InformationWeek

August 31, 1998

Biometrics Is Poised For A Breakthrough

By Jason Levitt

Related stories:

Security Standard For Credit-Card Transactions

Biometrics Is Poised For A Breakthrough

The IETF's X.509 Public Key Infrastructure Drafts

ant a sure-fire way to put a room full of business IT buyers asleep? Just start explaining Public Key Infrastructure to them. But mention biometrics and suddenly you've ventured into the territory of James Bond and Mission: Impossible-except that biometric technology is real and viable, not a product of Hollywood.

Declared one of the top 10 emerging technologies to watch in 1998 by Gartner Group Inc., biometrics-the science of identifying people based on their unique physiological characteristics, such as fingerprints, facial features, or voice-is poised to become a favorite way of authenticating humans in E-commerce scenarios.

Compared with the complexity and comparatively high maintenance of public-key encryption methods, biometric technologies such as fingerprint scanners are intuitive and easy to grasp. The main roadblock to acceptance has been the relatively high cost of the hardware, a problem that's being addressed by a new crop of inexpensive fingerprint scanners.

Companies such as Lucent spin-off Veridicom Inc., American Biometric Co., and Biometric Access Corp., among others, are now offering fingerprint scanning technology for less than $200 per seat. Biometric Access' new SecureTouch fingerprint reader sells for $119 in bulk, and can be used for enterprisewide authentication with products such as IBM's Global Sign-On 2.0 product.

For authentication purposes, biometric methods are intuitive and difficult to crack, but they aren't perfect. Like passwords and private keys, master fingerprint records, used to verify a fingerprint, must be stored online. With Biometric Access' product, though, each master record is a mere 480 bytes, and cannot be used to recreate the original fingerprint.

"Everything in the world can be faked if you have enough time and money," says Biometric Access CEO Ron Smith. "But it's a whole lot tougher to fake a fingerprint than to steal a password. So what you're doing is raising the fortress wall."

Citing consumer wariness of new security technologies, most E-commerce companies are taking a wait-and-see approach.

Though Microsoft says its Site Server product supports any biometric access method that's compatible with Windows NT's security infrastructure, the high cost of hardware coupled with a lack of user confidence in such methods has kept deployment low.

Win Treese, director of security for OpenMarket, says the market isn't ready yet. "We are paying attention, but it isn't something our customers are interested in right now," he says.

A full list of companies involved in biometric access technology can be found on the Biometric Consortium's Web site at www.biometrics.org.

Return to The Keys To Security

Back to Labs

Send Us Your Feedback

Top of the Page