Article

Kiosk biometrics: All in favor say eye

The growth of e-commerce at kiosks has created a desire for better methods of security and user authentication. The result: biometrics.

March 19, 2002

A well-respected technology expert and consultant to the kiosk industry, Francie Mendelsohn heads Summit Research Associates Inc. She has worked as a programmer, systems analyst, computer specialist and project manager. She is a frequent speaker at conferences and seminars throughout North America, including KioskCom, COMDEX, ComNet, FOSE and IDC briefings.

The majority of retail kiosks now being installed allow for purchases to be made at the

device. Add to this the rapidly growing number of incidents of credit card fraud, and you have the basis for increased concern about security and authentication, or ways to prove you are you who say you are.

Biometrics is the answer. Defined as a measurable physical characteristic or personal trait used to recognize the identity, or verify the claimed identity of a person through automated means, biometrics is being considered as a key ingredient of some kiosk solutions.

There are a number of different biometric systems in use. These systems scan fingerprints, hand geometry, facial features and irises. All but facial recognition are currently being implemented on kiosks. Facial recognition, which creates an elaborate set of data of the structure of a person's face, has historically been too CPU-intensive and expensive for widespread use. This has changed in recent months and will soon be offered as another alternative.

Give it a whorl

Fingerprints have been used for identification for many years. They are reasonably accurate and have the advantage of an enormous database of prints against which to match. The downside is that they project an aura of criminality. People feel they are guilty of something if they are asked to give their fingerprints.

There are many problems with accuracy, as well. A common problem is called "old and cold." As people age, their fingerprints appear to fade, and it becomes more difficult to get an accurate reading. Similarly, when people come in from the cold or are in air-conditioned rooms, their fingertips remain cold for a period of time. This, too, affects accuracy.

Another problem is the effect of injuries. A cut finger will often yield a false negative. Dirt and grime will also affect accuracy.

Finally, the reader requires active participation-the user has to place his or her finger directly on a reader. As a result, and because of the spread of epidemics like AIDS and hepatitis, many people feel uncomfortable using fingerprint scanners due to concern over catching a communicable disease.

Despite germ fears, a number of applications include scanning fingerprints for authentication. Some keyboards, notably those made by Cherry, have been introduced that have a fingerprint reader built-in.

Other manufacturers are selling standalone fingerprint readers, peripheral devices that attach to a PC's serial port. Some ATMs now use them to authenticate the customer. For example, First Union Bank requires non-bank customers to use an ATM fingerprint reader in order to cash checks.

Several kiosk developers, especially those specializing in financial services, are implementing the reader into their designs.

My, what big hands you have

Hand geometry scanners require a user to place his or her hand (usually the right hand), on the device. The machine displays an outline of a right hand as a guideline for proper placement. The reader contains four stick-like pins that stop further forward movement of the hand.

The authentication method measures the thickness and length of the fingers, and the distance between them. The scanning algorithm used to measure the hand creates a unique scan that is usually stored on a magnetic stripe card. Although the criteria make it seem unlikely these devices can create a unique identifier, in fact, hand geometry authentication is effective: the likelihood of a duplicate hand geometry is one in a million.

Hand scanners are being used at airports to control access to employee-only areas, and by the Immigration and Naturalization Service (INS) as part of its INSPASS (INS Passenger Accelerated Security System) kiosks.

INSPASS kiosks identify frequent business travelers between the U.S. and Canada. Travelers register their hands and are given an INSPASS card to use during security checks. Each time registered passengers go through U's security at major gateway airports to and from Canada, they insert their cards in the kiosk's card reader, put their hands on the hand geometry reader, verify their identities, receive security clearance (on a piece of paper) and are on their way. The transaction takes less than 40 seconds.

Hand geometry enjoys the benefit of not being a fingerprint reader. The aura of criminality associated with fingerprints is not a factor with these devices.

Though accurate, these systems are less so than fingerprint systems. Because they, too, require users to place their hands upon a reader, the same fears of catching a disease are present.

Relatively easy to use, it is also easy to get a false reading if fingers are not placed in the right position. Their popularity has grown, but there are no plans to market PC-based readers that would attach to the home computer. Deployment has been strictly in commercial environments.

The eyes are the window

The use of iris scanning devices is becoming more widespread. These systems read the black flecks that make up an individual's iris. The scan produced from a person's right eye is completely different from his left eye; even identical twins have completely different iris patterns.

The process by which one's eye is scanned is fast, easy and painless. A picture is taken of the iris and the black flecks are measured. The scan is repeated twice, and an average is taken. The amount of light required to read the iris need only be 30 watts, far weaker than an ordinary reading light.

Iris scans are accurate from an age of 18 months until five minutes after death. Readers match the pattern of the user against patterns stored on a database. Readers also verify that the eye is pulsating. This prevents someone from placing a color photograph in front of the reader to try and fool the system.

While some ATMs and financial services kiosks have used this technology for several years on a limited basis, it is expensive to modify existing equipment in order to add the readers and identification software.

These systems are starting to gain popularity in the kiosk arena. Airlines are starting to use this system in check-in kiosks. EyeTicker of McLean, Va. is launching a six-month trial of its service at London's Heathrow airport this fall. There, the immigration service will link each passenger's iris scan to a database containing that passenger's name, flight and passport data.

This system will dramatically reduce the time it takes to check a passenger's passport by hand. Other applications of the system will include allowing registered passengers to check in and obtain baggage tags and boarding passes.