Tuesday, September 14, 2004


UKPS trial-Biometric ID card Posted by Hello

September 14 2004

The UK Passport Service (UKPS) is running a trial to test the recording and verification of the facial recognition, iris and fingerprint biometrics. I took part in the trial, and …
this is what I experienced at Globe House, 89 Eccleston Square,
London, SW1V 1PN.

It's a sunny summer afternoon and I'm sitting in the bustling main passport application waiting room in London. I'm here to enrol as one of the lucky 10,000 volunteers in the UK government's biometric ID card trial and check out the process for myself.
I was greeted in a reception area for enrolment, which consisted of filling out a form with basic information about myself such as gender, age, postcode and ethnic background.
A small side room, in the second floor, off the main waiting room contains a large booth with a curtain around it. Inside a chair sits in front of a desk with one machine that scans the iris and takes a facial biometric (Panasonic BM-ET300, http://www.raycosecurity.com/biometrics/iris.html ), and another machine that takes a fingerprint scan (Identix TouchPrint™ 3100 Live Scan, http://www.identix.com/products/pro_livescan_3100.html ). For good measure there is a screen to sign an electronic signature on.
The aim of the trial is to test the enrolment process for each of the different biometrics to see how easy they are and also test them for accuracy.
I'm ushered into the booth and took a seat in front of the camera, which sits at face height. First up is the facial recognition. I asked if I can smile, it was allowed! (http://news.com.com/E-passports+are+nothing+to+smile+about/2100-7348_3-5299928.html ).
Then I positioned my eyes so they are looking into the iris scanner. A computer voice prompt tells you to move closer or further away until you are in the right position and after some whirring and a couple of camera clicks, the iris scan is done.
The UKPS operator taking my scans says there have been none of the problems highlighted earlier this year by MPs from the Home Affairs Select Committee who claimed long eyelashes, watery eyes and eye complaints could render iris scanning useless for large numbers of the population.
She said the guides on the iris scanning machine and the computer voice prompt will ensure peoples' eyes are aligned correctly with the reader. And speaking as someone with long eyelashes I certainly didn't have any problems on the day.
Next up is the fingerprint scanner, the scanner was cleaned by the UKPS operator with a cloth. It looks much like a scaled-down version of a regular computer scanner with a glass screen. First you put your four left fingers on the screen, then the thumb, and repeat the process for the right hand.
The system enables the operator to check all the prints scanned are of a good enough quality to be used. Ones that aren't are highlighted and are simply taken again. Because all the fingers and thumbs are scanned it also isn't an issue for people with the odd digit missing.
Interestingly, The UKPS operator said that a database of one million fingerprint scans has been imported from abroad for use during the trial to ensure that there is a big enough volume to check how accurate the matching process is with the 10,000 prints taken during the trial.
After giving an electronic signature, volunteers will then be given a few minutes to fill out a questionnaire asking them about how they comfortable they felt using each of the biometrics and how intrusive they thought each was.
Less than 15 minutes after starting the biometric trial, the UKPS operator hands me my very own biometric ID card. It's only a demonstration one and can't be used anywhere but the chip on it does contain my biometrics. Volunteers then get to choose one of the biometrics so it can be tested against the card.
I opt for the iris scan. The card is put into a reader and I sit in front of the iris scanner again. A problem with the server connection means it doesn't register first time but a few seconds later I get a correct match. The process has been smooth and painless and taken quarter of an hour with all three biometrics. The UKPS is currently getting through about four people an hour.
Et voila! I had to finish my questionnaire, I was also assured that all the data collected during the trials will be completely destroyed at the end of it all.
No stats are yet available on the failure and success rates of the different biometrics but a full government report is due out later in the year after the trials finish.

As I was leaving the UKPS office, I heard a voice saying "We'll be tracking you young man …"

Friday, August 27, 2004


A new handheld reader is likely to make the wish list of every well-equipped security provider. Not only will it handle biometrics (fingerprints), it will also read smart cards, contactless cards, and even traditional mag stripes and bar codes.
Judges at ISC West in Las Vegas, Nevada, in April were so impressed with Datastrip's DSVII-SC that they gave it the New Biometric Product of the Year award.
“The DSVII-SC is a new mobile device that was introduced in April, 2004,” said Melinda Morris, Datastrip’s inside sales manager at the company's corporate headquarters in Exton, Pennsylvania. “The devices are currently being used in the U.S. and worldwide by system integrators and Automated Fingerprint Identification System (AFIS) providers for solutions being developed for law enforcement, transportation, schools, prisons, nuclear power plants and other high security facilities.”

Friday, August 13, 2004


Anil K. Jain, Sharath Pankanti, Salil Prabhakar, Lin Hong, Arun Ross, James L. Wayman, (2004), “Biometrics: A Grand Challenge”, Michigan State University, IBM T. J. Watson Research Center, DigitalPersona Inc., Siemens Corporate Research, West Virginia University, San Jose State University. To appear in the Proceedings of International Conference on Pattern Recognition, Cambridge, UK, Aug. 2004.
Reliable person recognition is an important problem in diverse businesses. Biometrics, recognition based on distinctive personal traits, has the potential to become an irreplaceable part of many identification systems. While successful in some niche markets, the biometrics technology has not yet delivered its promise of foolproof automatic human recognition.

Tuesday, August 10, 2004


The UK Passport Service (UKPS) is running a trial to test the recording and verification of the facial recognition, iris and fingerprint biometrics. More details can be found on:



A good effort by Marie Sandström at Linköping University in Sweden, here is the abstract of her thesis.

Abstract: Biometrics deals with identifying individuals with help of their biological data. Fingerprint scanning is the most common method of the biometric methods available today. The security of fingerprint scanners has however been questioned and previous studies have shown that fingerprint scanners can be fooled with artificial fingerprints, i.e. copies of real fingerprints. The fingerprint recognition systems are evolving and this study will discuss the situation of today.Two approaches have been used to find out how good fingerprint recognition systems are in distinguishing between live fingers and artificial clones. The first approach is a literature study, while the second consists of experiments.A literature study of liveness detection in fingerprint recognition systems has been performed. A description of different liveness detection methods is presented and discussed. Methods requiring extra hardware use temperature, pulse, blood pressure, electric resistance, etc., and methods using already existent information in the system use skin deformation, pores, perspiration, etc.The experiments focus on making artificial fingerprints in gelatin from a latent fingerprint. Nine different systems were tested at the CeBIT trade fair in Germany and all were deceived. Three other different systems were put up against more extensive tests with three different subjects. All systems were circumvented with all subjects' artificial fingerprints, but with varying results. The results are analyzed and discussed, partly with help of the A/R value defined in this report.

Monday, August 09, 2004


By Yona Flink
Over the years there has been various discussions on whether combining twoor more biometrics (Fusion or Layered) enhances the accuracy of the biometric process for verification and identification. I have been of the opinion, that by intelligently layering two different biometrics, the resulting error rates would be reduced. However, on the occasions that I presented such a position, others turned to mathematical proofs andstatistical documentation using a paper by Professor Daugman. I have great respect for Professor Daugman positions, but the basis of Professor Daugman's paper are based on a different premise than those taken my myselfand others. The below documents are in the following order:
  • A brief outline of Professor Daugman's paper.
  • An email to the BC that I sent a year ago outlining a proposal forlayered biometrics.
  • An article appearing in Wave this month.Combining Multiple Biometrics John Daugman, The Computer Laboratory, Cambridge University Overview This short note investigates the consequences of combining two or morebiometric tests of identity into an "enhanced" test.

There is a common and intuitive assumption that the combination of different tests must improve performance, because "surely more information is better than less information." On the other hand, a different intuition suggests that if astrong test is combined with a weaker test, the resulting decision environment is in a sense averaged, and the combined performance will lie somewhere between that of the two tests conducted individually (and hence will be degraded from the performance that would be obtained by relying solely on the stronger test). There is truth in both intuitions. The key to resolving the apparent paradoxis that when two tests are combined, one of the resulting error rates (False Accept or False Reject rate) becomes better than that of the stronger of thetwo tests, while the other error rate becomes worse even than that of the weaker of the tests. If the two biometric tests differ significantly in their power, and each operates at its own cross-over point, then combiningthem gives significantly worse performance than relying solely on the stronger biometric. Example: Combination of two hypothetical biometric tests, one stronger thanthe other: Suppose weak Biometric 1 operates with both of its error rates equal to 1 in 100, and suppose stronger Biometric 2 operates with both of its error ratesequal to 1 in 1,000. Thus if 100,000 verification tests are conducted with impostors and another 100,000 verification tests are conducted with authentics, Biometric 1 would make a total of 2,000 errors, whereas Biometric 2 would make a total of only 200 errors. But what happens if thetwo biometrics are combined to make an "enhanced" test? If the "OR" Rule is followed in the same batch of tests, the combined biometric would make 1,099 False Accepts and 1 False Reject, for a total of 1,100 errors. If instead the "AND" Rule is followed, the combined biometric would make 1,099 False Rejects and 1 False Accept, thus again producing atotal of 1,100 errors. Either method of combining the two biometric tests produces 5.5 times more errors than if the stronger of the two tests hadbeen used alone. Conclusion: A strong biometric is better alone than in combination with aweaker one... when both are operating at their cross-over points. To reap any benefits from combination, the equations above show that the operating point of theweaker biometric must be shifted to satisfy the following criteria: If the"OR" Rule is to be used, the False Accept rate of the weaker test must be made smaller than twice the cross-over error rate of the stronger test. If the "AND" Rule is to be used, the False Reject rate of the weaker test mustbe made smaller than twice the cross-over error rate of the stronger test. The following is a position I took on layered biometrics in an email about ayear ago to the List. I do not think that the below disproves ProfessorDaugman's premise, but only points out that the premise from which I andothers have based their conclusions are different from that of Professor Daugman.The idea of layered biometrics has come about because of False Rejection. The layered biometrics issue may therefore be approached from another pointof view by not layering the biometrics but subjectively comparing the statistical results. At first, this may sound very non-scientific, butlet's first examine the problem of FR. Let us take for our examination two widely used biometric technologies forAccess Control: Hand Geometry and Face. In our example, both these system will be used for an access control system. The Hand Geometry reader will beour primary biometric system with the Facial Verification being our secondary system. Hand Geometry has a field proven EER of 0.2%. For our example, we will set the Hand Geometry reader's security at a threshold level of 60 which gives us a FAR of 0.08%. What we are saying in essence is that any person that verifies at or below the threshold level of 60 is who heclaims and anyone over the threshold level of 60 is an imposter and will notbe granted access. If a person verifies at 61, how much more of an imposteris he than the person that verified at a threshold level of 59 or 60? And if that same person verified at 69 or 75, is he more of an imposter than theperson that verified at a threshold level of 40? From the stand point ofthe set threshold level, anyone above 60 is an imposter and anyone at 60 or below is not an imposter. When we set a threshold level, there is a clear YES or a NO and no 'possible'. In the real world, we know that people may not always verify at the same level day in and day out. Should we reject a legitimate user because theuser failed by 0.05% and was verified at 61 instead of the minimum threshold level of 60? There may be a case for 'parallel biometrics'. In the case of parallel biometrics, we state that any person that does not meet the minimum threshold level will be verified by a second biometric technology. In this case, Facial Verification will be used. Let us assume that two persons, George and Giles were verified at the Hand Geometry reader and George received a verification level of 65 ( FA% 0.11%) and Giles received a verification level of 85 (FA 0.28%. George came pretty close toour required FA% of 0.08%, but could not be allowed access because he missed the threshold level by 0.03%. Close but no prize. Now, George and Giles are given a second chance to prove that they are who they claim. Both George and Giles look at the camera and receive the following verification levels: George is verified at a FA level of 7 % and Giles at 3 %. In the Facial, Giles came out better than George. If we hadbeen using Facial Verification alone and our access control threshold had been set for 98%, neither George nor Giles would have gained access. But now we are using Facial Verification in parallel with Hand Geometry. George did better than Giles with Hand Geometry but Giles did better than George with Facial. Do we deny both access because the did not meet the facial minimum requirements or should be combine both the Hand Geometry and Facial and divide by 2 or just toss a coin? Or should we ask an additional question: What is the probability of animposter achieving 99.89% accuracy for Hand Geometry and 93 % accuracy withFacial Verification based on George's two templates residing on the biometric database. In other words, what is the statistical possibility ofan imposter have facial characteristics that match the facial template onthe database by a similarity level of 97% and that the same imposter has hand geometry that matches that on the database by an accuracy level of 99.89%? Is not the possibility far less than 0.08%, which is our verification threshold on the Hand Geometry reader? What may be required in order to resolve the issues of falsely rejected legitimate users is an algorithm that is weighted in favor of the primary biometric technology and weighs the primary biometrics' rejection level against the secondary's evaluation of how accurately the rejected user matches the secondary biometric template in comparison to the level that he was rejected by the primary biometric technology. The levels of weighing each of the biometrics acceptance/rejection levels will be subjective and based on security requirements.

The following is an outline of Josef Kittle's paper at the Biometric Conference in Hong Kong. http://www.wave-report.com/other-html-files/currentwave.htm ****ICBA 2004, First International Conference on Biometric Authentication By John LattaHong Kong, July 15 - 17, 2004 Challenge of Biometric Fusion Josef Kittle, University of Surrey, UK, gave a keynote presentation on"Fusion of Intramodal and Multimodal Biometric Experts." It was one of themost interesting of the conference. One example in facial recognition wasbased on color channels. Three different methods related to the color channels netted TER, total error rates, of 5.8, 5.8 and 4.8. But when combined using a fusion process, the TER dropped to 1.9. This is anintramodal fusion because the same biometric modality was used, i.e., facial. Another example used face, voice and lips for the biometrics. In this case the HTER (1/2 TER) varied from .74 to 13.3. When it was fused andall modalities were used, the HTER dropped to .15. The last example was the fusion of face and voice with the HTER of 1.8 and 1.23. But the fused HTER was only .28. Logic draws us to the expectation that the use of more than one and even multiple biometric measures would result in lower error rates. Professor Kittle showed that the real challenge comes in operational environments. In these environments: Not all sensors are assumed to be able to collect their respective biometric for every individual in the authentication/identification process, The potential for fusion is limited to the number of biometrics used at the time of enrollment, and Some biometrics are of higher reliability that others. Operational expectations are that the use of biometrics will force the evaluation in the direction of the biometric with the highest confidence. Note that this is the case with Hong Kong Immigration which has both fingerprints and images. The images are not used as a biometric. In fusion, we would expect that the weights applied to the sensors used for authentication/ identification should be based on the reliability of the biometric. The WAVE asked the question: How does one compensate for these issues in operational environments? In response, it was stated this is oneof the issues to be addressed in the R&D of multimodal systems. The promise of fusion also carries with it the need for more research.What is of interest here is that in theory there is no improvement possibleby layering, combining or fusing two or more biometrics, yet in practice the test results indicate something else.

Yona Flink

OptiSec Ltd. Israel yona@optisec-systems.com

Mobile: +972 54 430 8727

Saturday, July 31, 2004


L. O’Gorman, "Comparing passwords, tokens, and biometrics for user authentication", Proceedings of the IEEE, Vol. 91, No. 12, Dec. 2003, pp. 2019-40.

For decades, the password has been the standard means for user authentication on computers. However, as users are required to remember more, longer, and changing passwords, it is evident that a more convenient and secure solution to user authentication is necessary. This paper examines passwords, security tokens, and biometrics – which we collectively call authenticators – and compares these authenticators and their combinations. We examine effectiveness against several attacks and suitability for particular security specifications such as compromise detection and non-repudiation. Examples of authenticator combinations and protocols are described to show tradeoffs and solutions that meet chosen, practical requirements. The paper endeavors to offer a comprehensive picture of user authentication solutions for the purposes of evaluating options for use and identifying deficiencies requiring further research.

Wednesday, June 23, 2004


Many people consider the widespread use of biometrics to be at least mildly disconcerting – a cross between 1984 and Minority Report. They imagine a world in which biometrics are integrated with massive centralized database applications designed to track and monitor our every move. This indeed would be a frightening and menacing nightmare. In reality, the prospects are not quite so ominous.

C.M. Most, “Towards Privacy Enhancing Applications of Biometrics”, DIGITAL ID WORLD June/July 2004.
URL: http://magazine.digitalidworld.com/Jun04/Page18.pdf

Friday, May 21, 2004


New security device a handy way to stop credit card fraud

By Harold Lee

A team of UCLA graduate student researchers is working to eliminate a variety of security and privacy problems by creating a portable device that would identify users by their thumbprints.


Biometrics 2004, The 7th World Conference and Exhibition on the Practical Application of Biometrics. London UK 13-15 October 2004.


Monday, May 17, 2004

British Computer Society Wireless Specialist Group

The aim of the group is to bring together academics, industry and researchers from research communities in wireless networking, wireless technology, wireless applications, wireless systems; wireless Internet and mobility. It provides presentations, meetings, events, conferences in wireless field and all aspects of its application.


Lisa Thalheim, Jan Krissler, Peter-Michael Ziegler

Body Check
Biometric Access Protection Devices and their Programs Put to the Test

Memorizing passwords is out. Laying your finger on a sensor or peering into a webcam can suffice to gain you immediate access to a system. There is the danger, however, that this new ease might be bought at the expense of security. How well do biometric access controls prevent unauthorized access? We have tested eleven products for you.

Wireless IT Research Centre, London UK

WITRC offers a cross-disciplinary program of research targeted at the emerging needs of the cellular and wireless communication industry.
Its research mission is to advance the development of wireless networking technology by combining the powerful resources of government, industry and academia. Its educational mission is to train the next generation of wireless technologists via graduate research programs that are especially relevant to industry.
WITRC is supported by a broad cross section of leading wireless industry sponsors, which benefit from a collaboration relationship to advance the development of wireless technology. The centre serves as a forum for peer-level technical interchange between academic, affiliated researchers and sponsor staff.