Biometrics In Physical Access Control
Issues, Status and Trends
Bill Spence
Recognition Systems, Inc.
Biometrics identify people by a unique human characteristic. The size and shape of a
hand, a fingerprint, the voice and several aspects of the eye are just some unique
attributes. No longer are these devices found only in James Bond movies and Star Trek
reruns. They are used on the front door of thousands of businesses around the world.
Modern biometrics actually got their start in access control applications as far back as the
mid 1970s. The early installations were typically very high security in nature, due
primarily to the high cost of biometric devices. In recent years, the advent of inexpensive
microprocessors and advanced imaging electronics have dramatically reduced the cost
and increased the accuracy of biometric devices. These changes have allowed biometrics
to become more and more a part of the commercial access control landscape. Today,
thousands of businesses use biometrics for all or part of their access control needs.
Biometrics are not just for nuclear power plants any more!
This paper will examine how biometrics are integrated into access control applications
and the key issues to be considered when using a biometric device. We will also
summarize the devices currently available on the commercial market and take a brief look
at what the future may hold for the industry.
The Benefits of Biometrics in Access Control
The goal of any access control system is to let authorized people into specific places.
Only with the use of a biometric device can this goal be achieved. A card-based access
system can control the access of authorized pieces of plastic, but not who is in possession
of the card. Systems using PINs (personal identification numbers) require that an
individual only know a specific number to gain entry. Who actually enters the code can
not be determined. Biometric devices verify who a person is by what they are, whether it
be their hand, eye, fingerprint or voice.
Biometrics also can eliminate the need for cards. While dramatic price reductions have
lowered the initial cost of the cards in recent years, the true benefit of eliminating them is
realized through a reduced administrative effort. A lost card must be replaced and
reissued by someone. There is a cost associated with the time spent to complete the task.
Eyes and hands are seldom lost, stolen or forgotten. They also don’t wear out and need to
be replaced.
Integration
The primary function of any biometric device is to verify the identify of an individual.
Access control requires the ability to not only identify the person, but unlock a door,
grant or deny access based on time restrictions, and monitor door alarms. There are
several ways biometrics can accomplish this task.
Standalone Systems
Many biometrics are available in this type of configuration. These devices are not only a
biometric, but also a complete door controller for a single door. Users are enrolled at the
unit and their biometric template is stored locally for subsequent comparison. The actual
comparison is accomplished within the unit and a lock output is energized depending on
the outcome. Input points are available to monitor the door switch for “door open too
long” and “door forced open” conditions. Outputs are provided to signal a bell or alarm
panel if an alarm condition is detected by the system. An audit trail, if required, is
available by connecting a printer to the unit. Time restrictions are programmed through
the integrated keypad for individual users. The number of users is limited by the
available memory and varies from manufacturer to manufacturer.
Example of a Standalone Configuration
Networked Systems
Many access control applications have a need to control more than one door. While
multiple standalone units could be employed, a network of biometric readers is more
common. By networking the systems together and then to a computer, several advantages
are available to users. The most obvious is centralized monitoring of the system. Alarm
conditions and activity for all the doors in the system are reported back to the PC. All
transactions are stored on the computer’s disk drive and can be recalled for a variety of
user customized reports. Networked systems also provide for template management.
This process allows a user to enroll at a single location and have their template available
at other locations. Deletion of a user or changes in their access profile need only be
entered at the PC. Some biometric systems such as the one offered by Voice Strategies
store all information in the PC and template comparison is also performed there. Others
distribute template information to the individual readers at each door. Either way, the net
effect of template management is the same. The connection between units is typically
accomplished via RS485 or over a modem connection. In the case of voice systems,
telephone lines are used.
Example of a Network Configuration
Third Party System Integration
Biometric manufacturers offer a variety of different methods to integrate into
conventional access control systems. The most common way is referred to as “card
reader emulation”. In this mode, the biometric device essentially works with the access
control panel in the same way a card reader does. The “card reader output port “ of the
biometric is connected to the panel’s card reader port. This method is very effective
when integrating into existing card based systems. The wiring is identical to the card
reader’s wiring. When a person uses the biometric, it outputs the ID number of the
individual if and only if they are verified. The format of the output is consistent with the
card technology used by the access control panel. Once an ID number reaches the panel, it
is handled as if it came from a card reader. The determination of granting access is made
by the panel. Door control and monitoring is all handled by the access control panel, not
the biometric. As an alternative to a keypad, some biometrics have card reader input
capability. At the biometric, the user swipes their card which contains their ID number.
If verified, that card number is sent up to the panel for a decision. Various card
technologies are supported by biometric manufacturers and include smart cards, Wiegand
formats, magnetic stripe and bar code. The most two commonly available formats are 26
bit Weigand with an 8 bit facility code and ANSI Track 2 for magnetic stripe. Proximity
cards can also be used as an input since they usually have the ability to output in a
Weigand format.
In all card reader emulation systems, template management is not handled by the access
control panel. If there are multiple biometric units in the system, this can be an issue to
consider depending on the size of the biometric user population. The larger the number
of templates to manage, the larger the issue. In some biometrics, it is possible to link the
biometric units together and let them handle the template management. This network is
separate from the access control system, but does allow users to enroll at a single location
and have their template information distributed to other readers.
A few access control manufacturers have fully integrated biometrics into their access
control systems. The ID3D HandKey from Recognition Systems for example is
integrated with Monitor Dynamics Inc., Sensormatic/Software House and Westinghouse.
In this type of integration, the access control software handles the template management
and communications to the biometric units.
Example of a Third Party System Integration
Issues to Consider
Acceptance
The most critical factor in the success of a biometric system is user acceptance of the
biometric device. There are several factors which have an impact on acceptance. First,
the device must cause no discomfort or concern for the user. This may be a subjective
issue, but it is important to fully explain any concerns users may have. If people are
afraid to use the device, they most likely will not use it properly and that may result in
them not being granted access. Second, the biometric must be easy to use. People like
things that are simple and intuitive. How many times have you been frustrated at a card
reader that gives no indication of which way to swipe the card? Third, the biometric must
work correctly. If a biometric is working properly, it does two things. It keeps bad guys
out and lets good guys in. Yet, no device is perfect and biometrics are no exception. The
two errors a biometric can make are letting the bad guy in and keeping GOOD guys out.
The probability of one of these errors happening is characterized by the False Accept and
False Reject error rates.
False Accept Rates
The probability of allowing an unauthorized user pass for someone else is known as the
False Accept Rate. This error rate must be low enough to present a real deterrent for a
given application. False Accept Rates claimed in today’s biometric access systems range
from .0001% to 0.1%. It is important to keep in mind that the only way a false accept can
occur is if someone tries. Therefore, the False Accept Rate should be multiplied only by
the number of unauthorized attempts in order to determine the number of possible
occurrences. To give some perspective to these numbers, the biometric used on the front
entry area of 60 percent of U.S. nuclear power plants has a False Accept Rate of 0.1%.
False Reject Rates
False Accept Rates are certainly important in security applications. But, the False Reject
Rate, which affects the good guys, is just as critical. The False Reject Rate or Insult Rate
is the probability that the biometric does not recognize an authorized user and therefore
denies them access. One can see the importance of a low False Reject Rate if you
consider that an access control point that does not allow bad or good guys in, is
commonly known as a wall. The False Reject Rates quoted for currently available
systems vary from .00066% to 1.0%. A low False Reject Rate is so important because
this type of error can occur with almost every use of the device. How many times will
authorized people attempt to gain access in a given day? To illustrate this point, an
example may be helpful. A company with 100 employees has a biometric device on the
front door. On average, the front door is used by each employee four times per day. This
would yield 400 transactions per day by the good guys. A False Reject Rate of 1.0%
would predict that each day, four good guys (one percent of 400) would be denied access.
Over the course of a five day week, that’s 20 problems for the good guys. Reducing the
False Reject Rate to 0.1% would result in only two problems for that same one week
period. What is considered an acceptable level of false accepts and false rejects depends
on the application. Understanding the impact to your application of these error rates can
mean the difference between success and failure.
A low False Reject Rate will also have a significant impact on user acceptance. If
someone is authorized to enter and the biometric recognizes them, then the system
works. People like things that work. If the biometric mistakenly doesn’t allow them
access, frustration will set in quickly and the biometric may never be accepted.
Equal Error Rates
In a biometric device, the False Accept and False Reject Rate can be affected by
increasing or decreasing the sensitivity of the device. The two rates are inversely
proportional and can be likened to a car alarm. When your car alarm is very sensitive, the
probability of the bad guys stealing your car ( a false accept) is very low. Yet the chances
of you accidentally setting off the alarm (a false reject) are higher. Reduce the sensitivity
and the number of false alarms will go down, but then you increase the chances of
someone being able to steal it. How much each error rate is affected by altering the
sensitivity is a characteristic of each manufacturer’s device. A device may offer an
extremely low False Accept Rate at a given sensitivity, but the corresponding False
Reject Rate may be totally unacceptable. The balance of the two error rates for a given
application is critical to the success of a biometric installation. Error curves such as the
ones below give a graphical representation of the biometric device’s personality, so to
speak. The point at which the false accept and the false reject curves intersect is called
the Equal Error Rate. This is the point where the two error rates equal one another. The
corresponding sensitivity setting for the Equal Error Rate is found on the lower axis. The
Equal Error Rate can be a good indication of the biometric’s all around performance. The
smaller the Equal Error Rate, the better.
% Error Rate
5.00%
4.00%
3.00%
2.00%
1.00%
Decreasing
Sensitivity
False Reject
200
190
180
170
160
150
140
130
120
110
100
90
80
70
60
50
40
0.00%
Increasing
False Accept
Example of Error Rate Graphs
Validity of test data
In general, testing biometrics is a difficult task because of the extremely low error rates
involved. In order to attain any statistical confidence in the results, thousands of
transactions must be recorded. Some quoted error rates are the result of theoretical
calculations. Others are obtained by actual field testing of the devices. Field test data is
usually more desirable since it is a real world test of the device. In the case of False
Reject data, only field test results can be considered accurate. This is due to the fact that
biometric devices require human interaction and rely on human characteristics for
verification. If the device is difficult for a person to use, false rejects will tend to go up.
If the attribute used for verification varies for some reason, a false reject could also occur.
None of these conditions can be accurately quantified and included in a theoretical
calculation. On the other hand, False Accept Rates can be reasonably calculated for some
biometrics by performing cross comparisons of templates in large template databases.
Currently, most field test error rate data for biometric devices has been generated by end
users and the various biometric manufacturers. There have been several tests completed
by independent laboratories, namely Sandia National Labs of the U.S. Department of
Energy. The last test released from Sandia was performed in 1991. In any case, it is
important to remember that error rates are statistical in nature. They are derived from a
series of transactions that were created by a population of users. In general, the larger the
population and the greater the number of transactions studied, the greater the confidence
level in the accuracy of the results. If the error rate is reported at 1 in a 100,000 and only
100 transactions were included in the study, the confidence level in the result would be
very low. If the same error rate was reported and 1 million transactions were used, the
confidence level would be much higher. The magnitude of the reported results will have
an effect on the size of the sample needed for a reasonable confidence level. If the
reported error rate is one in ten, then a sample of 100 transactions may provide a
sufficient confidence level. Conversely, 100 transactions would be too small a sample if
the error rate was reported as 1 in 100,000.
Throughput
A logistical issue that should be considered carefully when using a biometric is the
throughput. Throughput is the total time that it takes for a person to use the device. It is
difficult for manufacturers to specify a throughput since it is application dependent. Most
manufacturers specify the verification time for the reader, but that is only part of the
equation. When a person uses a biometric reader, they typically enter an ID number on
an integral keypad. The reader prompts them to position their hand, finger or eye where
the device can scan physical details. The elapsed time from presentation to identity
verification is the "verification time." Most biometric readers verify ID in less than two
seconds. Those considering the use of biometrics for access control must look beyond the
verification time and consider the total time it takes a person to use the reader. This
includes the time it takes to enter the ID number, if required, and the time necessary to be
in position to be scanned. If ID numbers must be entered, they should be kept as short as
possible. If a long ID number must be used, some biometrics can obtain the number by
reading a card, which contains the ID number in the card code. One must weigh faster
throughput gained by using cards against the card administration costs. The total time
required for a person to use the reader will vary between biometric devices depending on
their ease of use and verification time. A card-based access system may appear faster.
However, as one hand geometry user points out, "The speed difference between a card
and the hand reader is about two seconds, but you make up for it (the difference) since
your hand is right in front of you, verses fumbling around looking for your card."
The Technologies Currently Available
A wide variety of human characteristics are used by biometric devices to confirm a
person’s identity. The industry is constantly finding new attributes and ways to measure
their uniqueness. Some of these systems are still in the development stage and are not
currently available in a form that can be readily used in access control systems. These
emerging technologies will be discussed later. Here, we will review the biometric
devices that are commercially available today. Unless noted, all of the information has
been provided by the individual manufacturer. A contact name and phone number for
each of the manufacturers is supplied at the end of this paper.
The Eye
Two companies currently produce systems utilizing different aspects of the eye for
identification, EyeDentify and Iriscan. The EyeDentify system looks at the vascular
pattern on the retina of the eye. Iriscan, as the name implies, relies on the iris (the colored
part of your eye) for identification. Both technologies do not require the entry of an ID
number when using the system.
EyeDentify
EyeDentify’s first product offering was released in 1982. The technology was further
refined and a second generation system came to market in 1989. Continued
advancements and cost reductions have resulted in the current product.
Product:
List Price:
False Reject Rate:
False Accept Rate
Equal Error Rate:
Verification Time:
Standalone:
Network:
Card Reader Emulation:
Icam 2001
$2650
0.4%
0.001%
Not Supplied
1.5 to 4 seconds (varies depending on number of users)
Yes
Yes
Yes
Iriscan
In 1994, Iriscan brought their technology to the commercial market. The image of the iris
is captured with a standard video CCD, similar to those found in a video camera.
Product:
List Price:
False Reject Rate:
False Accept Rate
Equal Error Rate:
Verification Time:
Standalone:
Network:
Card Reader Emulation:
System 2000EAC
$5950
0. 00066%
0. 00078%
0. 00076%
2 seconds (10,000 users)
Yes
Yes
Yes
Fingerprint
Law enforcement agencies have used fingerprints for decades to identify individuals.
Efforts to automate the process were started in the late 1960s by the U.S. Federal Bureau
of Investigation (FBI). Currently, there are several manufacturers which have systems on
the market designed specifically for access control applications.
Identix/Bio Recognition Systems
Identix first introduced a fingerprint system for access control in 1988. In 1994, they
formed a relationship with Bio Recognition Systems (BRS). BRS integrates the Identix
fingerprint capture unit and the associated algorithms for template creation into their
access control terminal. Identix recently purchased BRS
Product:
List Price:
False Reject Rate:
False Accept Rate
Equal Error Rate:
Verification Time:
Standalone:
Network:
Card Reader Emulation:
TouchLockII
$2950
<1.0%
0.0001%
Not Supplied
0.5 seconds
Yes
Yes
Yes
Mytec
Mytec utilizes optical computing techniques to process the fingerprint image. This
methodology allows for large amounts of data to be processed very quickly. The unit is
just coming to market and error rate studies are in process.
Product:
List Price:
False Reject Rate:
False Accept Rate
Verification Time:
Standalone:
Network:
Card Reader Emulation:
Mytec Optical Fingerprint Comparator
TBD
Error rate studies in process
<0.1 seconds
Yes
Yes
Yes
Startek
This Taiwanese company first brought a system to market in 1993. The information
provided here is from reference sources. Startek did not respond to the request for
information on their system.
Product:
List Price:
False Reject Rate:
False Accept Rate
Equal Error Rate:
Verification Time:
Standalone:
Network:
Card Reader Emulation:
FIC-2000I
$5500 for a four door system
1.0%
0.0001%
Not supplied
<1 second
Yes
Yes
?
Hand
The size and shape of the hand and fingers is used by a hand geometry system to verify a
person’s identity. Hand geometry was the technology used for the very first commercially
available biometric device, the Identimat, which came to market in 1976. Today, two
companies offer hand geometry systems, Recognition Systems, Inc. and BioMet Partners.
BioMet Partners
The Digi-2 was introduced in 1994 and verifies an individual by looking at the size and
shape of two fingers. BioMet Partners provides an OEM module that consists of an
optical assembly and the associated template creation algorithms. The module is then
integrated by other companies into an access control reader configuration. The following
information was obtained through reference sources.
Product:
List Price:
False Reject Rate:
False Accept Rate
Equal Error Rate:
Verification Time:
Standalone:
Network:
Card Reader Emulation:
Digi-2
Not Supplied
0.1%
0.1%
0.1%
1 second
Yes
Yes
Yes
Recognition Systems, Inc.
After introducing their first system in 1986, Recognition Systems has refined and reduced
the cost of the technology. They currently offer their third generation product, the ID3D
HandKey, which was released in 1991. The system evaluates a three dimensional image
of the four fingers and part of the hand to verify a person. To date, the ID3D is the most
widely used biometric device for access control applications.
Product:
List Price:
False Reject Rate:
False Accept Rate
Equal Error Rate:
Verification Time:
Standalone:
Network:
Card Reader Emulation:
ID3D HandKey
$2150
0.1%
0.1%
0.1%
1 second
Yes
Yes
Yes
Voice
Voice verification utilizes characteristics of the voice, including bass and treble tones,
vibration in the larynx, and throat and nasal tones. Several companies have introduced
voice systems over the years, but only one, Voice Strategies, is actively marketing a
system.
Voice Strategies
First introduced in 1991, the Voice Strategies system uses technology developed by Texas
Instruments. Telephones located at the access points are linked to a central computer
where the verification process takes place.
Product:
List Price:
False Reject Rate:
False Accept Rate
Equal Error Rate:
Verification Time:
Standalone:
Network:
Card Reader Emulation:
VACS (Voice Access Control System)
$21,000 for a 16 door system
Error rates were not supplied
1.5 seconds
No
Yes
No
The Future
Lower Costs
The one thing that can be said with certainty about the future of the biometrics industry is
that it is growing! Biometrics are finding their way into all kinds of applications beyond
access control. Time and attendance, border crossings, day care centers, welfare
disbursement and point of sale are just a few of the applications where biometrics are
currently utilized. The use of smart cards is growing and so is the amount of information
they can store. The more data stored, the greater potential for privacy and security issues.
Biometrics are an obvious solution to these issues. As the number of uses increases so do
the volumes at which the devices are produced. This will ultimately reduce the cost of
systems. In addition, the seemingly endless reduction in the cost of computing power will
also contribute to lower costs.
Increased Accuracy
Biometrics got their start in very high security applications. The primary design criteria
of those systems was to keep the bad guys out, with little attention paid to letting the good
guys in. For those applications, a low False Accept Rate was the most important
specification. As biometrics move into more commercial/public applications, the False
Reject Rate becomes more critical. Barclay’s Bank made this clear by suggesting that a
biometric suitable for credit card verification would have a False Reject Rate of one in
100,000 and a False Accept Rate of 5%. Certainly the False Accept Rates required by the
commercial access control market are more stringent, but the need for low False Reject
Rate is clear. Low False Reject Rates, delivered in systems that are intuitive to use, are a
necessity for widespread use of biometrics in this market. In recent years, biometric
manufacturers have put tremendous energy into this area of development and will
continue to do so. One additional necessity for increasing accuracy is the need for more
rigorous testing of biometric devices. As the error rates grow smaller, the size of the test
will need be larger.
New Technologies
The market for biometric devices is not the only part of the industry that is growing. The
number of technologies and manufacturers is also expanding. Some of the new
technologies look at new unique attributes while others improve on ways to look at
characteristics currently being used by today’s biometric systems.
One new attribute that has received a fair amount of attention is facial recognition.
People easily identify other people by looking at their face, but automating the task is by
no means simple. Most of the work in this area has been dedicated to capturing the image
of the face through a video camera or picture. One company has taken a different
approach and looks at the thermal pattern created by the blood vessel structure of a
person’s face. Another company relying on the circulatory system examines the pattern
of veins and arteries on the back side of your hand. Several companies are developing
systems that use the other side of a hand and identify individuals by their palm print.
There is also work being done on an electronic nose. A blood hound can tell two people
apart by their scent, why not a biometric!
Some new technologies are being applied to human attributes that are already being used
by commercial biometric system. For example, a new sensor is being developed for
fingerprint image capture that utilizes ultrasonics to acquire the picture. This approach
could minimize the impact of dirt and debris which can cause problems with traditional
optical methodologies. Holograms are being employed to store fingerprint images
allowing for compact storage media and fast “optical comparisons”.
While all of these technologies hold promise, their usefulness will be determined by their
ability to provide a solution at a price/performance ratio that fits the needs of the market.
Only time will tell.
Summary
As the use of biometrics grows, the need to understand the issues related to them becomes
more critical. User acceptance will always be central to successfully utilizing a biometric.
Unfortunately, there is no way that a biometric manufacturer can specify a device’s user
acceptance. Different classes of applications demand different biometric performance in
order to achieve high user acceptance. The key quantifiable performance factors of a
biometric are it’s various error rates. Therefore, understanding what these different error
rates mean and how they can impact acceptance is extremely important.
Certainly, the future is bright for the biometric industry and their place in access control
applications. The goal of access control is to control where people can and cannot go.
Only a biometric device truly provides this capability to the end user. This technology is
no longer science fiction. It has been used successfully for years by large and small
companies alike. There are biometric systems available today which can economically
meet the needs of almost any commercial access control application. And, as costs come
down, justifying the use of a biometric will become a reality for more and more people.