Professional (December 1, 2001)

How is BioShield used to provide strong authentication to logon to networks?

Bioshield provides a fingerprint based strong authentication system to logon to networks. The registered fingerprint scan verification replaces the password in the typical NT logon screen.

Where are the minutia files for fingerprint verification stored?

The minutia files are stored in the SAM database.

Once the user has been registered with their fingerprint, what is the logon process?

The logon process for a registered user is:
• User presses Ctrl+Alt+Del to invoke the NT logon screen.
• Enter UserName and Domain.
• Place thumb on scanner platen and left mouse button Click on “Scan Fingerprint”.
• Scanner scans fingerprint, creates a minutia file, compares against the minutia files stored in the SAM database, and if there is a match, logs the user on to the network.

Can a fingerprint registered user use their password to by-pass the BioShield system?

The BioShield™ system authenticates the physical person for strong authentication for network logon. The use of a password that can be easily guessed, lost, stolen, or passed to unauthorized users does not result in strong authentication. This is the process if a fingerprint registered user tries to bypass BioShield™:
• User presses Ctrl+Alt+Del to invoke the NT logon screen.
• Enter UserName and Domain.
• Even though the user is registered, he clicks on “My fingerprint is not registered”.
• This will bring up a password screen.
• User types in password.
• BioShield™ verifies the registered user and replies “There is a fingerprint registered for this user, please use your fingerprint to logon”.
• BioShield™ forces the registered user to use their fingerprint and not their password for logon.

Can a fingerprint registered user use the BioShield™ system in a stand-alone mode to access the local PC desktop in case the network is down?

Yes, the BioShield™ system allows local machine accounts?