Search

For wide acceptance of biometrics, standards for interfaces and methods for performance evaluation are needed. Unfortunately, at the hardware level, the devices for biometrics still remain non-inter-operable except when sharing a common existing standard such as NTSC video. However, at the next level several standards are in the process of being developed and promoted. For instance, the Bio API [11,215] is a standard for the application programming interface allowing the decoupling of biometrics-technologies from the applications that use them. In terms of standardized evaluation, NIST is playing an important role in designing several fingerprint databases [222–226] and conducting speaker verification tests. Similarly, the US Department of Defense runs the FERET and FRVT face recognition tests. This chapter will further describe the current inter-operability standards and common public databases.

Biometrics is often used for establishing trusted communication between two parties to negotiate access to an application. This is also a topic that has been studied in the field of information security for quite a while now. Therefore, in the next sections we introduce some security terms and tools that can be found, for example, in [109,162,208]. Indeed we take the liberty of following Chapter 4 of [162] fairly closely.

Biometric enrollment is a serious biometric research topic because it asks an individual to give out even more private information (e.g., fingerprint) about his or herself. However, enrollment is just a process directed by some enrollment policy. This policy needs to be acceptable to the public, since (almost by definition) policies are public documents and at least must be understood by the public. Obviously, part of the enrollment process should be a clear statement of how, where, and when this private information will be used.

There has been much interest in the individuality of some of the biometric identifiers. Loosely speaking, individuality has to do with comparing a biometric with a password [179]; it is related to how easy it is randomly to “guess” a biometric machine representation, given current sensing and matching capabilities. Reasons for the interest in individuality include the many recent challenges to fingerprint, signature, and writer authentication expert testimony in the courts of law. As well as the published empirical studies on the relatively new iris biometric (Section 14.2).

Biometric identifiers, systems, and databases are really put to the test when 1:many searches of large biometric databases are part of the enrollment policy or authentication protocol. In such identification problems, not only are low error rates desired, high 1:1 match rates are quite often also required.

In this chapter we extend the statistical error analyses of the previous chapter to biometric identification systems. Identification systems have biometric representations of many (m) users enrolled and, when a biometric is presented to them, determine which of the enrolled biometric templates, if any, matches. Identification systems in effect try to answer the question, Who is this? Such systems base these answers on biometric data only.

The choice of biometric is not just based on error rates. Many factors are involved in selecting a biometric, given some application. The cost, or added cost, and security of the installation, no doubt, depend on the choice of biometric; therefore, selecting the appropriate biometric for an application is of prime concern. Accuracy is an important factor in selecting a particular biometric, but by no means does it have to be the most important factor (see Figure 8.1).

The specifications for a biometric authentication system will usually include requirements like maximum allowable error rates. There are a number of biometric error types, expressed as error rates or error percentages, that need to be understood before a solution is designed and before a particular biometric is selected. Some of these errors are inherent with biometric authentication being just a kind of pattern recognition application; other errors are more specifically related to biometric authentication systems. What is clear is that any biometric authentication system will make mistakes, and that the true value of the various error rates for a matcher cannot be computed or theoretically established; it is only possible to obtain statistical estimates of the errors using test databases of biometric samples.

Earlier in this book (Chapter 5) we described the evaluation of biometric systems in terms of their error rates. But two important questions to consider when comparing these measures, principally the False Accept and False Reject Rates, is how accurately we know the error rates, and how much can they be trusted for making decisions.