A Perfect Match

Consider multiple options for deployment of biometric authentication

• By Damon Dageenakis
• Sep 01, 2008

As more organizations implement biometrics, it is not uncommon to see an iris reader used to control access to an IT server room, a fingerprint sensor integrated into a laptop computer for desktop logon or a facial recognition system used to clock in on a factory floor. Although these are excellent examples of the use of biometrics, for many organizations the question remains, “Should we be using a biometric, and if so, what type?”

Whether the application is used for physical access control to a building, logical access control to a PC or time and attendance functions, biometric verification offers a number of benefits over traditional methods of authentication. Biometric verification is more productive and convenient than traditional methods and eliminates the need to remember multiple PINs or passwords. Additionally, each biometric is unique to a person, thus ensuring high-accuracy authentication for access control.

Which Solution is Right?
While there are no hard and fast answers regarding which biometric method works best for an organization, there are several issues, including regulatory compliance and/or government standards, that compel companies to consider deploying specific types of biometric installations.

The intense pressure for governance and compliance impacts organizations by amplifying the focus on security policies, controls, auditability and identity assurance. With increased regulatory considerations, including accounting and insurance security audits, these regulations and programs drive the need for multifactor authentication, especially where unsecured access to sensitive locations or information can lead to dire consequences. For instance, the government’s TWIC program requires that a biometric be enrolled on a smart card to access facilities, protecting U.S. ports from potential terrorist infiltration.

While most biometric solution providers offer both server and smart card-based methods of template storage and distribution, a smart card-based method enhances the privacy of biometric templates while reducing system installation costs and complexity. The result is an increased return on investment for the organization. Overall, the right biometric system will reduce costs and/or improve productivity such that it will pay for itself in a reasonable period of time, so long as the secondary authentication is protecting something of high value.

Deployment Within a Network
If an organization is looking to increase security within a facility, biometrics easily can be integrated into existing access control systems. Most biometric devices are equipped to support traditional Wiegand output, as well as bidirectional serial communication. Implementing biometrics can be as simple as adding a standard keypad or card reader. In this case, the question of where to install biometrics within the existing access control framework often arises.

Every organization’s needs are different, which often results in a tailored biometric installation. Organizations must weigh their need for increased security against cost, as well as increased throughput time and environmental considerations. For instance, organizations with larger physical spaces and security-sensitive locations, such as an airport, tend to install more biometrics to protect these locations, such as data centers and sterile areas. In contrast, organizations with few employees and less sensitive locations install biometric access on a smaller portion of physical access points like IT server rooms while using a biometric time and attendance system to ensure proper employee clock-in and clock-out.

For biometric installations at perimeter locations, an organization should consider that throughput time will increase. To prevent bottlenecks at main entrances, enough entry points should be available for employees. This is especially important for employees who use a biometric time and attendance application that requires them to clock in for their workday. For biometrics that will be installed on outdoor perimeters, consider a biometric that can perform and is rated for your climate. Additionally, it is important to work with a large portfolio of biometric products that can provide a variety of options, ensuring that the installation is tailored to meet the organization’s needs.

Application of Biometrics
Beyond standard access control, biometrics can be leveraged for other applications, including providing business efficiencies in the areas of time and attendance and logical access. Within the time and attendance space, biometrics can be used to confidentially support self-management at a PC terminal.

For instance, when an employee uses a biometric system to request time off or a shift change, the system is assured that the employee is the one who made the request. This helps to minimize the overhead of human verification and improves the ROI within an organization.

There are additional benefits of using a biometric. Once it can be positively confirmed who executed a transaction at a PC terminal using a biometric, more sensitive data can be shared, enabling employees to check their vacation time status, request time off and view short but important messages. The biometric adds non-repudiation, which is important when dealing with personnel issues.

What Should be Used?
Once the decision is made to deploy biometrics, the next question is usually, “What type of biometric should be used?” While there is no standard answer, there are several considerations for choosing which type of system to deploy, including:

Privacy. During enrollment, users often ask, “Is my biometric securely stored or will this be shared with any government agency?” Although biometrics are typically not shared, users often do not accept the argument and remain concerned with letting their information be stored on a server. In these cases, a better approach is to store the biometric on the user’s smart card and nowhere else. The template is read during the verification process and then discarded by the reader.

Cost. The key is to focus on the total cost of deployment and ongoing use, including the direct cost of the biometric equipment, as well as the cost associated with training users and maintaining the system.

Ease-of-use/traffic. For very hightraffic areas, such as the entrance to a large building, it may be necessary to use multiple readers to not delay employees during peak traffic times.

Installation environment. For environments where hands are used a lot for other tasks, the condition of the fingers may reduce the effectiveness of fingerprints. Even the best sensors have a difficult time reading wet and dirty fingers. In that type of environment, an iris-based biometric may be an effective solution, since no direct physical contact is required. Facial recognition—which performs best when the lighting at authentication is similar to when the user was enrolled—may require the biometric to be used in the same location every time, which can be impractical or problematic for portable use.

Form factor. This is a more sensitive topic when looking at the logical access arena. As travel restrictions become more prevalent and limitations are placed on carry-on luggage, it can be cumbersome to carry an extra peripheral for authentication when conducting PC log-on and single sign-on. This is where built-in biometrics is extremely beneficial.

Accuracy. The degree of accuracy desired must be balanced against speed and ease-of-use. For larger organizations with a biometric database that may have up to 100,000 records, it is not realistic to expect to identify a person in one second solely from a fingerprint presented at a door. Iris and retinal scans, while generally considered to be more accurate, are more time intensive.

Smart-Card Biometrics
Smart cards minimize the overhead when dealing with biometric template management and distribution. Rather than storing biometrics on a server and distributing them over a wired network, a smart cardbased system allows biometric templates to be carried by the card holder. By using smart cards, biometric templates are mobile and easily can transact with the biometric reader in the field, eliminating the need for the templates to be added, stored or purged on back-end systems.

With smart cards, security is often enhanced and privacy concerns are addressed with biometric template storage only residing on a secure card. Also, coupling a smart card with biometrics for some logical access applications can advance security, improve convenience for the end user and minimize help-desk calls for forgotten passwords in single sign-on cases.

System administration also is made easy with smart cards, as there is no need to download templates to biometric readers or worry about template capacity within the reader. Smart cards deliver template storage to an unlimited number of users. Additionally, the investment in smart cards returns an incremental benefit when adding more applications to the card.

The Algorithm Factor
Smart card-based systems also address privacy concerns by employing mutual authentication and encryption to protect the biometric template on the card. Algorithm choice also is something to consider when selecting a biometric system. There are two primary algorithms: a one-to-one and a one-to-many algorithm.

A one-to-one algorithm verifies the end user’s real-time data—fingerprint image or iris image—against his or her template. This algorithm requires that both a credential and real-time biometric data be supplied to initiate verification. A credential provides a unique identifier for the end user and/or the biometric template(s). Examples of credentials include iCLASS® and MIFARE contactless smart cards, magnetic stripe cards and keypad entry.

A one-to-many algorithm attempts to locate or identify an end user’s biometric information from a database of templates. The end user is only required to provide his or her real-time biometric data to the device; no card or PIN is required to initiate the process.

Although each algorithm has its advantages and ideal installation scenarios, a one-to-one algorithm is generally considered more secure and accurate. For a oneto- one biometric device, the end user must always supply at least two factors of authentication: the credential—what you have—and the candidate data—who you are. One-to-many algorithms attempt to match the candidate data to a potentially large database of templates. A one-to-one algorithm is only comparing candidate data against the template(s). These basic factors lower the probability for a false acceptance to occur within a one-to-one device. This system also addresses broader privacy concerns, as there is no database of biometric templates that can be hacked. Additional security can be achieved when factoring in the use of smart cards, which creates another layer of security via a diversified unique key specific to the site.