For your eyes only

17 Jun 2002

Retinal and iris scanning are generally used for high-security authentication, with the biggest users being government agencies, security services and the military. Stephanie Gordon finds that financial bodies are now evaluating the usefulness of the technique in automated teller machines.

From Opto & Laser Europe May 2001

Ocular biometrics - the science of optically scanning the iris or retina - is widely regarded as being more accurate than fingerprinting, face scans, signature recognition and voice recognition.

The basic hardware requirements for iris recognition are low-end processors and CCD cameras. Retinal scans require low-intensity infrared light and a video camera.

Revenues for ocular biometrics in 1999 were $1.1 million or 600 units (devices or software installations) and prices are expected to continue falling, dropping below $1000 per unit by the year 2005. In 2002, Frost & Sullivan (F&S) expects revenues to reach $2.5 million, then rising to $7.1 million by 2006. In unit terms, shipments will rise from 1700 to 8600 over the same period.The technique is concerned only with the unique characteristics of the retina and iris. John Daugman of Cambridge University in the UK is the driving force behind iris recognition research and his algorithms are the basis for all systems worldwide.

Daugman said: "The point of biometrics identification is to test for highly distinctive biological characteristics that are provably unique to a single person."

The algorithms allow the unique features of an iris to be encoded in as few as 256 bytes - enough to enable the identity of an individual to be established, verified or denied by comparison with reference iris patterns. Comparisons can be made at a rate of 100 000 individuals a second using ordinary computer equipment. Dedicated hardware could speed this up to 160 million people a second.

A perfect match is not crucial, because the identification algorithm can accept up to 33% mismatch and still make an identification with a high confidence level. This robustness stems from the fact that the remaining code contains many key features of the iris.

The iris recognition algorithms begin by mapping the inner and outer edges of the iris - detecting and excluding eyelids and eyelashes - with mathematical operations that are able to detect boundaries.

A co-ordinate system maps the iris independent of its size, position and the relative pupil size. It is also independent of camera zoom and distance to the eye, and it compensates automatically for the stretching of the iris tissue as the pupil dilates.

The system then produces a code containing 256 bytes of unique information. The method allows searches through large databases for the recognition and identification of an iris pattern rather than merely a one-to-one comparison for verification.

One of the first commercial applications of Daugman's technology aims to identify ATM customers through a built-in "smart" camera developed by Sensar of the US for Oki, Japan's largest ATM manufacturer.

Manufacturing and user licences are also being negotiated in Germany, France and the UK. Iris recognition is now used routinely at BT's high-security Web hosting operation in Cardiff in the UK .

The Nationwide Building Society in the UK introduced iris recognition in its cash machines in lieu of personal identification numbers (PINs) in 1998. More than 1000 participants took part in the trial at the society's Swindon branch based on a system supplied by Sensar.

Tom Drury, president and CEO of Sensar, said: "Nationwide's customers have clearly validated iris identification as the most convenient, foolproof, easy-to-use form of personal electronic identification."

Pupil movement and associated elastic deformations provide a test against photographs and glass eyes, but the system does operate effectively with spectacles, contact lenses and even sunglasses.

However, banks are reluctant to use biometrics in customer-facing systems, such as ATMs, in the short term for fear of irritating genuine customers who might experience false rejections.

Fool proof identification

Richard Tyson-Davies of the Association of Payment Clearing Services said: "UK banks have put everything on hold for now. We do not expect to see biometric ATMs in operation for several years."

While iris-recognition technology is under trial in ATMs, retinal biometrics, although not application specific, is being aimed generally at access-control markets.

According to Belgium-based biometrics company EyeDentify, retinal identification is the newest and most accurate biometrics identification method that you can buy.

Paul de Grove, president and managing director at EyeDentify Europe, said: "Research has proved that the vein pattern on the retina is the most unique characteristic owned by man, including identical twins. This pattern is not determined genetically, but has a random development with each individual. It is one of the most stable characteristics in the life of a person. Only extreme wounds and weakening illness can alter the retina pattern."

Retinal scans involve a low-intensity infrared light that is projected through to the back of the eye and onto the retina. Infrared light is used, because the blood vessels on the retina absorb the infrared light faster than the surrounding eye tissue can. The light with the retinal pattern is reflected back to a video camera, which captures the pattern and converts it into data 35 bytes in size.

EyeDentify's newest product, the ICAM 2001, uses a camera with an electromechanical sensor that measures the natural reflective and absorption properties of the retina from less than 3 cm away.

The user focuses on a green dot generated from a small 7 mW bulb - enough to record the vein pattern with visible light and near-infrared at a wavelength of 890 nm. Further signal processing builds up the retina reference. The user can be recognized with absolute certainty out of 1500 others in less than 5 s.

Available in a standalone version, the ICAM 2001 uses 96 bytes for the reference of each enrolled person and it has a basic storage capacity of 3000 individuals and full-history transaction storage. According to the company, there are no inherent limits to the capacity of the system.

Although proven in effectiveness, the integration of biometrics identification systems in Europe is dependent on the cost of the technology reducing in line with other security technologies, such as smartcards.

The integration of ATMs with iris or retina recognition capabilities in Europe is increasing steadily. Dundee-based ATM manufacturer NCR has released two versions of its "smart" ATMs, Stella and Bud. Based on iris-recognition technology, the machines will dispense cash, cinema tickets and postage stamps and the firm intends to offer further applications, including on-line shopping and the payment of bills.

However, Chris Cherrington, senior analyst at F&S, says that ATM replacement in Europe is around 10 years per device.

"Since virtually all bank customers use more than one bank's ATM, PINs will remain the main authentication technology for at least a decade," said Cherrington. "Even with as much as 10% penetration of iris scanning technology in all new ATM machines by one bank, it would take about 50 years before iris scanning became the majority authentication technique."

F&S predicts that iris-scanning ATM facilities will remain a minor technology and it gives a 5% chance that it will be accepted at all by any European bank.

According to F&S, the market for ocular biometrics should grow, reflecting the growth in the high-security sector. Though there is no current mass-market application for this technology, it may enjoy success in the longer term as fingerprint recognition gains acceptance as the "norm", thus creating a secondary market for more "secure" biometrics.Cherrington said: "Retina-based ocular biometrics have not really captured any significant market, but iris scanning has proved itself to be viable and extremely accurate. However, the restraints on this market are user confidence and cost."

Biometrics technology still faces some stiff challenges. On the technical side, the hardware is costly, different systems are still incompatible with each other and the technology is still maturing. User acceptance is also key to further integration and development, particularly in the consumer arena. There are also fears about future developments, such as systems that can recognize and register unique characteristics without the individual's awareness and consent.

Yet as computers become part of the fabric of everyday life and more transactions - from signing contracts to filing tax returns - are carried out digitally, biometrics firms think that their products will soon be ubiquitous and indispensable.