Originally Published: Thursday, 30 August 2001 Author: Shashank Pandey
Published to: enchance_articles_security/Advanced Security Articles Page: 1/3 - [Printable]

Biometrics: Just in a James Bond Flick? Not Anymore!

We all know that Linux is growing in popularity with embedded device makers of all kinds. Due to a variety of compelling factors Linux may well be the operating system behind all kinds of items of technology you use every day, without even knowing it. Security systems will be one of those. This article provides a brief overview of the new science of biometrics and how it is shaping up in the security technology sector.

   Page 1 of 3  >>

Out from the world of geeks and James Bond movies Biometry is the New-kid-on-the-Blockâ With the potential to change the way modern security systems are going to work, this technology is certainly powerful and here to stay.

Without further ado lets take a plunge into the hi-tech world of Biometrics.

The word 'Biometry' basically comprises of two words : bio + metry. The word 'bio' refers to life or a living being and the word 'metry' refers to 'measurement'. So 'Biometric' can be summed up as: the science of measurement of physical attributes(unique) to a living being (for authentication /authorization.)

These systems are one level up from traditional methods of authentication like passwords or security access cards because they ensure that the person trying to log on is actually the valid user and not just someone who is trying to impersonate an identity after he/she found an access card lying below your office desk or password written on a piece of paper as a reminder in case of a memory lapse.

Biometrics find a range of usage, like in hospitals, by law enforcement agencies, corporate solutions, VPNs solutions, limiting access to a private and sensitive database behind the corporate firewalls, in airports etc.

All biometric devices follow a general logic pattern for authentication, which can be summarized as:

1 Taking Input : First step involves taking an input like a fingerprint scan, eacan, iris scan etc from an user.

2 Processing Input : After capturing the image, the biometric recognition software digitizes and encrypts the input. This type of encryption, called Hashing or One way encryption is also present in Unix and does not allow the encrypted data to be decrypted (although, the encryption can still be crackedâ if its weak).

3 Storage : This digitized and encrypted biometric input is stored in a database for comaprision, authorization or rejection.

4 : Authentication : When a User logs on, his or her biometric input (voice pattern, retina scan, facial scan etc) is taken and matched with the existing database of biometric values.

if the match is positive : grant access to the resource if the match is negative : deny/lock access to the guarded resource

One important thing to know here is that these biometric systems do not record actual images of fingerprints, faces, etc. Instead, they process and store only mathematical models representing those attributes.

A couple of terms are associated with Biometric devices and are important to understand: a) False Acceptance Rate (FAR) : The rate at which an intruder can be recognized as a valid user.

If a vendor's FAR is quoted as 3% it means that three out of 100 users attempts to bypass the biometric device's security will succeed.

b) False Reject Rate (FRR) : The rate at which a valid user is rejected by the system. So a FRR of 3% means that three out of 100 valid users attempts will be rejected by the biometric device.

So the better biometric device (security wise) is the one with low FAR and FRR.

   Page 1 of 3  >>