Biometric for Network Security

Finger Biometrics

Face Biometrics

Voice Biometrics

Iris Biometrics

The Choice of a Biometric for Network Access

Statistical Measures of Biometrics Statistical measures of biometrics can be used to decide which biometric system will best suit your needs. Not knowing the math behind a measurement should not impact one's ability to understand and compare the different statistical measures. The most important biometric statistical measures are:

Statistical Measures FAR— Measures the probability that an imposter will authenticate as a legitimate user. FRR— Measures the probability that a user who makes a legitimate claim about his/her identity will be falsely rejected. FTE— Measures the probability that an enrollment candidate will be unable to enroll in the biometric system. ERR— Measures the intrinsic strength of the biometric system and compares the strength of different biometric systems based on their EERs.

FAR The FAR is defined as the probability that a user making a false claim about his/her identity will be verified as that false identity. For example, if Matt types Chris' user ID into the biometric login for Chris' PC, Matt has just made a false claim that he is Chris. Matt presents his biometric measurement for verification. If the biometric system matches Matt to Chris, then there is a false acceptance. This could happen because the matching threshold is set too high, or it could be that Matt's biometric feature is very similar to Chris'. Either way, a false acceptance has occurred.

FRR The FRR is defined as the probability that a user making a true claim about his/her identity will be rejected as him/herself. For example, if Chris types his correct user ID into the biometric login for his PC, Chris has just made a true claim that he is Chris. Chris presents his biometric measurement for verification. If the biometric system does not match Chris to Chris, then there is a false rejection. This could happen because the matching threshold is set too low, or Chris' presented biometric feature is not close enough to the biometric template. Either way, a false rejection has occurred.

FTE The FTE is defined as the probability that a user attempting to biometrically enroll will be unable to. For example, Craig goes to the group in his company responsible for biometric enrollments. He is quickly instructed on the use of a biometric device, and then he attempts to have his biometric trait enrolled. At this time, he is unable to be enrolled. What defines his FTE can influence this measure. If the FTE is defined as a single-attempt failure, then the FTE will likely be higher than what would be seen over a larger group of people.

Conti… The FTE is normally defined by a minimum of three attempts. This is justified by the Rule of Three. The Rule of Three in this case provides us with a confidence level for a given error rate for our FTE. It also assumes that each attempt to enroll is independent, identically distributed, and that the user population size is significantly large enough. For example, if Craig is part of a population of 300 people, then using the Rule of Three for a 95% confidence level, we would obtain an FTE of 1%.Thus, if Craig is still unable to be enrolled after three attempts, he has had an FTE.

EER The EER is defined as the crossover point on a graph that has both the FAR and FRR curves plotted. The EER can also be calculated from a receiver operating characteristic (ROC) curve, which plots FAR against FRR to determine a particular device's sensitivity and accuracy. The choice of using the crossover point of the FRR/FAR or using a ROC is a question of significance. An EER calculated using the FRR and FAR is susceptible to manipulation based on the granularity of threshold values. A ROC-based EER is not affected by such manipulations because the FRR and FAR are graphed together. Thus, the EER calculated using a ROC is less dependent on scaling.

What Measure Is Most Important? To decide what measure is most important to your choice of a biometric system, its use needs to be defined as follows: Define the user population. Is the application for verification or identification? Are other means of authentication available? What is the importance of the biometric authentication? Is it driven by convenience and ease of use?

Biometric Transaction This privacy is supplied by securing the entire biometric transaction. Privacy is a part of each person's individuality. Trusting someone means sharing some of that privacy with him/her. For sharing of private information to occur, there must be security and confidence in the relationship. Security and confidence can be gained over time as a result of shared experiences.

Biometric Transaction The security and trust of a biometric transaction must begin at the presentation of the live biometric trait and continue through the final algorithm decision. This transaction path is made up of the following components:  User  Biometric reader  Matching location

Matching Location Matching can be done in one of four locations. The location where the templating occurs can be independent of where the matching takes place. The next sections will discuss where templating could take place for use with each of the following matching locations: 1)Trusted device 2)Local host 3)Authentication server 4)MOC (smart card)