Biometrics: The Anatomy Lesson
Digitizing various unique human characteristics is getting to be big business, largely owing to the fact that biometrics—the technology of personal identification via physical attribute—is an extremely secure method of authentication, confirming that the person with whom we're communicating or allowing access to our office, plant, or electronic world is in fact who he or she claims to be.
In 2000, expenditures for biometric authentication systems reached $66 million worldwide, a combination of finger scanning, hand geometry, iris and retina scanning, face recognition, and voice and signature verification technologies, according to Frost & Sullivan, a leading market research firm, in its "Total World Biometrics Market" report. The forecast through 2006 is for an overall compound annual growth rate (CAGR) of 54 percent, attaining market levels near $900 million.
In its September 2001 study, "Biometric Market Report 2000–2005," the International Biometric Group (IBG) projects even further growth: as much as $1.9 billion by 2005.
The use of biometric authentication today is mostly seen in finance, health care, government and military, education, travel, and network and Internet environments, where the prevention of information or identity fraud spurs the growing adoption rate.
------------------------------------------------------------------------
Total Biometric Revenues: 1999–2005
Source: International Biometric Group, New York, NY; 1.212.809.9491
TOTAL BIOMETRIC REVENUES are expected to grow rapidly through 2005, according to a recent report from the International Biometric Group. The greatest gains will be in computer and network access and e-commerce, although public-sector implementations will continue to be a substantial part of the market.
------------------------------------------------------------------------
National and local legislation is another driver. One example is the federal Health Insurance Portability and Accountability Act (HIPPA), which mandates that health care providers incorporate strong methods to minimize unauthorized access to patients' medical records.
The IBG predicts that revenue in these emerging authentication sectors (computer and network access, e-commerce, and physical access—measuring a person claiming an identity against that person's template, one to one) will surpass that of mature identification sectors (criminal and citizen—searching for the best match in a large database of templates) by 2004, accompanied by dramatic growth rate differences. Large-scale public-secctor usage, currently 70 percent of the market, will be surpassed by private-sector implementations and eventually drop to only 30 percent of the market. The fastest adoption, according to the IBG's report, will be in financial services and health care.
Control is always a major issue, whether granting physical access to a tool crib or a warehouse on a multibuilding campus or electronic access to industrial PCs, corporate networks, or the Internet. It's all about getting irrefutable proof of your identity. According to the IBG, biometric system sales for PC and network access alone are predicted to reach $423 million by 2005.
Some of the newest applications revolve around proving that you've performed a task or met certain criteria. For example, a hospital or food service worker might be required to wash his or her hands following predefined actions or at certain intervals. A child with subsidized lunch privileges is no longer stigmatized when all children are biometrically scanned and an unseen computer tallies the meal charges as applicable.
One of the emerging truths in this area of technology is that a biometric solution is simply one component of a much larger supply chain system, much as a microprocessor functions as a vital component of a personal computer. A biometric system cannot function on its own outside the total package, noted Dr. Joseph Atick, president and CEO of Visionics, a company that uses facial characteristics in its security solutions: "The [biometrics] industry must assure [end users] that it can scale the biometric capabilities in step with the growth of [end user] needs."
------------------------------------------------------------------------
Biometrics Industry Growth Rates: 2001–2005
Source: International Biometric Group, New York, NY; 1.212.809.9491
REVENUES FROM EMERGING SECTORS, including computer and network access, e-commerce, physical access, and surveillance, show dramatic growth rates and are expected to surpass revenues from mature market sectors (criminal and citizen identification) by 2004, according to a recent study by the International Biometric Group.
------------------------------------------------------------------------
Do You Know Me?
A particular biometric technology measures either an apparent anatomical characteristic (fingerprint, face, iris, retina, hand) or some physiological output, as in voice and signature capture. By far, fingerprint biometrics leads market revenues, according to Frost & Sullivan, with approximately $24 million invested in 2000 (36 percent of the total market) and predicted to dominate the world market through 2006. According to the International Biometric Group, finger scanning claimed almost half the market in 2001.
"One of the main reasons is because fingerprint identification and verification is a very old, tried-and-tested technology, with lots of confidence in the technology and the ability to develop excellent-quality, low-cost solutions," observed Dan Riley, vice president of software development at SecuGen.
Although fingerprint technology is widely known, vendors are not abandoning research and development efforts. At SecuGen, advances in the company's scanning systems are the result of reviewing and improving optical technology and overall robustness, and of manufacturing virtually indestructible hardware.
In addition, scanning and processing algorithms are improving, so that authentication accuracy rates are higher, usability is easier, and false rejection rates (forcing multiple scans) are dropping significantly. Couple this with the adoption of algorithms that can discern living flesh from faked latex fingers or pictures of fingerprints, and the technology simply is much more capable than it was even five years ago, and is continually improving.
------------------------------------------------------------------------
Comparative Biometrics Market Share: 2001
Source: International Biometric Group, New York, NY; 1.212.809.9491
FINGER SCANNING is the leading biometric technology, with almost half the market, notes a recent International Biometric Group report. Facial scanning is in second place, now surpassing hand scanning in popularity.
------------------------------------------------------------------------
New concepts in optical technology are in development, as well. At DELSY, a finger biometrics company based in Germany, the traditional scan systems employing capacitive, thermal, or optical technologies have given way to direct-optical technology, using residual light emitted through the finger. Light is delivered from above via a fiber optic faceplate and detected by a CMOS (complementary metal-oxide semiconductor)–based silicon sensor beneath. The whole system is sealed in a fiberglass layer, rendering it tamper resistant, temperatureproof, weatherproof, and resistant to electrostatic discharge.
For some companies, however, fingerprint scanning is not the authentication technology of choice. For one thing, many people associate fingerprint identification with criminal behavior. In addition, it may not feel as secure as something more proactive, such as a signature, recognized as a sign of commitment. Signature biometrics is evolving into a market player in conjunction with the increasing adoption of personal digital assistants (PDAs). "You don't have to buy a graphics tablet because the PDA already has one," said Bill Holmes, vice president of marketing at SSP Solutions. This may prove to be a key ingredient in electronic transactions and communications, where public key infrastructure (PKI) technology is coupled with signature biometrics to ensure integrity and privacy of transmitted information. (For more on PKI, see "Layering and Multimodal Biometrics," p. 36; "Deal Me In: New Card Technologies Pay Off for e-Business," May 2001, p. 16; and "In the Security Game, It's What and Who You Know," March 2001, p. 31.)
Speaker verification is also gaining attention as an alternative biometric authentication technique. It is used largely as a method of authentication—matching a single stored voiceprint to the person speaking into a microphone—rather than identification, which would entail searching a database of stored templates to find a match and authorize the application.
Iris biometrics, which captures information from the colored ring around the pupil of one's eye, is predicted to become the second-leading revenue generator ($200 million) by 2006, according to Frost & Sullivan. Analysts attribute this to the growth of companies like Iridian, with its patented technology and product line, including its newest network security unit, the Authenticam.
"The iris has more unique information than any other single organ in the body," noted Bill Willis, chief technology officer at Iridian. "The price point for the Authenticam is only $239, placing it more in the mainstream marketplace."
In years past, iris imaging hardware cost four to six times that amount, relegating it to high-security applications only. At this new price point, iris-based technology is still more expensive than fingerprint units, whose hardware costs between $60 and $130. A according to a study titled "Biometric Product Testing" (March 19, 2001) by Britain's National Physical Laboratory, however, iris recognition technology outperforms other leading methodologies in both accuracy and throughput speed. By 2006, facial recognition biometrics will be producing the third-largest amount of revenue, projects Frost & Sullivan, mostly because it is a passive technology and does not require a huge investment in infrastructure—making it attractive for government and law enforcement agencies.
One company focusing on this technology is Visionics. Noted the company's Dr. Atick, identification (one-to-many recognition) in all forms—including local, distance, and mobile applications—can be performed only with certain biometric technologies, including facial scanning, thus delivering value that goes beyond the traditional value proposition of authentication (one-to-one recognition).
Layering and Multimodal Biometrics
Layering is a method of combining one biometric technology (who you are) with other authentication methods, such as smart cards (what you own), identification codes (what you know), or even another biometric. "By combining technologies, we then don't need the highest-level biometric technology, because we have other security factors working in tandem," explained Xavier Passard, field marketing manager at SchlumbergerSema.
WHEREAS LAYERED SECURITY SCHEMES combine one biometric authentication technique partnered with a smart card, PIN code, or other method, multimodal biometrics is the combination of more than one biometric authentication method. BioID Enterprise 3.0 SDK (software developer's kit) simultaneously evaluates face, voice, and lip movement traits extracted from a single user action: looking into a camera and saying an appropriate phrase. Photo courtesy of BioID America.
------------------------------------------------------------------------
Smart cards are gaining favor because they store digital biometric templates away from a central computer's databases. "The user maintains, in his or her personal possession at all times, the sensitive and confidential information," observed Sven Hammar, vice president of global financial and security services business at Gemplus. "The way a technology will grow is highly dependent on how comfortable users are with operating the system."
As noted above, SSP Solutions is developing security products based on PKI technology, an advanced form of cryptography that ensures the integrity and privacy of information transmitted in electronic transactions and communications. Adding a PKI layer reinforces the public's perception of the security of the transaction.
"If you're combining biometrics with PKI and then looking at the act of signing an order for $10 million, somehow placing your finger on a plate for about one-tenth of a second doesn't feel like you've committed $10 million," noted SSP's Mr. Holmes.
Added Gemplus' Mr. Hammar, "PKI enables secure transactions and handling of the digital identity; the smart card prevents the identity from being copied; [and the] biometrics guarantees who's using it. It's an integrated solution offering the highest possible level of user authentication."
Another way to beef up biometrics-based security is to measure three traits in one discrete action. This multimodal technique is the focus of BioID America, where facial geometry, voice characteristics, and lip movements are all captured while the end user looks at a standard USB (Universal Serial Bus) camera and pronounces a prerecorded pass phrase.
Multimodal analysis also allows for natural changes to single traits—for example, a temporarily scratchy voice owing to a cold. Another key element in the future success of this approach is that if the stored templates are compromised in any way, enrolled users can always record a new pass phrase, thus creating a brand-new identity template altogether.
"The whole security system is still intact because the person whose template has been invaded doesn't have to opt out of the system," explained Jeffrey Buechler, sales director at BioID.
While combining multiple algorithms to capture three biometric traits used to be memory intensive, BioID in the last year has reduced the template footprint by 40 percent, to approximately 16 kilobits, storable on a smart card.
In addition, because this solution is software based, it's now possible to use a standard, off-the-shelf $25 camera, minimizing implementation costs while gaining video conferencing capabilities and active computer monitoring for automatic screen saver shutdown if a person leaves his or her workstation.
Infrastructure and Standards
The decision to implement a biometric or layered security scheme is often based on whether an organization needs authentication versus recognition. As noted above, authentication is simply a one-to-one match between a stored, prerecorded template; recognition, on the other hand, involves scanning an individual's biometric feature and comparing it against a complete collection of all possible individuals' biometrics, stored in a database. In addition to entailing increased cost and complexity, recognition also requires greater storage capacity.
"Visionics offers platforms for the scalable deployment of facial biometrics, aimed at enterprise security where we see the convergence of identification systems, access control, information security, and surveillance," said Dr. Atick. "Our Biometric Network Platform encapsulates our biometric capabilities into modules [hardware appliances as well as Java Servelets or Applets] that connect together, subject to a network application programming interface [API that can connect to existing standard security and financial infrastructures. The industry is now mature enough to recognize that the world does not want to change its business processes; it simply wants to make them better."
SecuGen continues to work on physical access control, but the company is also pushing into the information technology and Web application security markets. The firm recently introduced the SecuIBAS, an authentication server that lets administrators integrate network biometric tools into their Websites. Additional products include solutions for workstation security and systems that enable Novell, LDAP (Lightweight Directory Access Protocol), and other types of networking architectures and infrastructures.
AN EMPLOYEE CAFETERIA CUSTOMER uses a DELSY CMOS (complementary metal-oxide semiconductor) sensor in an ekey payment application. The company's DiOS technology uses residual light coming through the user's finger to produce a high-quality digital image, verify the individual, and process the transaction. No lenses or mechanical parts are necessary. Photo and caption information courtesy of DELSY.
------------------------------------------------------------------------
Interoperability of biometric security solutions is a function of industry standards. "The emergence of new standards could demolish a longstanding obstacle to industry growth," observed Prianka Chopra, an analyst with Frost & Sullivan.
"The biometrics industry, once plagued by interoperability issues, has combined forces and agreed on a common platform," he added. "Previously, biometrics relied on proprietary methods to store and exchange data, locking users into one specific technology. The newly released Biometric API standard [BioAPI] should facilitate communication between applications."
The BioAPI Consortium is a group of more than 50 organizations that have a common interest in promoting the growth of the biometrics market. BioAPI is dedicated to developing a specification for a standardized application programming interface (API), which will be compatible with a wide range of biometric applications and technologies. The API description defines how application programmers and biometric solution vendors write to the common BioAPI interface. The BioAPI runtime framework will let applications interoperate with various biometric solutions.
To be clear, interoperability refers to "a global standard that would describe application interfaces that would be usable with all these different biometric technologies," said SchlumbergerSema's Mr. Passard. At the application level, the user talks to a single given interface, and behind that interface, each individual biometric vendor writes to that interface.
"Every biometric has, to some extent, proprietary algorithms and a certain amount of intellectual property," said SecuGen's Mr. Riley. "So we're not saying standardize or provide a generic algorithm, but develop a standard format for storing the data so that you can easily identify to whom the template belongs and what vendor's appropriate algorithms should be used to process the data.
"Current activities include the BioAPI standards, which allow application developers to write to a single common standard and then anyone in biometrics can use it. There's also a standard called Common Biometric Exchange File Format [CBEFF], which is a standard format for storing a biometric template, whether it's face, finger, voice, or whatever.
"ISO [International Organization for Standardization, based in Geneva] is active at the international level, as well. In addition, certain industry sectors, such as the federal government and the finance market, continue to define how biometrics are used, stored, and retrieved."
Speaking of Speech Technology
Although many of the applications in which biometric systems are employed are considered commercial, speech is making waves in industrial environments, where alternative data input methods—in the interest of streamlining operations—are always welcome. Speech technology isn't new in warehouse and distribution center environments, but it is proving to be an increasingly useful data input tool, complementing traditional bar code scanning and other data collection) technologies.
A PICKER IN A REFRIGERATED WAREHOUSE wears a headset attached to a wireless computer and receives and responds to picking instructions via spoken commands. Photo and caption courtesy of SyVox.
------------------------------------------------------------------------
Noted Dr. Iván Pérez-Méndez, president and CEO of SyVox, the term speech technologies encompasses speech recognition (a useful tool for access control as discussed above), automatic speech recognition (which lets a computer recognize human speech), and text-to-speech (which produces synthesized computer voices). In a typical application of speech technology, a warehouse picker clips on a unit, runs the headset cord up his or her back, and adjusts the microphone into position. The worker begins by speaking a pass code to authenticate who he or she is and the system logs the worker in (speech recognition). The first set of picking instructions is delivered through the picker's headset (text-to-speech) via a wireless radio frequency (RF) link from the host warehouse management system (WMS) or picking program. Upon arriving at the first location, the picker confirms the location by speaking the last digits or the check digit of the location's bar code (automatic speech recognition). If the entry is accepted by the computer, the next set of instructions is forthcoming.
According to Joe Iarocci, director of speech systems at Psion Teklogix, using voice input instead of keyboard input can result in productivity gains of at least 10 to 20 percent: "It takes time to look at a screen." The caveat: You can have the fastest hardware in the world, the most bandwidth-efficient radio, and the greatest application, but at the end of the day, if the recognizer doesn't work, you don't have a solution at all, observed Fred Rost, product marketing and management director at Voxware: "That is the input/output mechanism, and that recognizer must work in a wide variety of operations and environments."
One of the key areas that can make or break that productivity gain is the ability of the recognizer to discern between the desired spoken data input and environmental noise that's inherent in any large facility. "What we've done over the last few years is develop a noise-robust speech recognition engine for multiple languages that is simple to use," said Mr. Rost. "Normally a picker is working in a 70-decibel noise environment, but in the blink of an eye someone in the area can turn on a piece of machinery and the noise level will go up to 90 or 100 decibels. It's like trying to speak to someone at a rock concert. With version 2.1, we continue to enhance our patented VISE speech recognition technology performance with improved word and phrase recognition accuracy in a wider variety of hostile acoustic environments, such as nonstationary or impulsive noises."
To obtain accurate recognition in the presence of noise, it is necessary for the worker to use a noise-canceling, close-talking microphone, added SyVox's Dr. Pérez-Méndez: "These microphones favor the sound that emanates from the worker's mouth and eliminate most of the extraneous surrounding noise. The technology must also be tuned to noisy environments to support mission-critical industrial speech applications." Microphone selection must be carefully considered, because what may well work in your isolated office, where it is relatively quiet, will not suffice in a warehouse.
Another area of continuing development is speaker-dependent versus speaker-independent speech recognition. In the first, an end user must enroll in the system to train it to understand his or her specific voice. Speaker-dependent systems store a template of each user's voice with a limited number of words and the platform translates the voice into data inside each unit. The data is then forwarded to the RF system.
A speaker-independent system attempts to recognize any input, regardless of who is speaking. "Speaker-independent systems need large, powerful processors and memory capacity, which isn't practical to install on every picker's unit," noted Psion Teklogix's Mr. Iarocci. "Although the systems split the speech recognition process between the worker's unit and a speech server, it's the server that interfaces between the worker and the WMS. This creates more traffic on the RF backbone."
At some point, the time and effort required to enroll and distribute templates for a large workforce with high turnover gets to be too large a burden to manage. That's where speaker independence comes in. Industrial workers want to be able to pick up any unit, log on, and begin work just as with other automated data collection equipment. In exchange for eliminating the template problem, though, expect to pay much more for the recognition software, consume more networking bandwidth, and have more difficulty changing dialogs. Independent systems are considered somewhat less accurate, as well. "However, this difference in accuracy completely dissipates with a carefully crafted application with adequate dialogs and vocabularies," said Tim Zimmerman, vice president of sales and marketing at SyVox. "The complications created by speaker-dependent systems by far outweigh any real or imagined difference in accuracy."
Beyond the actual unit is the RF technology that enables mobility using wireless units. This in itself poses a challenge to vendors because the speech templates for speaker-dependent systems and the catalog of words for speaker-independent systems are bandwidth hogs; less bandwidth means either the system is going to run more slowly or the system has to be stripped of input and output steps to minimize communication. With the emergence of the IEEE's 802.11b standard, however, we'll be seeing better and faster systems. "It's exciting because the bandwidth is only going to be bigger and [end users] will be able to do more," said Psion Teklogix's Mr. Iarocci, adding that market applications are expanding into the "port" markets, such as airports.
The necessary interfaces that connect speech recognition applications to enterprise systems are also progressing. Considering Voxware's solution—with the VISE speech recognition engine, embedded VoiceXML browser VoxBrowser, a more efficient wireless networking capability with Voxware Java Messaging Layer (VJML), the VXML application server VoxServer, and standard interface integration technology VoxXchange—it's clear that eXtensible Markup Language (XML) is beginning to play a clear role in standardization. "We're using Java, XML, and Sequel to integrate to a WMS or directly to a customer's database, or the end user can just present a transaction file description, which we process," noted Mr. Rost.
Fitting applications into a company's business model is a new concern for enterprises. "SyVox SpeechNet Logistics Application Modules are configurable to the end user's business practices without custom application development," said Mr. Zimmerman. "As [end users] use speech recognition technology, they may want to use it in a new area or change the business rules, [and with our system] both changes are possible through our Administration Console, [which doesn't] require developers to write additional custom code."
The Final Analysis
Over the last five years, many hardware manufacturers have acknowledged the importance of speech recognition and have integrated the necessary components into their platforms. Today, speech data terminals don't have to be vendor specific—and they can be laptops, PDAs (personal digital assistants), or industrial mobile clients, noted SyVox's Mr. Zimmerman: "The market is expanding in two ways. Existing [end users] are realizing the return on investment [ROI] of speech recognition solutions and finding new applications where the technology can be used. Also, as people become more educated about speech and its capabilities to address their business needs, speech recognition is finding new applications in existing industrial markets and new markets such as medical and field sales. Before the end of 2001, we'll see speech data terminals the size of PDAs with an average selling price of less than $2000."
What may have started out as a single-use idea is expanding. "What we're seeing is that people will accept the use of speech-based solutions for supply chain applications," said Voxware's Mr. Rost. "Once [workers] start [using a speech recognition system], they begin to get a whole array of ideas and want to load another application and perform another function, whether it's replenishment or cycle counting or quality control. The more applications they can use with the new device, [the more it] leverages the investment they've made."
Psion Teklogix predicts that speech technology will proceed in one of two ways: either as a variable-input device on a terminal with adjunct bar code scanning and keyboard entry, or as a dedicated terminal. "The applications will be more user specific," concluded Mr. Iarocci, "with tools that put control into the hands of the company, as opposed to making it a slave to technology."
Source: Supply Chain Systems Magazine, November 2001
