Unlike fingerprints, the iris' characteristics don't vary based on environmental conditions, with the notable exception of the pupil's reaction to light. So iris-recognition algorithms adjust for pupil size, as well as for the position of the eyelid. They work even if the user has contact lenses or glasses. To detect fraud, algorithms check for the presence of a pattern on the sphere of the eye instead of on an internal plane, and use measurements at different wavelengths to detect a living eye.

Confidence levels for iris-recognition systems are extremely high relative to other biometrics. While facial-scanning systems may have difficulty distinguishing people with matching facial structure, even identical twins don't have the same iris patterns. This makes iris recognition ideal for identification of an individual from a large database. Most other systems perform only one-to-one matches, or at best one-to-few, because a minor increase in FARs can produce matching errors as the database size increases, as noted previously.

While the per-device costs are expected to drop sharply, iris recognition will never be as inexpensive as the cheapest voice-, face- or fingerprint-recognition options. For one, low-cost cameras don't offer enough resolution, and the iris-recognition camera can't be used for general-purpose applications. For another, IriScan's exclusive iris-recognition patents will prevent competition from driving down prices.

Loops, Whorls and Arches Fingerprint recognition offers a high user-acceptance rate, low per-device cost, a large selection of products and maturing application interfaces. It also enjoys a longer application history than most techniques, with many years of use for physical access control, criminal law enforcement and entitlement programs.

When the FBI adopted AFIS (Automated Fingerprint Identification System), it transformed criminal fingerprint-recognition systems from a haphazard manual approach to an automated system that could make sense of thousands of fingerprints. Yet vendors bringing products to the enterprise are quick to distance themselves from AFIS because of its "criminal" overtones, very high cost, storage of actual fingerprint images and its need for expert operators.

AFIS' strict technical requirements--at a minimum of 500-dpi resolution per scan--also are well-beyond the needs of most customers. AFIS-capable systems require careful tuning and operation, are bulky and tend to be expensive. Cogent Systems, a major supplier of systems used in AFIS, doesn't expect that these high-quality readers will be available for less than $600 any time soon.

The devices themselves are typically based on optics: a prism and multiple lenses with an internal light source. They capitalize on the different indices of refraction for the lens versus the air, thus able to distinguish ridges on a finger. Yet optical techniques alone may not suffice to identify a fake or lifted finger, as our tests discovered. They also may have problems with dry, wet or dirty hands.

Other alternatives measure the electrical field of the finger. Manufacturers such as SGS-Thomson and Harris Semiconductor have built sensors for reseller use that are essentially large silicon chips; in fact, the chips are some of the largest ever built. These systems have not yet been proven to withstand all environmental conditions found in the field, especially static discharge, nor is it clear if inexpensive chips can be built with a large enough surface area to accurately read all populations.

Who? Vision Systems takes another approach, using a custom light-emitting polymer that it claims will eventually be available for less than $10 per unit to manufacturers. At the opposite end of the spectrum, Ultra-Scan Corp. uses ultrasound measurements to read fingerprint attributes, which have been demonstrated to work right through the thin latex gloves used in hospitals.

Gimme a Hand Here Hand geometry systems are being adopted in physical access control and time/attendance applications. Reader costs are moderately expensive (several thousand dollars each), and they tend to be large devices, making them less appropriate for computer access control applications. Mass-production techniques are expected to bring down prices, but never to the level of the alternatives discussed here.

It's difficult to create a fake hand with the right physical characteristics to get past a hand reader, and the FRR for these devices is low. Measurements aren't affected by dirt, moisture, temperature or ethnicity, and can be determined through thin gloves.

Hand geometry readers are based on optical technologies and don't use X-ray imaging for verification. The data from a hand can be compacted into a surprisingly small template. According to Recognition Systems, a hand template can be reduced to 9 bytes of data, and the comparison algorithm fits in 200 bytes of 8-bit processor code.

Face Up To It Facial recognition offers the least-intrusive approach to authentication. In fact, users may even be unaware that they're being identified--making for some interesting applications. For example, the Visionics FaceIt NT system can continually monitor the front of the computer for the presence of valid users, unlock the system when they sit down, then immediately re-lock the system again when they stand up.

The cost of facial recognition can be less than fingerprint recognition, but not as low as voice recognition. The lowest cost systems rely on off-the-shelf, multipurpose video capture boards and camera hardware, available for $100 to $200, with per-seat software running less than $100.

Facial systems can't tell some people apart, particularly identical twins, limiting their use to relatively small populations. It's a bad fit for general-public kiosks, but it's a good match for most office environments.

Like face-recognition systems, voice-recognition systems rely on common hardware components. All you need is a simple microphone. Some systems can use the telephone for authentication, reducing incremental hardware costs to nothing. They also use shared verification servers on the back end, reducing per-user costs even further.

Voice recognition best fits applications where users will tolerate a lengthier enrollment process, as the system and user adapt to each other. It also fits environments where the cost of fraud is not excessively high.

Sign (In) on the Dotted Line Signature-recognition systems have undergone more than 20 years of research in academic circles, and automated systems are available for under $200. Because a signature is the most critical element used for nonrepudiation of paper documents, it naturally fits electronic document-management systems. It enjoys a widely used API. But as a generalized authentication mechanism, it's awkward and too intrusive.

Undeniably, biometrics authentication methods can serve customized vertical applications very well, with finger and face recognition moving into wider use as general authentication mechanisms. In addition to the methods discussed here, several vendors are promoting a layered approach, using hybrids of multiple biometric technologies, or biometrics in combination with tokens, smartcards and passwords.

David Willis can be reached at dwillis@nwc.com.