Abstract-The measurement of unique physical characteristics, such as fingerprints, DNA, or retinal patterns, for use in verifying the identity of individuals .There are several types of biometric identifications such as iris, retina, fingerprint etc, The working of these encryptions is very essential to know. In social, economical, industrial, cultural fields it has its own identity and applications such as bioregistrator, smartcards. Advantage and disadvantage are the two faces of the coin, Biometrics also has its own limitations, we shall try to overcome those.

1. INTRODUCTION The term "biometrics" is derived from the Greek words bio (life) and metric (to measure).Biometrics is becoming an interesting topic now in regards to computer and network security, however the ideas of biometrics have been around for many years. Possibly the first known example of biometrics in practice was a form of finger printing being used in China in the 14th century, as reported by explorer Joao de Barros. He wrote that the Chinese merchants were stamping children's palm prints and footprints on paper with ink to distinguish the young children from one another. This is one of the earliest known cases of

biometrics in use and is still being used today.

Biometrics is a field of science that uses computer technology to identify people based on physical or behavioral characteristics, such as fingerprints or voice scans. "Bio" in the name refers to the physiological traits that are measured, while "metrics" refers to the quantitative analysis that provides a positive identification of a unique individual. Biometrics are gaining widespread use in the business world as means to make the workplace more secure and efficient. The technology promises almost foolproof security for facilities and computer networks. It also helps employees increase their productivity by providing instant identification for time cards, payroll processing, computer logins, phone or copy machine usage, and myriad other purposes.

In the 1890s, an anthropologist named Alphonse Bertillion sought to fix the problem of identifying convicted criminals and turned biometrics into a distinct field of study. He developed 'Bertillonage', a method of bodily measurement whichgot named after him. The problem with identifying repeated offenders was that the criminals often gave different aliases each

1

time they were arrested. Bertillion realized that even if names changed, even if a person cut his hair or put on weight, certain elements of the body remained fixed, such as the size of the skull or the length of their fingers. His system was used by police authorities throughout the world, until it quickly faded when it was discovered that some people shared the same measurements and based on the measurements alone, two people could get treated as one.

After this, the police used finger printing, which was developed by Richard Edward Henry of Scotland Yard, instead. Essentially reverting to the same methods used by the Chinese for years. However the idea of biometrics as a field of study with usefull identification applications, was there and interest in it has grown.Today we have the technology to realise the aims, and to refine the accuracy of biometric identification, and therefore the possibility of making it a viable field.

There are two main modules in a biometrics system. "storing" and "comparing". The sytems must first store your information before it can use this stored information

to compare and verify. The storing process however differs between different systems.

2. BIOMETRICS IS,

A technique that identifies people based on their unique physical characteristics or behavioral traits. Biometrics is a field of science that uses computer technology to identify people based on physical or behavioral characteristics, such as fingerprints or voice scans. "Bio" in the name refers to the physiological traits that are measured, while "metrics" refers to the quantitative analysis that provides a positive identification of a unique individual. Biometrics are gaining widespread use in the business world as means to make the workplace more secure and efficient. The technology promises almost foolproof security for facilities and computer networks. It also helps employees increase their productivity by providing instant identification for time cards, payroll processing, computer logins, phone or copy machine usage, and myriad other purposes.

"The biometrics industry, which produces technologies to identify people by their natural biological features, such as fingerprints, the patterns in the eye's iris, and facial characteristics

2

—the stuff of Mission Impossible—is sensing the chance to break out of high-tech security doors and enter the mainstream of daily life," Julian Perkin wrote in the Financial Times. "Biometrics are enjoying good reviews from the businesses that have integrated them into their systems to date," Sheila Smith Drapeau added in the Westchester County Business Journal. "They are proving themselves reliable, time efficient, affordable, and easy to use—another nod to shaving a few dollars off the office payroll. And their popularity is expected to skyrocket as aging baby boomers concerned with memory loss eagerly seek an alternative to remembering passwords, numerical systems, and their car keys."

One benefit of biometrics is that it relieves people from the burden of remembering dozens of different passwords to company computer networks, e-mail systems, Web sites, etc. In addition to creating distinct passwords for each system they use or Web site they visit, people are expected to change their passwords frequently. Employees who have trouble remembering their passwords may be more likely to keep a written list in a desk drawer or posted on a bulletin board, thus creating a security risk. But biometrics offers an easy

solution to this problem. "An employee may not be able to remember a dozen passwords and PINs, but is very unlikely to forget or misplace his or her thumb," P.J. Connolly wrote in InfoWorld.

A related problem with passwords is that they do not provide reliable security. In fact, hackers can download password-cracking software for free on the Internet that will test the most obvious combinations of characters for each user on a system and often find a way in. Electronic retailers have found that their prospective customers are aware of the unreliable nature of password-based security systems. A survey conducted by Yankelovich Partners and reported in Entrepreneur indicated that security concerns prevent 31 percent of Internet users from making purchases online. Installing a biometrics-based security system is likely to impress customers who are concerned about Web site security. "You may already have the solution to all your security needs right in the palm of your hand—or, more likely, at your fingertips," Mike Hogan noted in Entrepreneur. "That's because biometrics offers an answer to all security and authorization issues."

3

Biometrics systems—which once cost tens of thousands of dollars to install—were originally used only by large corporations and the government. But now less expensive systems—costing as little as a few hundred dollars per desktop—are making the technology available to smaller businesses and individual consumers. As a result, analysts believe that the usage of biometrics will grow over the next few years, so that the technology will become prevalent on the Internet as well as in businesses. Several recent developments have helped assure the future of biometrics. For example, digital signature legislation passed in 2000 provided for biometric authentication to be accepted in place of a written signature and considered legally binding on documents. In addition, Microsoft announced that it would support biometric technology in future versions of Windows, making it easier to build Internet and network servers that can accept the biometric identifications. Before long, biometric scanning devices may be bundled into every new PC sold.

One of the first general applications of biometric technology may be in the health care industry. The Health Insurance Portability and

Accountability Act recommended biometric authentication for health care facilities and insurance providers and set high penalties for improper or negligent disclosure of medical information. At some time in the future, every U.S. citizen's medical records may be available online and accessible with biometric authentication. This would allow individuals to access their records from a pharmacy or an emergency room far from home. It would also allow physicians to share case information and expertise online. However, many people still have concerns about privacy and worry that the online availability of medical records might affect their ability to change jobs or obtain insurance.

3.Types of Biometric Encryption

    There are many types of biometric encryption that are being explored today.  Below are listed some of the methodologies which have been receiving some attention lately.  Click on the description to learn more about each type of biometric encryption.

A. Fingerprint Recognition    B.Optical RecognitionC. Facial Structure Recognition D. Voice Recognition

4

E. Signature RecognitionF. Keystroke Recognition

:

Fingerprint identificationFingerprint ridges are formed in the womb; you have fingerprints by the fourth month of fetal development. Once formed, fingerprint ridges are like a picture on the surface of a balloon. As the person ages, the fingers get do get larger. However, the relationship between the ridges stays the same, just like the picture on a balloon is still recognizable as the balloon is inflated. By having an individual scan their fingerprint electronically to decode information, the transmitter of the data can be certain that the intended recipient is the receiver of the data.  When scanned electronically, fingerprints provide a higher level of detail and accuracy can be achieved over manual systems. One concern of fingerprint biometrics is that latent prints left on the glass will register the prior user, however there already exist units that will not scan unless a "live" finger is on the glass and will only register the later imprinnt.Closely associated with fingerprint

biometrics is another biometric that registers the imprint left by the palm of the hand.  These types of scanners measure the geometry of the hand rather than the fine skin patterns as found in the finger tip.  Hand scanners have been used in apartment buildings, nurseries, and even the 1996 Olympic Village in Atlanta to control access to restricted areas.  These units are more commonly found in areas where dirt or debris on hands may make fingerprint identification difficult such as on shop floors in manufacturing plants.

Hand geometryHand geometry is the measurement and comparison of the different physical characteristics of the hand. Although hand geometry does not have the same degree of permanence or individuality as some other characteristics, it is still a popular means of biometric authentication.

Palm Vein AuthenticationThis system uses an infrared beam to penetrate the users hand as it is waved over the system; the veins within the palm of the user are returned

5

as black lines. Palm vein authentication has a high level of authentication accuracy due to the complexity of vein patterns of the palm. Because the palm vein patterns are internal to the body, this would be a difficult system to counterfeit. Also, the system is contactless and therefore hygienic for use in public areas. Optical RecognitionThere are two common types of optical biometrics; retinas and irises.

Retina scan

A retina scan provides an analysis of the capillary blood vessels located in the back of the eye; the pattern remains the same throughout life. A scan uses a low-intensity light to take an image of the pattern formed by the blood vessels. Retina scans were first suggested in the 1930's.

Iris scanAn iris scan provides an analysis of the rings, furrows and freckles in the colored ring that surrounds the pupil of the eye. More than 200 points are used for comparison. Iris scans were proposed in 1936, but it was not until the early 1990's that

algorithms for iris recognition were created (and patented). All current iris recognition systems use these basic patents, held by Iridian Technologies.

Face recognitionFacial characteristics (the size and shape of facial characteristics, and their relationship to each other). Although this method is the one that human beings have always used with each other, it is not easy to automate it. Typically, this method uses relative distances between common landmarks on the face to generate a unique "faceprint." This type of technology has been popularized in many action movies as a means of identifying villains as they enter a building.  Facial biometrics can function from either short distances or over greater distances.

Signature

Although the way you sign your name does change over time, and can be consciously changed to some extent, it provides a basic means of identification. Biometric signature recognition operates in a three-dimensional

6

environment where, not only is the height and width of pen strokes measured, but also the amount of pressure applied in the pen stroke to measure the depth that would occur as if the stroke was made in the air.  This helps to reduce the risk of forgery that can occur in two-dimensional signatures

Voice analysisThe analysis of the pitch, tone, cadence and frequency of a person's voice.     There are several distinct advantages that voice recognition has for use in encryption technology. 

it lends itself well for voice verification over the public telephone system and is more secure than PINs.Keystroke Recognition

    This type of technology is not as mundane as it sounds.  The concept is based off of the current password or PIN system, but adds an extra dimension of keystroke dynamics.  Not only must an intruder know the correct password using this technology, but they must also be able to replicate the rate of typing and intervals between letters to gain access to the

information.  It is most likely that, even if an unauthorized person is able to guess the correct password, they will not be able to type it with the proper rhythm unless they have had the ability to hear and memorize the correct users key strokes.

4. How Biometrics Systems Work

The main biometrics systems on the market work by scanning an individual's fingerprints, hands, face, iris, retina, voice pattern, signature, or strokes on a keyboard. According to Hogan, finger scanning accounts for 34 percent of biometric system sales, followed by hand scanning with 26 percent, face scanning with 15 percent, voice scanning and eye scanning with 11 percent each, and signature scanning with 3 percent. Retinal scanning—which reads the blood vessels in the back of the eye and requires the user to be within six inches of the scanning device—is the most accurate system but also the least likely to enjoy widespread use because of people's natural protectiveness toward their eyes.

7

Once the scanner reads the user's physiological information, the computer begins analyzing it. "The system reads the physical or behavioral characteristic, looks for telltale minutiae, and applies an algorithm that uniquely expresses those minutiae as a very large alphanumeric key," Bill Orr explained in the ABA Banking Journal. "This sample key then goes to a repository where it is compared with a key (called a template) that was created by the approved user when she enrolled in the system. This in turn generates a score based on how closely the two samples match."

Some experts suggest that the various types of biometric technologies will be combined as needed to fit different user applications. "If you already have a telephone in your hand, the most natural thing in the world is to use voice scanning for identification," Samir Nanavati of the International Biometric Group told Hogan. "If you're already typing at a keyboard, the unique pattern of how you type makes the most sense. And if you need an electronic signature anyway, why not do a biometric match for identification purposes?"

For companies hoping to incorporate some form of biometrics into their facility or

computer security systems, the most difficult aspect of the process might be making various systems work together. "The tough part of implementing a biometric method isn't choosing between face, fingerprint, and voice pattern recognition but integrating the chosen method with your existing applications," Connolly acknowledged in InfoWorld. Even though biometric scanners are becoming more affordable, Web site operators still have to buy authentication and authorization servers that can accept the biometric identifications. However, some vendors are beginning to offer these services for companies that are unable to maintain a biometric server in-house.

Perhaps the most difficult obstacle to overcome in adopting biometric technology is employee or customer concern about its invasiveness. For example, many people think the technology could be used to collect fingerprints for a huge database. "But that's not how it works," Hogan noted. "While biometrics may make you more efficient at matching your Web site visitors to the customer profiles you keep of them, it doesn't provide any more information about the user at the point of access than the typical password system."

8

WORKINGKeystroke Recognition

    This type of technology is not as mundane as it sounds.  The concept is based off of the current password or PIN system, but adds an extra dimension of keystroke dynamics.  Not only must an intruder know the correct password using this technology, but they must also be able to replicate the rate of typing and intervals between letters to gain access to the information.  It is most likely that, even if an unauthorized person is able to guess the correct password, they will not be able to type it with the proper rhythm unless they have had the ability to hear and memorize the correct users key strokes.

DEVICES:

BioRegistrator®

BioRegistrator® is the proven identity platform for the electronic identification of persons.  The product can be used as enrolment tool (i.e. capturing of biometric characteristics), for the registration of identities (personal information ) and verification purposes. The product makes deployment of biometric technology

accessible for all kind of organisations.It saves customers development costs for applications, reduces the time to deploy biometric technologies and creates an independent platform for biometric suppliers.The product has been proven in combination with several biometric technologies, like face and fingerprint recognition. Quality tools are integrated to make automatic capturing possible. It uses international standards for storage and exchange of biometric templates and images (e.g. NIST) and can be connected to biometric AFIS databases. It is independent of the supplier of the algorithm.The product is worldwide used in large biometric systems. HSB identification has available a monitoring tool to support customers from a distance with the use of biometrics.Applications for BioRegistrator® are (portable) enrolment stations, visitor's registration, employee registration and secure

9

access control to building and property.

Mobile Biometric DevicesThe identity of persons can be checked with mobile devices including  the BioRegistrator® software platform.

Handheld terminals

Basic functionality: Accept contactless

smart cards for ID-checks including 1-to-1 verification

GPRS / GSM transmission; for exchange of identification data over the air

Fingerprint sensor for verification and identification purposes

One-to-many identification up to a limited amount of templates

Technical specifications: Small handheld

terminal Windows mobile 5.0 BioRegistrator®

2. Portable terminals

Basic functionality:

Fast one-to-many identification in local database

Synchronisation protocol with base station

Independent from fingerprint scanners (optical or sensor)

Technical specifications: TabletPC with

Windows XP for TabletPC

Biometrics quality tools

Fingerprint matching algorithm

BioRegistrator®

Multifunctional Smart Card

One card fits all.... Many companies and institutes are looking for better services and higher efficiency with the use of one multi-functional smart card for several applications such as payment, parking, logical or physical access and ID-cards. The cards can either be contact of, even more, contactless like Mifare. Examples can be found in education (University Cards) and larger communities (City Cards).

10

Smart Card Management is an important tool to manage the issuance of these cards by either local or centralized personalisation. Before creating these cards information has to be acquired: photo’s, personal data and application rights.

During the life cycle of these cards CardCare® will manage new card requests, the registration of lost and stolen cards (revocation), but also the change of specific authorisation rights. Applications can be added to the card at any moment.

With its track record HSB identification can support you with the blue print of such implementation.

Applications:

Payment Parking Physical Access Logical Access Multifunctionals Membership ID for

libraries, museums, etc. 

Sample Uses of Biometrics Time and attendance

reporting Building access control ATM transaction

verification Computer data base and

network access Vehicle access and ignition

security Residential access and

security alarm control Vault and safe access Verification of signatures Parolee and home arrest

monitoring Personalized firearm

safety Point-of-sale identity

verification "Chain-of-custody"

verification Security guard tour

tracking Inmate identity

verification Refugee and POW

identification Portable law enforcement

identity checks Secure cable TV access Process control security Cellular telephone security

11

Applications

IBG designs, builds, and integrates custom solutions for diverse biometric applications such as IT/Network Security, e-Commerce, Identification Systems, Access Control, and Smart Cards. Specific skills and experience are required for different biometric applications - in many cases the biometric solution is a small part of the overall technology challenge. Requirements for accuracy, ease of use, response time, legacy integration, security, and privacy differ widely across these applications. IBG's vendor-independent and technology-neutral approach allows us to incorporate best-of-breed solutions, and to develop standards-based infrastructures and platforms to meet specific client needs. 

Identification Systems Biometrics are increasingly integrated into large-scale systems for drivers' licensing, surveillance, health and identity cards, and benefits issuance. The need for singular identification and transactional verification has emerged in various public and private sector environments. Learn More

IT/Network Security As more and more valuable

information is made accessible to employees via LAN and WAN, the risks associated with unauthorized access to sensitive data grow larger. Protecting your network with passwords is problematic, as passwords are easily compromised, lost, or inappropriately shared. Learn More

e-Commerce and Internet Biometrics are being positioned as a solution for e-Commerce and Internet security, designed to ensure that only authorized individuals can access sensitive data or execute transactions. From the perspective of commercial or government institutions, however, building effective e-Commerce and Internet solutions is more complicated than replacing a password dialog with a biometric interface. Learn More

Access Control Biometrics have proven to be an effective solution for high-security access control, ensuring that only authorized individuals can access protected or secure areas. However, there is more to deploying biometrics than replacing or complementing existing proximity or swipe systems. Biometric systems require controlled and accurate enrollment processes, careful monitoring of security settings to

12

ensure that the risk of unauthorized entry is low, and well-designed interfaces to ensure rapid acquisition and matching. Learn More

Smart Cards Biometrics are an authentication technology; smart cards can be a storage, processing, and/or authentication technology. In certain applications, the two technologies compete, such that an institution may deploy smart cards instead of biometrics for access control, or vice versa. Increasingly, the two technologies are deployed in conjunction, strengthening each other's capabilities

Advantages of a biometrics system Personal privacy. The user remains in full and exclusive possession of their biometric data. It is stored securely on their personal device. Personal privacy is maintained and the user's biometric data is never shared, collected or stored in any external system.eliminating the need to carry multiple access cards or to remember multiple passwords reduces long-term credential issuance and management costs.

The fact that you will have to personally be present in order to authenticate yourself is the

advantage of this system. Finger print or retina of the eyes of one person do not match with anyone else's data in the database. Therefore there is abosolutely no chance of other people using your identity. Disadvantages of a biometric system.

The finger print of those people working in Chemical industries are often affected. Therefore these companies should not use the finger print mode of authentication.

It is found that with age, the voice of a person differs. Also when the person has flu or throat infection the voice changes or if there there are too much noise in the environment this method maynot authenticate correctly. Therefore this method of verification is not workable all the time

For people affected with diabetes, the eyes get affected resulting in differences. 

Biometrics is an expensive security solution.

Biometric Encryption and Electronic Commerce

13

    Most of the firms who manufacture biometric encryption devices see the Internet as the "Holy Grail" for widespread acceptance of their devices.  As described earlier, two-way public systems are the safest for use over open networks.  Therefore, individuals would need to be able to combine their biometric identifiers to code a common encryption key to perform electronic commerce over the Internet domain.  A firm would be able to code information that would only allow its intended recipient(s) to receive the information.  Organizations would be able to perform paper intensive transactions such as billing and payments over an open network without the concern of easy access to sensitive banking information such as account numbers and access numbers.  Companies would benefit from these types of secure transactions because it would speed up the amount of time required to obtain payments from their customers while at the same time avoiding bank charges for processing of paper transactions such as checks.

    Companies could manage their entire supply chain in a secure environment using

biometric encryption technology.  Electronic data interchange (EDI) would be easier to facilitate without the need for dedicated networks to deter outside agents from obtaining a company's sensitive information.  Orders could be placed with vendors without allowing outside parties to know quantities and prices, and corporate officers could communicate with one another about sensitive company policies using e-mail on open networks.

    It is not a matter of "if" biometric technology will come into play in electronic commerce in the future, but more a matter of "when" it will come into play.  As technology continues to grow, the need for this particular technology will grow at an equal pace.  Corporations, governments, and individuals all see the potential of biometric encryption to further electronic commerce in future.  

ConclusionBiometrics offers substantial benefits in addressing the need for reliable verification of identity. Combining the power of biometrics with a personal token that can securely carry and deliver the variety of credentials that are utilised by the different systems in

14

today's buildings and IT environments – and only deliver those credentials after a biometric verification of identity –can directly help organisations reduce costs, streamline the lives of their users, and achieve convergence of identity across their physical and logical security systems.

REFERENCES

Connolly, P.J. "Biometrics Comforts Customers while Securing Assets." InfoWorld. April 2, 2001.

Connolly, P.J. "Future Security May Be in the Hands, or Eyes, of Users—By Eliminating the Need for User Passwords, Biometrics Will Tighten Networks and Save Big IT Money." InfoWorld. October 16, 2000.

Connolly, P.J. "Security Steps into the Spotlight." InfoWorld. January 29, 2001.

Drapeau, Sheila Smith. "Biometrics: Where Science Meets the Company Payroll." Westchester County Business Journal. February 5, 2001.

Fonseca, Brian. "Biometrics Eye the Mainstream Markets." InfoWorld. January 15, 2001.

Hogan, Mike. "Body Language." Entrepreneur. March 2001.

Orr, Bill. "Time to Start Planning for Biometrics." ABA Banking Journal. October 2000.

Perkin, Julian. "New Services Will Keep an Eye on Security: Biometrics." Financial Times. February 21, 2001.

15