Biometric Verification for POS

Printer-friendly version

By Tony Chapman, New Product Development Manager, Arinc.
 
Let’s start by clarifying exactly what we mean when we talk about biometrics. Biometrics is the science and technology of measuring and analysing biological data. In information technology, biometrics refers to technologies that measure and analyse human body characteristics, such as fingerprints, eye retinas and irises, voice patterns, facial patterns, DNA and hand measurements, for authentication purposes, and more specifically to identify the identity of individuals.
 
All biometric devices, such as fingerprint or iris scanners, consist of several components: a reader or scanning device; a software application to convert the biometric input to identify specific points of data as match points; and an algorithm that processes match points and translates that information into a numeric value. The database value is then compared with the biometric input the end user has entered into the scanner and authentication is either approved or denied. This database may be centralised, whereby the scanned information is searched against that held on a distant hard drive (a one to many lookup), or the data may be held on a smart card or similar device (a one to one lookup).
 
Authentication by biometric verification is becoming increasingly commonplace in corporate and public security systems, consumer electronics and point of sale (POS) applications. In addition to security, the driving force behind biometric verification has been convenience.
 
Flight Plan
 
Finger print scanners are now standard on many computers as a means of restricting access to the registered user and so protecting the data contained – recent events in the UK involving the loss of personal data can only increase this use. Additionally, this helps eliminate the need for the plethora of passwords that we all need to remember these days. In parallel to these developments, and accelerated by the events of 9/11, the increasing requirements of security and authenticating travellers’ identities, together with the requirement to shorten the security wait times for ‘known’ passengers, has hastened the development of biometric systems. To underline the requirements for positive traveller identification based on biometric identity, the 9/11 Commission Report concluded that “for terrorists, travel documents are as important as weapons.”
 
All biometric implementations are relatively new, and as we have seen this is a rapidly changing technology. However, one of the earliest implementations of the use of biometrics for passenger travel was the US Visit programme. For this project Arinc provided self-service kiosks that guided non-immigrant visa holders through the presentation of their passports, the submission of two fingerprints, a digital collection of their facial image, and collection of a printed transaction record. The data received from these transactions is stored in an encrypted format in the workstation or central server until it has been successfully delivered to the CBP IDENT database. These kiosks are used in unison with the same data collected by immigration officials for non-visa holders, but may be used by all travellers on exit.
 
At the same time, ‘Registered Traveller’ programmes were developed in many countries. In these, travellers’ credentials are registered and validated in advance and then they are typically issued an ID card that either holds their credentials, or a reference number that matches with their records held on a centralised database.
 
Although differing in approach, they all have the same aim – to confirm and validate identity, and so to reduce queue wait times for travellers that are known and considered risk free. This not only allows those passengers a quicker transit through the airport, but also allows immigration and security personnel to concentrate on those passengers that they have a more significant interest in.
The US Clear programme is a typical example in which Arinc has integrated biometrics hardware and software into its kiosks for the Registered Traveller system provided by Verified Identity Pass. As with other similar programmes, an enrolment kiosk or station is required in order to capture biometrics and photos, and authenticate/capture document information.
 
Once vetted by security authorities, the traveller is issued a smart card for use in biometric verification at the Security Checkpoint. The Clear programme uses fingerprint and iris as the biometric identifiers.
 
These devices and services have currently very little global interoperability, a US Clear traveller being unable to use their card with the Netherlands’ Privium system, for example.
 
This growth of independent standards and systems is like any new technology, where differing local requirements drives different solutions – ultimately, however, standards need to converge to allow global solutions. The IATA Simplifying Passenger Travel initiative is one forum where airlines, airports and governmental agencies are holding discussions with the ultimate aim of creating a set of prevailing common standards for identification technology. The Ideal Passenger Flow document was developed to link all aspects of the journey, and define where and how it would be possible to collect and verify traveller identity information as early as possible, and then, by using the same information throughout the remainder of the airport journey, facilitate easier air travel while maintaining high standards of security and identity management. Biometrics are an integral, although not exclusive, aspect of this model.

A direct result of the SPT was the ‘miSense’ trial in the UK, which was established to demonstrate that multiple journey stages could be linked together to create a single travel experience, including check-in, entry to security screening, aircraft boarding and automated self-service border clearance.

So where does this lead us with CUSS kiosks? The CUSS standard was approved in 2002, and although in many ways it pre-dated registered traveller developments, it does, however, support the various biometric and card reader peripheral devices that are required, such as fingerprint and iris scanners. Indeed, it could be argued that the first use of biometrics on a CUSS kiosk was in Japan in 2002. The biometric in question was a camera for passenger registration purposes only, nevertheless it demonstrated the use of such devices as part of the standard.
 
The e-Passport is now a reality and will further drive the requirement for additional devices that not only read the biometrics from the passport, but then validate them against the same biometric captured locally. The addition of registered traveller cards may need to be integrated with the process, such that not only will the identity of the passenger be verified, but if in addition their identity has previously been validated and approved, they will be cleared for the entire journey – as demonstrated in the miSense trial.
 
The world is changing fast, and truly global standards are now essential for biometric systems to enjoy successful global deployment and interoperability within the self-service industry and beyond.