biometrics iris scanning: a literature review

1 Biometrics: Iris Scanning – A Literature Review [www.oliviamoran.me] BIOMETRICS: IRIS SCANNING

A Literature Review

WWW.OLIVIAMORAN.ME

2 Biometrics: Iris Scanning – A Literature Review [www.oliviamoran.me]

Olivia Moran is a training specialist who specialises in E-Learning instructional design and is a certified Moodle expert. She has been working as a trainer and course developer for 3 years developing and delivery training courses for traditional classroom, blended learning and E-learning.

Biometrics, Iris Scanning: A Literature Review was written as part of a group collaboration with Barry Feehily and Eric Nichols.

AUTHOR ABOUT THE

WWW.OLIVIAMORAN.ME


Abstract The interest in Biometrics from both governments and industry has lead to the emergence of multiple Biometric technologies all with their own strengths and flaws. One currently at the forefront of Biometrics is iris scanning. The process involved in the identification and verification of people using iris scanning is examined in this paper. The advantages and disadvantages associated with the utilisation of such a technology are also explored. A number of legal and ethical issues are highlighted. Iris scanning is looked at in comparison to other forms of Biometric technologies. Future work in the area of Biometrics is also considered in light of current developments.

Introduction Over the past number of years, identity theft has evolved into a billion dollar industry. Pin numbers and passwords just do not cut it anymore. They are no match against shoulder surfing and card scanning. Developing new ways to protect information has become critical. Many have turned to Biometrics making it one of the more popular alternatives. Biometric testing means identifying a person on the basis of physiological and behavioural characteristics. According to Prabhakar et al (2003) it enables “automatic personal recognition based on physiological or behavioural characteristics”. The advances in technology in terms of processing power and cheaper memory have also fueled interest in this area. This article will examine Biometrics placing particular emphasis on remote iris scanning. It will take an in-depth look at how such technology functions. The advantages and disadvantages that are associated with it will also be highlighted. Ethical and legal considerations are addressed. A comparison of iris scanning is made with other kinds of Biometrics. Possible areas for future research and development are proposed.

How it Works With the current state of iris recognition technology, Kanda (2005) states “Up to 20 people can be recognised per minute if the scanning distance is within three metres and the subjects walking speed is less than one metre per second”. There are various algorithms for iris scanning. Plemmons et al (2004) describe eight different algorithms and write that they all share the same basic steps; obtain the iris image, extract the features and compare to a database for a match. Daugman (2004) algorithms are used in places such as British Telecom, US Sandia Labs, UK National Physical Lab, NBTC, Panasonic, LG, Oki, EyeTicket, IBM SchipholGroup, Joh.Enschede, IriScan, Iridian, and Sensar. He reports that while using his algorithms, “all testing organizations have reported a false match rate of 0 in their tests, some of which involved millions of iris pairing”. Daugmans’ algorithms in the context of the above three steps will now be examined.


Step one involves obtaining the image. This step can only be successfully performed when people being scanned look in the general direction of the scanner without blinking. Obtaining the iris image involves scanning the eye for the iris boundary, the pupil boundary, and the upper and lower eyelid boundaries, as shown in Figure 1. From these localisations the iris can be removed from the rest of the eye and encoded.

Figure 1: Obtaining the iris image (Daugman 2004, p.1) Step two entails extracting the necessary features (i.e. encoding). It is done by scanning over the entire iris “with many wavelet sizes, frequencies, and orientations, to extract 2,048 bits” Daugman (2004). Each discrete item of extracted data contains two bits. Therefore there are 1,024 different items of information encoded. This includes not only the iris, but also masking items such as eyelashes that fall over the iris. As such, each eye is encoded with only 256 bytes. Step three involves comparing the collected data to a database for a match. This comparison is done with a fractional Hamming Distance. Daugmans’ (2004) version of the Hamming Distance (HD) involves taking a scanned eye and applying an Exclusive OR to it and an item from the database. The masking bits from the scanned eye and the eye in the database are the ANDed. They are then ANDed with the items that were applied an Exclusive OR. The result is made positive and then is divided by positive ANDed masking bits to produce the Hamming distance, as shown in the following equation by Daugman in Figure 2:

Figure 2: Hamming Distance (Daugman 2004, p.4) When the HD is 0, then there is a perfect match between two irises. When the DH is 1, there is an absolute mismatch. There must be a target for the comparator to resolve whether a match has been made. Table 1 shows that a lower matching target results in less chance there will be a false match:

Table 1: HD target result to false match (Daugman 2004, p.7)


If a system were only concerned with false matches, then a target at or near zero for positive identification would be desired. However, if a subject’s iris is more or less dilated, or if the subject’s eye is slightly more closed or open, the mask will be different which will make the HD higher than zero – even for the same iris. As such, a target HD of less than 0.30 on a world-wide scale would be advised as this would ensure a positive match for the same iris while keeping the false matches at less than 1 in 13 billion.

Advantages of Iris Scanning There are a number of advantages associated with iris scanning. These include the following.

Uniqueness of the Iris The iris of each person has a unique nature. Unlike with DNA “An iris image is independent of an identical genetic makeup” Horst (2006). Take for example, identical twins that come from the same embryo. Both will share the same DNA, yet evidence from research into iris imaging show that “even irises of identical twins are different” Jain et al (2000). Some people even go as far as to claim that “The iris is the most personally distinct feature of the human body” Kirsch (2006). Red Herring (2006) report, “The odds of being misidentified by an iris scan, assuming both eyes are used, are less than a trillion to one”.

Robustness Iris scanning systems are more robust than other authentication methods such as face and voice recognition. These systems can find it hard to cope with changes in the environment or the person. For example, voice recognition may not work if the user is suffering from laryngitis or if there is excessive background noise. Irish scanning eliminates this problem.

Accuracy Accuracy is of crucial importance. People will not trust a system that gives wrong results. “An inaccurate system could falsely identify a traveler as a terrorist, or give a false sense of security while failing to identify a real terrorist” (Bryant 2001). Recently in a report entitled National Institute of Justice Research Report on Entry-Control Technologies, it has been claimed, “iris pattern scanners are considered the most accurate of all Biometrics” (Jarvis 2006). The accuracy of iris scans is higher than that of its contemporaries.

Ease of Use Remote iris scanning systems are relatively simple to use. While the user has to undergo enrolment it is short and easy to complete. The acquisition of the iris image does not involve any intrusive procedure. The user is not really required to interact with the system. The characteristics of the iris are captured by simply glancing into a digital camera for a fraction of a second. Ease of use is extremely important when it comes to gaining acceptance. If people feel that controls are too annoying or time consuming they will simple override them. It is this ease of use that has proven a huge success in US airports for both access control as well as passenger ticketing. It has also been successful in use for ticketing at sporting events.


Security Remote iris scanning is more secure than other methods of identification such as pins and passwords. These can be guessed and there exists the danger that someone could ‘shoulder surf’ you while you type it in. These identification methods also run the risk of been stolen should they be written down and fall into the wrong hands. Fooling an iris scanning system is almost impossible as it is “extremely difficult to surgically tamper iris texture information and it is easy to detect artificial irises” Jain et al (2000). No other biometric technology can rival the combined attributes of mathematical certainty.

Speed Iris recognition is widely accepted as the fastest form of biometric testing and is suitable for use where a large number of people are involved. Iris Scanning has been successfully deployed at seventeen air, land and seaports in the United Arab Emirates (UAE). Border officials have scanned the irises of 900,000 people whose visas have expired or who have been asked to leave the country. Using those scans to screen arrivals has uncovered 650,000 illegal aliens trying to re-enter the UAE using false passports. At Amsterdam Schiphol Airport, frequent travelers have been using iris scans to speed up entry and immigration checks since 2001. There is no question that iris scanning is the best choice where huge volumes of people need to be processed quickly.

Disadvantage of Iris Scanning There are multiple weaknesses associated with iris scanning which need to be improved upon in the future. These include the following.

Costs One of the main reasons for slow adoption of Iris Scanning is the high cost currently associated with the installation and maintenance of such technology. It is expected however, as the industry matures and use of iris scanning becomes more wide spread, that costs will be reduced significantly. As outlined by Torbet et al (1995), “Many biometric devices could be integrated with the existing system, with the exception of the input sensor. This will reduce the cost and make wide-scale adoption more likely”.

Acceptability Users generally don’t like the unfamiliar. People are slow to adopt new technologies especially when they see them as interfering with their privacy and confidentially. In order for iris scanning to be acceptable its operation must be perceived by its potential users to be “at least as well, or better, than any currently available alternative” Torbet et al (1995).

Fraudulent Use Although the risk is relatively low the data collected during the iris scans could be used for fraud. “Such fraud can occur at the enrolment stage as well as well as the verification stage” (Bennett 2000). During the enrolment phase someone may be able to set up a false template. Fraud can also take place during the verification or identification stage. When the system scans the users iris


the resulting data must be compared against the relevant template. This template is usually stored in a central database. Therefore, data must be transmitted at this point. If this transmission is not secure it is possible for others to intercept the information. They can then use it for whatever purpose they wish.

Security No system is one hundred percent accurate and that includes Biometrics. Although iris scanning reduces the risks, there is always room for error. From the research conducted it is highlighted that there is a False Rejection Rate, where the system rejects the right person and the False Acceptance Rate, where the wrong person is accepted. The levels of these errors however are deemed to be well under the acceptable level.

Industry Standards As outlined by Emory (2002) “The development and acceptance of a primary standard is critical for the growth and applicability of the biometrics industry”. While industry standards do exist, they do leave room for improvement and are few and far between. The bigger more powerful companies such as Microsoft refuse to conform in order to build a better product and they create their own set of standards. The adoption of global standards would limit and minimise the abuse of data collected. However, the adoption of standards is voluntary and not legally binding.

Legal Considerations The rapid progression of the use of Biometrics and Iris Scanning has raised concerns from a legal point of view, especially the legislation concerning privacy and the protection of data. From this article it is clear that all Biometrics involves working with and processing data. As a result Biometrics must comply with legal requirements that are currently in place. Take for example ‘The Data Protection Act (1998)’ in Ireland. According to this act personal data should be collected for a specific purpose and should be adequate, relevant and not excessive for the purpose for which it is collected and processed. In addition it must be accurate and up to date. Appropriate security measures must be in place to protect it. If a company is found to be in breech of the requirements of this act they can be prosecuted.

Ethical Considerations

Disabled Users Advocates of iris scanning market it as being the only system needed for authentication. This is fine for most but what about the small group of people who do not have an iris? Obviously these people cannot undergo iris scans. The exclusion of users with disabilities is not ethical nor is it legal. We claim to be an inclusive modern society and yet little consideration is given to this group. Using a mulitmodal system could overcome this limitation. Users could carry a smart card, which would contain information about their lack of iris. The system could then permit an override for this individual. Authentication could be done by some other means such as


fingerprint or facial recognition. Such a multimodal system “offers higher and more consistent performance levels” (Bennett 2000).

Privacy Concerns One of the major concerns associated with the use of any Biometric system is privacy. There is a threat to privacy and civil liberties because of potential for a wide range of people to cross-reference information. People wish to keep their confidential information exactly that, confidential. If we give all our information to a bank what is stopping them from selling this information to a third party such as a marketing agency. Even worse what could the “Potential impact that government might use of these technologies might have on personal freedom ... The government could use some unforeseen technological advances to compile biometric records for the real-time tracking of individuals” Wayman (2000). Currently such technologies are utilised in many countries to find and track criminals. This could however be extended to cover the wider law abiding population. Up until now fingerprinting has been collected mainly for the use of law enforcement e.g. criminals and this is a very sensitive issue for many people. However, it must be acknowledged that iris scanning reduces the quantity of personal information that needs to be created and stored.

Iris Scanning Versus Other Forms of Biometric Testing Retina recognition relies on the retina’s blood vessel pattern. Unlike iris scanning, this technology is personally invasive and requires skilled operators and time. Facial recognition examines characteristics such as eyes, nose and mouth positioning taking into account the distances between them. To date attempts to get computers to recognise faces have had only limited success. The challenge here is producing hardware that will map the features of the face reliably and accurately. Voice Recognition based on vocal characteristics is not intrusive, however, it is sensitive to background noise and vulnerable to attack. Today the fingerprinting is probably the most common form of Biometric technology used. This involves matching minute features such as ridge and endings. While it is a widely accepted form of Biometric testing it also has its drawbacks. The success of this process is highly sensitive to image quality. Failure of this system can result from dirt and scars on the fingers along with poor finger positioning. According to Matsumoto (2002) “Biometric samples or even templates may be constructed, for instance artificial fingers may be used by attackers”. As a result it is quite evident Iris Scanning offers advantages over alternative biometric techniques.


Future Work While iris scanning has been successful in providing a false match rate of zero, it has a weakness that must be addressed. The system needs direct visual contact with every subjects’ iris for it to operate. A person turning his or her head while talking to another could be a common occurrence in a system that scans many people at once. People could also take advantage of this weakness. An example is a locked door that needs iris identification in order for it to unlock. A person with authority to pass could unlock the door with an iris scan. Before the door re-locks, people without authority to pass through the door could close their eyes and also pass through before the door is re-locked. The system would not be aware that an unauthorised person had breeched the security. An additional security system such as a guard at the scanner would therefore be required. This is a problem inherent in iris scanning. In order to implement a better system technology would have to be utilised that could allow for the remote identification of individuals. Such a system would not depend upon actions from those individuals. Brainwave biometrics would provide this solution. Lawson (2002) notes that people “cannot alter what is referred to as their baseline brainwave pattern”. Every person’s baseline brainwave pattern is unique. From birth until death people broadcast unchanging and unique waves from their brain. Technology that could receive and decode these waves would provide a foolproof means of personal identification. Future work in this area is needed from various fields. For instance, hardware would be needed that is capable of receiving baseline brainwaves. The issue of storing individual’s brainwaves on databases will need to be addressed. Algorithms would have to be developed to convert these waves into a binary format. A way to compare the brainwaves so that a match can be immediately found will also need to be implemented. There is plenty of future work to be done in this area. Once such work is completed the best possible system of personal identification will have been available for use.

Conclusion In this document the area of Biometrics was critically examined focusing on iris scanning. The way in which the entire iris scanning process works was illustrated. The benefits and shortcomings of this particularly technology were addressed as well as the legal and ethical problems arising from the use of such technology. Iris scanning was considered in relation to other technologies and comparisons were made. Lastly, areas for future research and development were put forward. Two important issues globally affecting the world today are identification and authentication of an individual. Identification says who you are and authentication specifies that you are who you say you are. From the research conducted it is quite evident that the use of Biometrics and iris scanning for the above purpose is fast gaining worldwide recognition.


It is clear to see that Iris Scanning is a highly accurate and speedy form of Biometric Testing and is suitable for use in many different situations especially where speed is essential e.g. airports. However, the one major drawback at this time is its high implementation costs. With the development of a more cost-effective system, it is anticipated that iris scanning will be used more wide spread and it will gain a higher level of recognition in the future. Biometric Technology also raises privacy-related concerns. Biometric systems must comply with the principles of data protection legislation, since they create and process data, however, as Biometric Technology is been widely implemented across the world, it is anticipated that countries will update their laws to facilitate surveillance of this new technology. Overall, especially after the tragic events of the attacks of the 11th of September 2001 and the current fight against terrorism, it is likely that Biometrics and iris scanning will increasingly become part of everyone’s life but like all other data collection and processing systems, it must be handled with care. It will only be useful if the processes surrounding it are safe and secure.

biometrics iris scanning: a literature review

Education