Selected Biometrics: Investigating Facial and Fingerprint Scanning Technologies

Selected Biometrics

Investigating Facial and Fingerprint Scanning Technologies

MGMT 6821G

Oct 9th, 2002

prepared by

Group 2

Akincioglu, Volkan Berneiser, Gregor Chen, Changwei Gao, ShaoHui Selected Biometrics: Investigating Facial and Fingerprint Scanning Technologies

Metz, Katherine

of 10 Introduction...... 1 Facial Biometrics...... 2 Technology...... 2 Hardware Requirements...... 2 Software Requirements...... 3 Cost of Ownership...... 4 Business Value...... 4 Benefit...... 4 Applications...... 4 Example...... 5 Limitations...... 5 Fingerprint...... 5 Technology...... 6 Optical Scanning...... 6 Identification vs. Verification...... 7 Cost of Ownership...... 7 Business Value...... 7 Benefit...... 7 Applications...... 8 Example...... 8 Limitations...... 8 Conclusion...... 9 References...... I Selected Biometrics: Investigating Facial and Fingerprint Scanning Technologies

Introduction

The biometric consortium of the US government defines biometrics as follows: “Biometrics are automated methods of recognizing a person based on a physiological or behavioral characteristic. Among the features measured are face, fingerprints, hand geometry, handwriting, iris, retinal, vein, and voice.“(1) Physiological biometrics is based on measurements and data derived from direct measurement of a part of the body, while behavioral biometrics is based on an action taken by a person. The patterns of these individuals are then matched against a database of records. It is important to note that these two are closely related. Behavioral biometrics is based partly on physiology, such as the dexterity of hands and fingers. On the flip side, physiological biometric technologies are similarly affected by user behavior, such as the manner in which a user presents a finger or looks at the camera. (2)

In this paper we will focus our discussion on physiological biometrics, specifically fingerprints and facial scans, as they make up more than 70% of the total market for biometrics (see figure 2). It will be our aim to investigate how these two technologies create business value and what their possible applications are. We will also look at biometrics from a broader perspective and discuss the limitations, threats and the outlook for this technology. This we will approach by looking at the security and ethical dilemmas associated with them.

Figure 1: Biometrics Revenue

Figure 2 Biometrics Market

of 10 Selected Biometrics: Investigating Facial and Fingerprint Scanning Technologies

Facial Biometrics

There are various facial-scan technologies used to recognize people. One thing that they all have in common is that they focus on areas of the face that are not easily alterable. These areas include the cheekbone area, the upper outlines of the eye sockets, the sides of one’s mouth, etc. There are four primary methods employed by facial scan vendors to verify subjects.

Technology

The key technology of facial biometrics is how to use various features of the face to recognize or verify a user. As summarized by International Biometrics Group, there are generally four facial recognition techniques:  Eigenface, literally meaning "one's own face," a technology developed at MIT. “Basically, a database holds a large number of template faces (typically between 60 and 120). When the face is read in, it is mapped on to the template faces so that the program can mix the template faces together to actually artificially reproduce the face. This is then used later for recognition and verification purposes. Eigenface techniques have to be applied in fairly controlled situations.” (3)  Feature analysis is the most widely utilized facial recognition technology. This is why we will focus more on this type of analysis. It utilizes various features from different regions of the face, predominantly in the area from the person’s temples to the top of the lip, commonly known as ‘The Golden Triangle’, to identify and derive a representation in terms of the spatial relationships between different features, or ‘nodal points’ on the face. The analysis incorporates the relative location of these features. The extracted features are building blocks, and both the type of blocks and their arrangement are used to identify and verify the face. “Once it has performed the mathematical calculations, the facial recognition engine converts a face into a template. This template can be as small as 88 bytes. Due to the small template size, faces can be searched and compared at the speed of up to one million faces per second.” (4)  In Neural Network Mapping, features from both the stored (enrolled) and verification face “vote” on whether there is a match. “Neural networks employ an algorithm to determine the similarity of the unique global features of live versus enrolled or reference faces, using as much of the facial image as possible. An incorrect vote, i.e. a false match, prompts the matching algorithm to modify the weight it gives to certain facial features. This method theoretically leads to an increased ability to identify faces in difficult conditions. “ (5)  Automatic Face Processing (AFP) is a “more rudimentary technology, using distances and distance ratios between easily acquired features such as eyes, end of nose, and corners of mouth” (6) to identify a person against a reference face.

Hardware Requirements

Facial scanning is not a very hardware-intensive biometrical methodology, as the processing and recognition of the faces are largely based upon the capabilities of the software employed and build on already existing

infrastructures, such as closed circuit television (CCTV) installations. However, several basic requirements have to be met.  Digital cameras allow for more frames per second, along with higher resolution, and will lead to better performance in verification or identification scenarios. These cameras must be able to compensate for varied and changing lighting, providing a Figure 3: Typical Set up for a CCTV system stable image of the user's face so it can be easily recognized.  A computer or network system, an adequate video card, sufficient processor speed, and a database are needed. Figure 3 shows a typical set up for facial scanning.

Software Requirements

We will use “FaceIt”, a feature analysis product manufactured by Identix, as an example to demonstrate how a facial scan works. Everybody’s face is unique in that it has certain distinguishable landmarks, peaks and valleys that make up the different facial features. “FaceIt” defines these landmarks as “nodal points”. “There are about 80 nodal points on a human face such as the:  Distance between eyes  Width of nose  Depth of eye sockets  Cheekbones  Jaw line  Chin  And many others

Figure 4: Nodal Points “These nodal points are measured to create a numerical code that represents the face in a database. This code is called a “faceprint”. Only 14 to 22 nodal points are needed for the FaceIt software to complete the recognition process.” (7) This process has four basic steps: 1. Face Finding: Finds faces in field of view. 2. Extraction: Separates faces from background. 3. Template Creation: Creates 84-byte template, or faceprint. 4. Matching: Compares the templates against those stored in a so-called ‘watchlist’ database. (8)

Cost of Ownership

Cameras can be purchased for as little as $50, and demo versions of leading vendors' software are available for free download. However, depending on the capacity and complication of hardware and software, the TCO varies greatly. It can range from a few thousand dollars for a simple camera plus recognition software, to millions for a big CCTV system plus face capture and recognition software. Since most potential users already have a CCTV system, the only additional cost is for the software. However, additional personnel may be needed to staff the CCTV operation. For example:  Identix loaned its Faceit software at $30,000 to the Tampa Police Department for one year. (9)  Viisage Technology, Inc. was awarded a $1 million contract by the Massachusetts Cities Collaborative to implement its FaceEXPLORER(TM) face recognition solution to assist the police department during investigative and booking processes. (10)

Business Value

Benefit First, compared with other biometrics, facial biometrics is the only one capable of identifying known people at a distance. Though this method may seem less accurate than others, it is the best for identifying unknowing suspects. "It's unobtrusive, passive and does not require people's involvement. You don't expect Osama bin Laden to enter a kiosk and subject himself to an iris test would you?" (11) Also, Facial surveillance can yield instant results, verifying the identity of a suspect and checking through millions of records for possible matches quickly, automatically and reliably. It works well with existing hardware and software, including digital cameras, computers, and CCTV systems and new hardware cost is minimized.

Applications The application of facial recognition can be categorized into two basic areas: controlled and uncontrolled. In the controlled recognition process, whether it is verification or identification, the light, the environment, the angle of the picture, and all other factors can be controlled. It is therefore more reliable than uncontrolled scanning. The uncontrolled setting is typically a CCTV (closed circuit television) system whereby all faces passing before the cameras are scanned and compared to the databases. Here are a few examples of the use of the facial scan technology.  “Israel's Ministry of Defense uses facial scanning to monitor movement along the Gaza Strip.  The city of London uses facial scanning to remotely patrol the streets.  Mexico and Uganda use facial scanning to register voters.” (12)

Example

In January 2001, Super Bowl officials announced a plan to have cameras scan the crowds for known criminals. On that day, people who entered the stadium had their faces electronically compared against a database of "known criminals." The cameras set at the entrances to the Stadium were connected with a computer. Tens of thousands of people had their faces videoed and then these pictures were fed into computers that, in less than a second, compared the facial characteristics against a database of images employing feature analysis. The system used is called FaceTrac, manufactured by Viisage Technology.(13)

It is evident that biometric technology provides many better possibilities for government to prevent crime and control criminals. Once biometric systems are installed, the number of security staff can be decreased in the long run. More importantly, at large events criminals can be detected and controlled, so the potential benefit is large.

Limitations

 People may have very similar or even identical faces (twins, for example) and the facial recognition can often be inaccurate and therefore needs a second identification method (finger scan, for instance) to confirm the result.  Facial operations, whether for beauty or for legal circumvention, will make the system unable to recognize the person.  In the uncontrolled setting, if the face is too far from the camera, if the environment is not well lit, or if there is too much or too little movement, the results will be greatly compromised.  In the uncontrolled setting, criminals may hide their faces or try not to stand before the camera  False positive results may cause a lot of trouble both for the individual and for the authorities  Quality of capture device  Change between enrollment and verification cameras (quality and placement)  Not everyone’s face is currently in the databases

Fingerprint

Fingerprinting, as the name suggests, is the acquisition and storage of the image of the fingerprint. Everyone is known to have unique, immutable fingerprints. Fingerprinting has been used for decades when booking suspects or conducting criminal investigations. However, this has been a manual process involving ink and paper. More advanced optical or non-contact fingerprinting systems (known as live-scan) are currently the standard for forensic usage. The characteristics of an individual’s fingerprints include whorls, arches, loops, ridge endings and ridge bifurcations. The uniqueness of a fingerprint can be determined by the pattern of ridges and furrows as well as the minutiae points.

Figure 5: Fingerprint

Minutiae points are local ridge characteristics that occur at either a ridge bifurcation or a ridge ending. Figure 5 gives an overview of the different components of the fingerprint.

Technology

There are three main technologies for fingerprinting, which are optical, ultrasound, and chip-based. Ultrasound technologies have been around for many years, but their use is not widespread. When a finger is placed on the glass platen, an ultrasonic scan is taken. Since sound is used, direct contact with the platen is not needed

Figure 6: Functional Configuration (e.g., scanning works through a thin latex glove or on very dirty for Fingerprint Scanning fingers). Chip-based technologies involve users placing their fingers directly onto silicon chips with the surface-area of a postage stamp.

The optical scan is the oldest and most mature method. We will focus on this category, as it is the most widespread. Fingerprint scanning is a very hardware-intensive technology, as the system architecture on the left suggests. One or more scanning units are needed, depending on the size of the system. These have to be connected with a database that stores reference fingerprints, the so-called enrollment prints. Furthermore, a fingerprint -matching computer has to be connected to the system that is responsible for performing the actual matching operation. (14)

Optical Scanning

The optical scanning process works the following way. When you place your finger on a glass plate, a small camera takes a picture. The system then generates an inverted image of the fingerprint. Before comparing the print to stored data, the scanner processor makes sure the camera has captured a clear image. It checks the average pixel darkness, or the overall values in a small sample. Then it checks the image definition. If the processor concludes that the image is of good quality, it proceeds to compare the captured print with those on file. (15)

Figure 7: Fingerprint Authentication Process

Identification vs. Verification

Finger scan systems can be broadly categorized into two types: identification systems, known as AFIS (automatic fingerprint identification systems), and verification systems. Verification systems perform one-to-one verification that is accomplished in a few seconds. They use all three types of approaches discussed previously.

We will, however, focus on the AFIS systems that use only optical scanners and typically perform one- to-many operations. There are two major types of AFIS applications: forensic and civil. Forensic AFIS systems capture a rolled image of all ten fingers. Such rolled finger images provide more data for forensic investigations. These systems are designed for use in hostile environments where criminals may be struggling to avoid having their fingers scanned. Furthermore, these systems track demographic information and attach police tracking information. Civil AFIS applications capture flat finger images from a few fingers. AFIS systems take a few minutes to perform the one-to-many search. Finger-scan technology also acquires the fingerprint, but does not store the full image. It stores particular data about the fingerprint in a much smaller template, requiring from 250-1000 bytes. After the data is extracted, the fingerprint is not stored. Significantly, the full fingerprint cannot be reconstructed from the finger-scan template. (16)

Cost of Ownership

AFIS, which perform one-to-many identification searches, are expensive. The cost is based on the number of searches performed per day, the required search time, and whether the application is for civil or forensic purposes. Forensic AFIS systems are more expensive because they handle rolled prints with more data than a flat image. A forensic AFIS application with 5 million people, performing 5000 searches per day, with a response time of 5 minutes, costs a few million dollars. An AFIS capture device can range from several hundred to tens of thousands of dollars, depending on whether it is designed to capture one or multiple fingerprints. (A PC peripheral finger-scan device generally costs less than $200). (17)

Business Value

Benefit

Fingerprinting is one way a security system can verify an authorized user. Passwords and PIN codes are used when a system is only allowing certain people access, but if a system wants to know who is actually entering or accessing a restricted area, the system is looking for physical evidence that the person entering is who he says he is. The major advantages of systems utilizing fingerprint scanners are:

 Relatively high accuracy  Physical attributes are much harder to fake than identity cards.  You can't guess a fingerprint pattern like you can guess a password.  You can't misplace your fingerprints like you can misplace an access card.  You can't forget your fingerprints like you can forget a password.

Applications Civil AFIS include:  Benefit transfers in New York, Los Angeles and Spain

 Voter registration in Jamaica  The Federal Bureau of Investigation, state police departments and city police departments use forensic AFIS to identify criminals

Example

Some similar fingerprint recognition system was also installed for San Diego County's Department of Social Services. The county's goal was to eliminate the instances of welfare recipients applying for benefits more than once. The project involved 25,000 recipients. Previously, when individuals applied for benefits, they were required to provide demographic data, such as their name and address. However, since not all eligible applicants possess identification, general assistance benefits cannot be denied because the individual does not have identification. As a result, it was relatively easy for individuals to apply for benefits - under different names, at multiple offices. Now, as part of the application process, the individual's fingerprint is scanned and stored in a database accessible by the county's seven offices. If someone tried to apply for benefits at a second office, their fingerprint would appear in the database. That way, the office would know it was a fraudulent claim. In its first six months of using the system, San Diego County saved over $200,000. Previously, 4-6% of the county's budget was spent paying fraudulent claims.

Limitations

But, as effective as they are, they certainly aren't infallible, and they do have major disadvantages. Optical scanners can't always distinguish between a picture of a finger and the finger itself, and capacitive scanners can sometimes be fooled by a mold of a person's finger. If somebody did gain access to an authorized user's prints, the person could trick the scanner. In a worst-case scenario, a criminal could even cut off somebody's finger to get past a scanner security system. Some scanners have additional pulse and heat sensors to verify that the finger is alive, rather than a mold or dismembered digit, but even these systems can be fooled by a gelatin print mold over a real finger.

The following is a list of aspects, composed by IBG Strike System (18), that work against a successful verification:  Cold finger  Dry/oily finger  High or low humidity  Angle of placement  Pressure of placement  Location of finger on platen (poorly placed core)  Cuts to fingerprint  Manual activity that would mar or affect fingerprints (construction, gardening)  ‘Loud’ clothing that can distract face location

These strikes do not include inherent characteristics such as age, ethnicity, or gender, which can also affect system accuracy. The performance of many biometric systems varies for specific populations.

Conclusion

Every biometric technology has its own advantage and disadvantage technically or related with cost or level of acceptance. Facial recognition techniques may be less intrusive; but the accuracy level is not as high as with fingerprint or iris scans. For deployment, user perceptions of biometric technology are an essential element in their success. If the method being used is perceived as invasive, people are less likely to cooperate. One might use a combination of technologies that can offset the pros and cons of each system. The user criteria and business objectives play an important role. Determining which technology to deploy has become a small fraction compared to an institution’s overall biometric implementation strategy.

Since certain identification becomes possible, it also becomes possible to find out and store all kinds of information about an individual. Does this give law enforcement the right to immediately have access to an individual’s data by scanning his/her fingerprint? Does it give hospitals the right to refuse treatment if they can identify from someone’s finger scan that he/she does not have insurance? The list of questions that could be identified is long.

The issue that arises is whether this technology is going too far, infringing on civil rights and laying the foundation of a totalitarian state, like George Orwell has described it in his book “1984”. However, legislation is being drafted already, that will incorporate biometrics to a much greater extent:  USA Patriot Act (signed in October 2001)  Aviation and Transportation Security Act (signed in November 2001)  Enhanced Border Security and Visa Reform Act (signed in May 2002) Each of these pieces of legislation explicitly calls for the implementation of biometric technology to enhance security. Therefore, the question is of an ethical nature. Are we going to allow the uncontrolled use of biometric authentication and storage of information relating to biometric data? We conclude that:  facial-scan, due to its being the only biometric capable of operating in surveillance mode as well as being compatible with massive databases of photographs and facial images,  and AFIS, due to its position as far and away the most proven biometric technology for 1 to many identification, are two technologies in the field of biometrics that will experience large growth rates. It is increasingly rare that a public or private sector institution faces a decision on whether to deploy finger-scan technology or facial-scan technology in the first place. Rather, the specific requirements such as accuracy of identification, response time, level of impact on existing systems and processes, and compatibility with existing data define which technology can be effectively deployed.

The real problem with biometric security systems is the extent of the damage when somebody does manage to steal the identity information. If you lose your credit card or somebody somehow accesses your secret PIN, you can always get a new card or change your code. But if somebody steals your fingerprints, it becomes far more complicated. One could even go further and assume that criminals might alter their facial features to gain access to certain facilities. The scenarios previously only drawn in James Bond movies become increasingly realistic after the events of 9/11.

But even with significant drawbacks, fingerprint scanners and facial scanning systems are an excellent means of identification. In the future, they'll most likely become an integral part of most peoples' everyday life, just like keys, ATM cards and passwords are today.

Finally, all of the literature that our group has consulted suggests that one of the largest impacts on the biometric industry has been 9/11. All sources estimate a major increase in public sector spending on biometric technology for the authentication of individuals. This spending will reflect a priority on access control and identity-related applications as opposed to information security related applications.

of 10 References

1. http://www.itl.nist.gov/div895/isis/bc/bc2002/aboutbiometrics.htm 2. http://www.ibgweb.com/reports/public/technology_reports.html 3. James Matthew, Biometrics: An Overview, 1/10/02, http://www.generation5.org/ 4. (No author), Face Recognition, 1/10/02, http://www.biocom.tv/FacialRecognition.htm 5. IBG, Primary Facial-Scan Technologies, 1-10-02, http://www.ibgweb.com/reports/public/reports/facial-scan_primary.html 6. IBG, Primary Facial-Scan Technologies, 1-10-02, http://www.ibgweb.com/reports/public/reports/facial-scan_primary.html 7. Kevin Bonsor, How Facial Recognition Systems Work, 30/9/02, http://www.howstuffworks.com/facial-recognition1.htm 8. Identix Corp. , Biometric Network Platforms, 01/10/02 http://www.identix.com/products/pro_security_bnp_argus.html# 9. Kevin Bonsor, How Facial Recognition Systems Work, 30/9/02, http://www.howstuffworks.com/facial-recognition1.htm 10. Press release, Viisage Awarded $1 Million Facial Recognition Contract From Collaborative of Massachusetts Police Departments, 29/09/02, http://biz.yahoo.com/prnews/020725/neth024_1.html 11. Joseph Atick, Visionics(now part of Identix)' chairman and chief executive, Biometrics Takes Flight After Terrorist Attacks, 01/10/02 http://www.kioskcom.com/article_detail.php?ident=917 12. Julia Scheeres, Smile, You're On Scan Camera, 1/10/02 http://www.wired.com/news/technology/0,1282,42317,00.html 13. Revolutionary Worker #1093 , Big Brother In Your Face: Biometrics at the Super Bowl, Online posting, 30/10/02, http://rwor.org/a/v22/1090-99/1093/superbowl.htm 14. http://www.fire-scan.com 15. http://www.howstuffworks.com 16. http://www.findbiometric.com/pages/fingerprint_articles/fingerprint_1.html 17. http://www.findbiometric.com/pages/fingerprint_articles/fingerprint_1.html 18. http://www.biometricgroup.com/ Figure 1 IDC Data Figure 2 IDC Data Figure 3 EyeNet Corporation Figure 4 Motorola General Business Information, BIOMETRICS IN LAW ENFORCEMENT, 30-9-02 Links http://www.ibgweb.com/ http://www.fingersec.com/indice.htm http://www.integratedbiometric.com/ http://www.biometricpartners.com/Finger_Prints/finger_prints.html http://www.biometricsdirect.com http://www.bioverinc.com http://www.findbiometrics.com/ http://www.biometricscatalog.org/ http://www.itpaper.com http://www.east-shore.com/ http://www.biocom.tv/FacialRecognition.htm http://abcnews.go.com/sections/scitech/CuttingEdge/WTC_biometrics010921.html http://rwor.org/a/v22/1090-99/1093/superbowl.htm http://www.businesssolutionsmag.com/Articles/1998_02/980207.htm http://www.bioverinc.com/files/ready.doc Selected Biometrics: Investigating Facial and Fingerprint Scanning Technologies

URL to website of another team investigating the topic http://irisscan.tripod.com/biometrics/

Page II of 10