The New Biology of Biometrics

The field of biometric security is moving beyond mere fingerprint readers and producing more sophisticated devices that are more difficult to dupe. Providers are moving with hardware that senses bloodflow beneath a handprint and software tools that analyze not only the password a user types in, but also how he or she typed it.

To a lot of computer users, the concept of biometric authentication is limited to thumb drive reader devices, eye scanners and voice pattern recognition. Such technologies still face stiff competition in most enterprise circles, where passwords and user tokens seemingly work well enough and are quicker and cheaper to deploy.

Existing security strategies that grant access only after the presentation of a user's recognized physical traits are changing. Updated versions of fingerprint, voice and eye scanners are gaining popularity with IT managers. Newer biometric authentication layers are tightening the security blanket for computer and data access. These innovative devices are making it more difficult for impostors to spoof their way into data they shouldn't be able to access.

Historically, authentication security involved a combination of passwords, PINs, signatures and keys. First-generation biometric authentication devices added more choices to the mix. Now these choices are again changing. New strategies for personal identification are providing stronger security to computers and sensitive data.

For instance, next-gen fingerprint readers can detect the presence of blood coursing through the tissues to eliminate the threat of a severed finger passing muster. Fujitsu Computer Products of America announced on Sept. 9 a mouse with a built-in palm reader that it claims cannot be duped.

"I expect to see even better speed and imaging performance from future [fingerprint] readers. In addition, newer technologies such as IR [infrared] imagers are able to detect thermal signatures of either finger veins, palm or hand veins as well as facial prints. These technologies are starting to appear, but their price points are not where fingerprint sensors are so they are still early in the development cycle. Whether these will become as mainstream as fingerprint biometrics is still unknown, but these technologies look promising," David Ting, CTO of Imprivata, told TechNewsWorld.


Worth the Upgrade?

Next-gen of biometric authentication devices may offer greater security, but that may not be the most pressing issue for potential enterprise adopters. Are enterprises better off upgrading to the newest versions of biometric solutions? Perhaps they would be better off taking a hands-off approach to these newer biometric-based security strategies.

Basic fingerprint readers are becoming so reliable and inexpensive that the level of improved access control they offer is already better. Introducing more costly devices may not be cost effective, Ting suggested.

From a technology perspective, enterprises are starting to see widespread adoption of fingerprint biometrics. A driving factor for this acceptance is the device's long history of sensor development, image processing and a large population statistics, he said.

"The devices on mobile devices are starting to benefit from evolution rather than revolutionary changes as they become more usable (to fingerprint and environmental conditions), durable and faster. This, coupled with the reduction in footprint, power consumption and cost, have resulted rapid adoption for mobile and desktop users, as evidenced by the number of users today who are buying them for their notebooks," he explained.

Lagging Desire

For a variety of reasons, the security industry has not seen widespread requests for voice or facial recognition, even as microphones and digital cameras become standard equipment on notebooks. Factors like variables in the operating environment and how they affect the recognition rates certainly play a large role in this.

"We see companies using technology from the business space and applying it to their own partners. There is no silver bullet with getting security from biometrics. Companies that use biometrics in isolation are finding out that they are getting spoofed. They have to use multiple strategies in concert," Matt Shanahan, SVP of AdmitOne Security, told TechNewsWorld.

When deciding whether to buy into new biometric security devices, IT managers should consider the risk factor they face, he said. They should ask themselves, what are the most concerning threats and what should they do about them?

Two Possibilities


Collusion and corporate social engineering are two typical ploys hackers use to break through security barriers. Biometric devices need to identify the right user, not just a user that appears to be right. However, the devices don't always reach this goal.

"The rise of new threats is causing people to rethink biometrics. Then they have to decide if they should rely on physical, which is more intrusive, or behavioral, which is less intrusive," said Shanahan.

In many cases, advancements made in software-based behavioral biometrics can be 95 percent effective, he added. With physical biometrics, users need new hardware on their PCs, and the upgrades can be expensive.

Behavioral Biometrics

With behavioral biometrics in place on the network end, no external devices are needed. AdmitOne's biometric product captures the typing cadence of the approved users, so whatever keyboard they use, their typing behavior will not change.

In addition, behavioral biometrics provides for multiple levels. For instance, banks using behavioral biometrics first require customers to get the password right. For that same customer to do a transaction online, he or she will have to re-enter the password or answer pre-set security questions.

Another layer can be applied by using risk-based methods. Customers will have to answer different levels of challenges depending on their interactive behavior on line. With risk-based strategies, the degree of strength needed is determined by the amount of risk assessment the access requires, said Shanahan.

All Things Considered

AdmitOne's behavior biometric software relies on multiple sets of factors. For instance, it determines if the log-on attempt comes from the same IP (Internet protocol) address as it usually comes from. A log-on attempt coming from a different geographic region is given special consideration.

"The assessment of risk combines the observable factors with the requested responses. This makes for a reliable pattern of use. Depending on the behavioral assessment, additional levels can be applied, such as calling out to the customer's cell phone. Using these strategies, 99 percent of people won't be challenged at higher levels," Shanahan said.

Palm Science

One innovative physical biometrics device to come down the pike is Fujitsu's mouse and palm reader duo. Its design places the user's hand grip in direct contact with the palm reader embedded into the mouse.

"The palm of hand area is two inches by two inches and is an intricate, data-rich structure. We can capture, classify and identify patterns with infrared lights. This technology looks below the skin's surface at vein patterns. It looks like a bunch of squiggly worms," Jerry Byrnes, manager of biometrics and strategy planning for Fujitsu, told TechNewsWorld.

The technology produces a false rejection rate of 0.0007 percent. The false acceptance rate is 0.01 percent, he said.

"We use a liveness test. It needs to sense flowing blood. The device can't be spoofed," Byrnes ventured.

Different Strokes

The use of different types of biometric devices is meant to address different needs. Some industries will be served better than others by these next-gen biometric technologies.

For instance, vascular biometrics using vein patterns may be an attractive option for some sectors, but the hardware deployment may not be conducive or even possible for all enterprises, noted Byrnes.

Fujitsu's palm and mouse device is already well established in the Japanese banking industry, among others. But the market in the U.S. is much different. There's generally less concern over security, in part because the insurance business in the U.S. covers damages from security breaches.

"One of the biggest and first adopters in the U.S. is the healthcare industry. Compliance rules are driving biometrics acceptance and development. Corporate officials literally have jail hanging over their heads. Our method is well accepted. Another area of adoption [for next-gen biometrics devices] is patient ID and authorization," Byrnes said.

Third-Party Trend

Rather than looking for applications that provide all their own biometric capabilities, users are looking to external providers to support biometric verification for all applications, according to Imprivata's Ting. For example, his company's ProveID application programming interface, which accesses OneSign biometric authentication, is being used by multiple healthcare and financial applications to offload the responsibility for all the workflow, credential storage and device management necessary to support biometrics.

"We expect this trend to continue as more applications are required to comply with having biometric support. This is a win/win for both customers and application providers," said Ting.

The end user doesn't want multiple proprietary devices for individual applications or the need to individually learn to use and enroll with different systems. Similarly, app providers generally don't want to constantly wrestle with the complexities of different authentication technologies, he added.

Most of the biometric technology provided by laptop computer vendors is based on device-centric methods. This means the reference biometric data sets are typically locally stored on the specific device used during enrollment, rather than stored and processed centrally as one would for enterprise use, Ting explained.

"Imprivata has long held the opinion that all reference biometric data need to be stored and managed centrally to offer the maximum flexibility and security for the end users," said Ting.

The OneSign server securely stores the reference fingerprint biometric for all users and supports fingerprint lookup across a distributed environment. This model is more operationally correct within healthcare, government, financial services and utility applications.

Nex-gen enterprise biometric solutions will evolve toward being able to work both with centralized, distributed as well as mobile devices, such as smartcards or contractless smartcards, according to Ting. Another aspect for enterprise-based solutions is the ability to be interoperable across different devices.

This will make it possible for the end user to work with different sensor technologies on different platforms without having to enroll with multiple systems. This need will become more significant as first-generation scanners get replaced by newer ones, predicted Ting.

Growing Geodesic Carbon Nanodomes

 

Researchers analyzing the assembly of graphene (sheets of carbon only one atom thick) on a surface of iridium have found that the sheets grow by first forming tiny carbon domes. The discovery offers new insight into the growth of graphene layers and points the way to possible methods for assembling components of graphene-based computer circuits.

 

Paolo Lacovig, Monica Pozzo, Dario Alfè, Paolo Vilmercati, Alessandro Baraldi, and Silvano Lizzit at institutions in Italy, the UK and USA report their discovery in a paper appearing October 12 in the journal Physical Review Letters.

The researchers' spectroscopic study suggests that graphene grows in the form of tiny islands built of concentric rings of carbon atoms. The islands are strongly bonded to the iridium surface at their perimeters, but are not bonded to the iridium at their centers, which causes them to bulge upward in the middle to form minuscule geodesic domes. By adjusting the conditions as the carbon is deposited on the iridium, the researchers could vary the size of the carbon domes from a few nanometers to hundreds of nanometers across.

Investigating the formation of graphene nanodomes helps physicists to understand and control the production of graphene sheets. In combination with methods for adjusting the conductivity of graphene and related materials, physicists hope to replace electronics made of silicon and metal with tiny, efficient carbon-based chips.

Jorge Sofo and Renee Diehl (Penn State University) highlight the graphene nanodome research in a Viewpoint in the October 12 issue of Physics.

New Software Could Smooth Supercomputing Speed Bumps

Supercomputers have long been an indispensable, albeit expensive, tool for researchers who need to make sense of vast amounts of data. One way that researchers have begun to make high-speed computing more powerful and also more affordable is to build systems that split up workloads among fast, highly parallel graphics processing units (GPUs) and general-purpose central processing units (CPUs).

There is, however, a problem with building these co-processed computing hot rods: A common programming interface for the different GPU models has not been available. Even though the lion's share of GPUs are made by Advanced Micro Devices, Inc. (AMD) and NVIDIA Corp., the differences between the two companies' processors mean that programmers have had to write software to meet the requirements of the particular GPU used by their computers.

Now, this is changing as AMD, NVIDIA and their customers (primarily computer- and game system–makers) throw their support behind a standard way of writing software called the Open Computing Language (OpenCL), which works across both GPU brands. A longer-term goal behind OpenCL is to create a common programming interface that will even let software writers create applications that run both GPUs and CPUs with few modifications, cutting the time and effort required to harness supercomputing power for scientific endeavors.

Researchers at Virginia Polytechnic Institute and State University (Virginia Tech) in Blacksburg, Va., are hoping that OpenCL can help them write software that can run on GPUs made either by AMD or NVIDIA. Using a computer equipped with both a CPU and an AMD GPU, the Virginia Tech researchers were able to compute and visualize biomolecular electrostatic surface potential (pdf) 1,800 times faster (from 22.4 hours to less than a minute) than they could with a similar computer driven only by a CPU.

The National Institutes of Health (NIH) has committed more than $1.3 million in funding from 2006 through 2011 for a project led by Alexey Onufriev, an associate professor in Virginia Tech's departments of Computer Science and Physics, to represent water computationally, because water is key to modeling biological molecules. "When you model a molecule at the atomic level," Onufriev says, "you need to know the impact that water will have on that model."

This is the type of program that GPUs map quite well, says Wu Feng, director of Virginia Tech's Synergy Laboratory and an associate professor in the school's departments of Computer Science and Electrical & Computer Engineering. "These applications tend to be compute-intensive and regular in their computation," he adds, "regular in the sense that you're calculating electrostatic potential between pairs of points."

CPUs, however, are better suited than GPUs to computing tasks that require the computer to make a decision. For example, if a string of computing tasks were likened to a line of people waiting to enter a stadium, Feng says, the GPU would be very good at dividing up the people into multiple lines and taking their tickets as they enter—as long as everyone has the same type of ticket. If some people had special tickets that allowed them to go backstage or entitled them to some other privilege, it would greatly slow the GPU's capabilities as the processor decided what to do with the nonconformists. "GPUs work well today when they are given a single instruction for a repetitive task," he adds.

Feng and his team are adapting an electrostatic potential program for Onufriev's lab so that it will work specifically on computers running GPUs made by AMD. Feng notes that as OpenCL is embraced more widely, he will be able to write programs that can communicate with any type of GPU supporting OpenCL, regardless of manufacturer, and eventually write code that provides instructions for both CPUs and GPUs. (Earlier this week, AMD made available the latest version of its software development tools that the company says allows programmers to use OpenCL to write applications that let GPUs operate in concert with CPUs.)

With this type of computing power and versatility, Onufriev says many limitations will be lifted regarding the types of research he can tackle. Another of his projects is studying how the nearly two meters of DNA in each cell is packed into the cell's nucleus. "The way DNA is packed determines the genetic message," he says. "No one knows exactly how this works. We're hoping to get stacks of GPU machines where we can run simulations requiring massive computations that help us better understand DNA packing." Such work would be aided greatly by systems that can make use of both GPUs and CPUs.

New Computer Graphics Systems Give Reality a Convincing Makeover

Whether they know it or not, the National Football League faithful who root for their teams every weekend have also become big fans of "augmented reality". If you're not sure what this is, take a look at your television on Sunday afternoon and notice the yellow "first down" stripe running the width of the field (as well as a blue one that delineates the line of scrimmage). That's augmented reality—technology that merges computer-generated images with real-world sights and sounds.

For decades, researchers also have been developing a more sophisticated, wearable technology that brings augmented reality to people in their daily lives. Think of a see-through visor in automobiles that would provide directions (not just text, but arrows) to drivers as they cruise down the highway. These kinds of mobile applications are not easy to engineer because the wearer's location is constantly changing, making it difficult for the cameras, angular velocity sensors and accelerometers that are part of a wearable augmented-reality system to determine which graphics to display, says Jurjen Caarls, a researcher at Eindhoven University of Technology in the Netherlands.

Caarls should know, because last week he received a PhD from Delft University of Technology in the Netherlands, where he and colleagues created a prototype augmented-reality system that superimposed computer-generated graphics over real-world scenes. The system included a helmet with a visor that projected images into the wearer's eyes to create the illusion that these images were part of reality. This effect was achieved using two small screens and two semitransparent mirrors built into the helmet.

Caarls's system used a camera and inertia sensors for measuring the wearer's position. Cameras are capable of obtaining accurate absolute positions, but they do so rather slowly, according to an interview with Caarls in the university's Delta newspaper. Inertia sensors are faster, but less accurate, providing only acceleration and rotation speed. By combining the two data inputs, Caarls developed image-processing techniques and filters that allowed for the absolute position to be determined with the camera and a single small visual marker, while information from the inertia sensors was used to interpolate in-between camera measurements. One problem that Caarls could not solve completely, however, was the slight time lag (about 80 milliseconds) between what the user sees in the real world and the virtual projection.

"I can imagine a future in which people experience augmented reality by wearing glasses with integrated displays that project images on their retinas," Caarls said in a press release describing his research. "Think of it as a visual Walkman."

Any augmented-reality system includes three key features, according to Mark Billinghurst, director of the Human Interface Technology Laboratory at the University of Canterbury in New Zealand, in the article, "Annotating the Real World," published in the October 2008, issue of Scientific American. These include: "virtual information that is tightly registered, or aligned, with the real world; the ability to deliver information and interactivity in real-time; and seamless mixing of real-world and virtual information." The keys to advancing augmented reality, he wrote, are advances in display technologies ("virtual" eyeglasses, for example), processors and graphics chips for mobile devices, along with tracking systems and cameras.

Researchers have been building prototype systems for more than three decades, according to an April 2002, Scientific American article entitled, "Augmented Reality: A New Way of Seeing". The first was developed in the 1960s by computer graphics pioneer Ivan Sutherland and his students at Harvard University and the University of Utah. In the 1970s and '80s a small number of researchers studied augmented reality at institutions such as the U.S. Air Force's Armstrong Laboratory, NASA Ames Research Center and the University of North Carolina at Chapel Hill.

In the 1990s Boeing envisioned mechanics wearing head-mounted displays (HMDs) and carrying small computers that would contain a database of information for fixing Boeing products, says Eric Foxlin, founder and chief technology officer of InterSense, Inc., a Billerica, Mass., motion-tracking technology–maker that helped Boeing with the project. Augmented reality would inform mechanics how to replace parts without the need for consulting a manual. More recently, Boeing has proposed its HMD technology (or some variation of it) as a way to help with repairs on space missions.

The publisher of The Official Michael Jackson Opus, a biography of the late performer due in December, plans to incorporated augmented reality into the project. Opus Media Group designed the 400-page, 12-kilogram book so that, when certain pages are held up to a Web camera, "the pages will come alive, with both video and music appearing on your screen while you hold the book up to [Webcam]," according to RollingStone.com.

Identifying ID Theft And Fraud

If the wife of FBI boss Robert Mueller has warned him not to use internet banking because of the threat of online fraud, then what hope is there for the average Jo? The results of research published in a forthcoming issue of the International Journal of Business Governance and Ethics suggests that more of us are no longer entrusting our finances to virtual accounts.

According to Susan Sproule and Norm Archer of McMaster University, Ontario, Canada, identity theft and fraud are an increasing concern to consumers who interact with online businesses routinely.
Phishing for logins is not the only problem. Credit card skimming, insider theft, and counterfeiting of digital information, and ID "trafficking" are also on the increase. All of these types of fraud are costly for the individuals involved both financially and often in terms of the time needed to clear their name when illegal use has been made of their personal details.
The Canadian team has now created a model of how consumer identity theft and fraud occur and in parallel report on a recent survey of Canadian consumers. In assessing fraud concerning credit cards, existing bank accounts, new accounts, and other frauds, they find that one in five people have stopped or reduced the amount of shopping that they do online while almost one in ten are no longer carrying out banking online, or have reduced the amount of online banking that they do because of fraud worries.
"These findings are of concern to business and government," Sproule says, "since, if consumers stop doing business online, the productivity benefits of e-business will not be realized." Until recently there was little information on the problem of identity theft in Canada, in particular, and there were no coordinated efforts within the academic community to examine the problem. She adds. "It was believed that, if unchecked, the problems around identity theft and fraud could have a significant effect on e-commerce."
Fortunately, since 2005, Sproule and her colleagues have been involved in a multidisciplinary program that has brought together researchers from four universities and subject matter experts from the financial and telecommunications sector. Their research is allowing them to define the processes involved in identity theft and to measure its reach.
The team's model of cyber crimes has now defined ID theft and fraud as two distinct but related problems, which could not only help legislators to develop new laws and law enforcers in the pursuit of criminals, but also help educate an unwary public as to how their personal data might be misappropriated and used fraudulently.

---