handbook of biometrics3

23

Biometrics in the Commercial Sector

Salil Prabhakar

1

and Vance Bjorn

1

DigitalPersona Inc, 720 Bay Road, Suite 100, Redwood City, CA 94063, USA

salilp@digitalpersona.com,vanceb@digitalpersona.com

23.1 Introduction

Biometrics systems have long captured people’s imagination as the inevitable

way people will authenticate their identity in the future. Sometimes such

problems that biometric systems are solving in the commercial sector.

23.1.1 Opportunities for biometrics in the commercial sector

There are primarily three unmet business needs that are creating an urgency

for enterprises to adopt biometrics:

• Reduce Fraud: Businesses are losing billions of U.S. dollars annually due

to fraudulent activities. The amount of fraud has reached epidemic pro-

portions in our global electronically interconnected society. No longer is it

the case that a business deal is done with a handshake and signature on

paper; business transactions conducted fully automatically from remote

locations are the norm. This makes it easier for hackers to commit fraud

person to their digital identity is imperatively needed to check fraud.

480 Salil Prabhakar and Vance Bjorn

• Improve convenience of security: Traditional technologies used for authen-

tication such as passwords and tokens are not only expensive to maintain

but they are also inconvenient to use. Businesses enforce strong password

policies to improve security but people disdain them because remember-

ing several different, long, random, passwords that have to b e changed

every so often is frustrating. To overcome this nuisance, people write their

passwords down on post-it notes or in a computer file, defeating their

purpose. Otherwise, people forget their passwords and call the business’s

helpdesk for a reset, which is expensive to the businesses. For example, SC

• Provide increased security and non-repudiation: Passwords and tokens pro-

vide inadequate security and privacy and are ineffective in providing audit

trails and regulatory compliance. Passwords and tokens can be shared

and cannot ascertain that the person begin authenticated was physically

present at the point of authentication. A stronger method of security and

accountability is needed.

Businesses understand that foolproof personal recognition and security

systems do not exist and perhaps never will. Security is a risk management

strategy that identifies, controls, eliminates, or minimizes uncertain events

that may adversely affect system resources, information assets, and a busi-

23.1.2 Benefits of biometrics in the commercial sector

Traditional technologies used in the commercial sector for achieving a pos-

itive recognition primarily include knowledge-based methods (for example,

personal identification numbers (PIN) and passwords) and token-based meth-

ods (for example, keys and cards). Earlier we alluded to their deficiencies. Let

us elaborate:

• Weak passwords are easy to crack. Most people set their passwords to

words or digits they can easily remember, for example, names and birth-

days of family members, favorite movie or music stars, and dictionary

words. In 2001, a survey of 1,200 British office workers conducted by Cen-

23 Biometrics in the Commercial Sector 481

family member’s name as a password. Others based their passwords on

celebrity or movie character names, such as “Darth Vader” and “Homer

Simpson”. Such passwords are easy to crack by guessing or by simple

brute-force dictionary attacks. Although it is possible, and even advisable,

to keep different passwords for different applications and to change them

frequently, most people use the same password across different applica-

tions and never change it. Compromising a single password can thus cause

a break in security in many applications. For example, a hacker might

create a bogus Web site enticing users with freebies if they register with

long, contains at least one digit and one special character, and must be

changed every couple of weeks. Such policies backfire. Certainly, longer

complex random passwords are more secure, but they are so much harder

to remember, that they prompt users to write them down in accessible

locations such as Post-it notes hidden under the keyboard, an unprotected

electronic file on their computer, or other electronic devices such as cellular

ever, these are in turn protected by weak passwords, which defeats their

purpose.

• Password cracking is scalable. In a password-based network authentication

application, a hacker may launch an attack remotely against all the user

accounts without knowing any of the users. It costs the hacker almost the

same amount of time, effort, and money to attack millions of accounts as

it costs to attack one. In fact, the same password (for example, a dictio-

nary word) can be used to launch an attack against (a dictionary of) user

accounts. Given that a hacker needs to break only one password among

those of all the employees to gain access to a company’s intranet, a single

hacker could make a master key that op ens many locks. Only biometrics

can provide a guarantee of authentication that cannot subsequently be

482 Salil Prabhakar and Vance Bjorn

refused by a user. It is very hard for the user to deny having accessed a

biometric-based system.

In the case of negative recognition (to find if a single person has multiple

identities in a commercial application/database), any other useful technology

simply does not exist. For example, passwords and tokens cannot be used

to find out duplicate identities in a database. Either the businesses have to

trust that the government has not issued multiple identity documents (such as

driver licenses and passports) to a single person and that the issued documents

are unforgeable (for example, by using anti-counterfeiting technologies) or the

businesses have to depend on biometrics technology to find the duplicates

based recognition systems require the person being recognized to be present

at the point of recognition. Biometrics strongly links an identity to a physical

human being. Biometrics are difficult for attackers to forge and for users to

repudiate. Furthermore, the security level is relatively equal for all users in

a system, which means that one account is not much easier to break than

any other (for example, through social engineering methods). The main ad-

vantage of a biometric system in the commercial applications is that it gives

users greater convenience (they no longer have to remember multiple, long

and complex, frequently changing passwords or carry multiple keys) while

maintaining sufficiently high accuracy and ensuring that the user is present

While there is no doubt in our minds that biometric systems address an

important security function in the commercial sector applications and that

its adoption is increasing, the rate of adoption has been somewhat slower

than expected. We believe that this is primarily because of lack of education

and awareness about the benefits and capabilities of biometric technologies.

Secondarily, it may be because the business case for biometrics has often

proven to be somewhat difficult due to the following reasons:

• The business value of “security” and “deterrence” has always been difficult

to quantify in terms of return on investment, regardless of the technology.

23 Biometrics in the Commercial Sector 483

• Fraud rates and costs of long standing business systems (for example, to-

kens and passwords) are not well understood, quantified, and documented.

• Biometrics, being an emerging technology is sometimes confronted with

unrealistic performance expectations and not fairly compared with exist-

ing alternatives (for example, tokens and passwords), whose inconvenience

and high cost businesses have resigned to tolerate. A successful biometric

solution does not have to be 100% accurate and 100% secure. A particular

application demands a satisfactory performance justifying the additional

investments needed for the biometric system. The system designer can ex-

nario testing of biometric systems. Vendor’s own claims of performance

could sometimes be misleading due to vast differences in their testing pro-

tocols and demographics of test subjects. Certain biometrics vendors have,

unfortunately at times, even made bogus performance claims. This leaves

businesses to either perform their own evaluation (which delays deploy-

ment) or rely on references (which could be difficult to obtain because of

nesses with concerns over continued product and support availability.

23.1.4 Biometrics technology adoption in the commercial sector

has come from taking people out of business processes and transactions. For

example, forgotten passwords result in helpdesk calls which are expensive

to businesses. It is abundantly clear and widely documented in popular press

that biometric systems can significantly reduce the spending on helpdesk calls

much beyond the cost of investment. In many commercial applications, the use

of biometrics can facilitate businesses to move to a user-friendly self-service

often more than justify the investment in appropriate biometrics technology.