US: IBIA wants NIST to do more for biometrics

NIST Urged to Expanded Role of Biometric Authentication (Find Biometrics)

...IBIA Vice Chairman Walter Hamilton pointed to recent years’ “surge in the use of biometric technologies for mobile banking and other e-authentication applications,” adding that “NIST should support this trend by providing guidance on how to ensure the effective implementation of biometrics as an authentication token rather than narrowly limiting its use.”

The Nitty Gritty of fingerprint algorithm testing

re:ID podcast — The Minutiae Interoperability Exchange Test
Gina Jordan and NIST researcher Patrick Grother discuss the ins and outs of how some fingerprint templates are made and how the US National Institute of Standards and Technology (NIST) provides the service that allows algorithm developers to test them (6:26 min.).

Patrick Grother, NIST iris project leader among 15 innovative US government employees

Patrick Grother is a pioneer in making iris scans--not long ago, the stuff of science fiction--a viable biometric usable on smart card credentials today (FierceGovernmentIT)

Good news for iris biometrics

Notice: Link goes to a 22 MB pdf...

IREX VI - Temporal Stability of Iris Recognition Accuracy (United States National Institute of Standards and Technology - NIST)

Using two large operational datasets, we find no evidence of a widespread iris ageing effect. Specifically, the population statistics (mean and variance) are constant over periods of up to nine years. This is consistent with the ability to enroll most individuals and see no degradation in overall recognition accuracy. Furthermore, we compute an ageing rate for how quickly recognition degrades with changes in the iris anatomy; this estimate suggests that iris recognition of average individuals will remain viable over decades.

There's a whole lot o tehcnical detail on the full report.

The executive summary continues on to say...

However, given the large population sizes, we identify a small percentage of individuals whose recognition scores do degrade consistent with disease or an ageing effect. These results are confined to adult populations. Additionally, we show that the template ageing reported in the Notre Dame studies is largely due to systematic dilation change over the collection period. Pupil dilation varies under environmental and several biological influences, with variations occuring on timescales ranging from below one second up to several decades. Our data suggests that the natural constriction of pupil size over decades does not necessitate re-enrollment of a well enrolled iris.

Some people really love stovepipes...

...otherwise there wouldn't be so many.

Congress demands progress on advanced ID cards  (FCW)

"We've spent billions and we have nothing to show for it," said Rep. John Mica (R-Fla.) at a June 19 hearing addressing lagging implementation of fingerprint and iris recognition technology. Mica, who chairs the House Oversight and Government Reform Committee's Subcommittee on Government Operations, noted various examples of flawed federal biometric ID efforts, including the Transportation Workers Identification Credential, or TWIC card, and the Federal Aviation Administration's new pilot's license -- which does not include a photo of the licensee.

"It's mind boggling that we have nothing close to meeting with the intent of the 2004 law," said Mica. "Is there any sense of urgency here?" asked Rep. Gerry Connolly (D-Va.), the subcommittee's ranking minority member.

Witnesses included managers from the National Institute of Standards and Technology, FAA, Customs and Border Protection and the State Department.

It's stunning that pilots licenses still don't have photographs on them. Lots of good information awaits those who click the link.

NIST seeks to refine standards for oral biometric modalities, among others

NIST Biometric Workshop Studies Voice, Dental, Oral Standards (Press Release via Thomas Net)

A working group of international dental and forensic experts has developed a draft dental and oral biometric data record that would ease identification of bodies in disasters such as an airplane crash. For instance, if bodies are burned beyond recognition, photographs or fingerprints might not offer practical means of identification; in such instances, forensic analysts turn next to dental and oral information. Developing this standard was challenging due to the variety of ways dentists around the keep dental records, but could offer an interoperable mechanism to exchange such information in the future.

“Oral” measurements and images include attributes such as lip prints and soft palate impressions. Lip prints can sometimes be linked to specific persons and may be found on objects at crime scenes.

The proposed Dental and Oral Supplement would enable the exchange of images and descriptions of pattern injuries on persons, some of which may resemble bite marks, and to allow transmission of imagery such as X-rays and sonograms.

The workshop also will collect information to develop recommended best practices for identifying disaster victims. A panel will discuss the use of various biometric data in identifying victims, including DNA, facial characteristics, tattoos, dental records and fingerprints. This project is in conjunction with the international Scientific Working Group for Disaster Victim Identification

More at the link above.

More information on the NIST Biometric Conformance Test Software

Are your biometrics up to snuff? Free suite tests for compliance (GCN.com)

The BioCTS suite checks that the record of an iris image or other piece of biometric data being used has the correct data and in the order called for by the standard, so that it can be sent to and received correctly and filed accurately by any user, from the Homeland Security Department to state and local police departments. The conformance testing provides programmers, users and product purchasers with an increased level of confidence in product compliance and increases the probability of successful interoperability.

The tests do not ensure interoperability of different products, however; only that they adhere to common standards, Podio said. “Conformance increases the probability of interoperability, but cannot ensure it because of all the possible implementations that can be included” in a product. Each developer can implement different profiles from the standard, depending on how the product will be used.

More good analysis and links at the GCN link above.

New NIST tools for testing against standards

New NIST software checks performance of biometrics applications against 2011 standard (PhysOrg)

A new software test suite developed at the National Institute of Standards and Technology (NIST) allows local and federal agencies and other users of the NIST's revised biometric standard to gain higher confidence that the correct biometric information can be shared between agencies accurately and rapidly.

National Strategy for Trusted Identities in Cyberspace (NSTIC) Background and Progress Report

ID management: A matter of trust (Federal Computer Week)

In April 2011, the Obama administration launched a plan called the National Strategy for Trusted Identities in Cyberspace (NSTIC) to encourage the private sector to develop, with federal support and input, online ID and authentication systems that people could use and government agencies, other organizations and commercial players could accept without each needing to create their own vetting systems.
...
At this point, NSTIC supporters are making headway, though perhaps not in a headline-grabbing way. Earlier this month, the Identity Ecosystem Steering Group, a federally supported committee led by the private sector that will guide creation of NSTIC-style systems, met for the first time in Chicago to hash out plans for addressing privacy, standards, usability, contracts and other key components.

National Strategy for Trusted Identities in Cyberspace (NSTIC) is being run by National Institute of Standards and Technology (NIST) to encourage the development and adoption of standards for ID management. The recent Apple-Amazon hack points to why this is important.

In an environment where everyone has to create their own ID management system, it is inevitable that organizations will create exploitable gaps in the way they emphasize the importance of information. In this case, Amazon (like many other companies, just check your restaurant receipt) treated the last four numbers of a credit card as non-secure information, while Apple used the same information for logical access control.

Initiatives like NSTIC hope to facilitate companies and government agencies to work through ways to make this kind of thing less likely.

New Standard Protocol Allows Web-Based Biometric Acquisition

New Protocol Enables Wireless and Secure Biometric Acquisition with Web Services (NIST.gov)

The WS-Biometric Devices protocol will greatly simplify setting up and maintaining secure biometric systems for verifying identity because such biometric systems will be easier to assemble with interoperable components compared to current biometrics systems that generally have proprietary device-specific drivers and cables. WS-BD enables interoperability by adding a device-independent web-services layer in the communication protocol between biometric devices and systems.

This ought to help out a lot with interoperability. Thanks, NIST!

NIST Evaluates Iris Biometric ID Algorithms

Eye-recognition techniques picking out 'needle in haystack' much faster (New Kerala)

NIST evaluated 92 different iris recognition algorithms from nine private companies and two university labs, all of which submitted software to an open competition held by NIST. The task was to identify individuals from a database of eye images taken from more than 2.2 million people.

The article does a great job of showing that different solutions addressing the same problem perform differently. The article is about iris technology, but the same principles hold with all biometric modalities.

UPDATE: Here's the actual full report...

WARNING: Clicking this link (IREX III final Report) will probably cause your browser to automatically download a .zip file from The National Institute of Standards and Technology's .gov web site (not that there's anything wrong with that).

New NIST Biometric Data Standard

New NIST biometric data standard adds DNA, footmarks and enhanced fingerprint descriptions (Physorg.com)

"The additions to this version of the standard represent a great leap forward," said NIST Biometrics Standards Coordinator Brad Wing. The capabilities of the system have been greatly expanded from that of matching a fingerprint, facial image or iris sample collected directly from a live person and comparing it to samples previously stored in a database. New types of biometric data—DNA and plantars/footprints—were added as well as updates to existing record types.

This is the first international standard for the exchange of DNA data. DNA can be used for criminal case identification, such as in a rape case, or in a forensic setting to identify victims, such as those in a plane crash, where it is necessary to have an original DNA sample from the victim, or establish kinship by taking DNA samples from purported relatives. The standard handles both types of cases.

The full article will appeal to technical readers. If that doesn't satisfy your thirst for detail, the full publication of the standard can be found here:
Data Format for the Interchange of Fingerprint, Facial & Other Biometric Information [pdf]

Web services look to revolutionize biometrics

National Institute of Standards of Technology (NIST) is working to establish protocols to ease implementation and increase interoperability for biometric devices (ThirdFactor.com)

Currently biometric devices require dedicated software to interact with other electronic devices (e.g. computers, handhelds, mobiles). When either device changes, the wheel must essentially be recreated–or at least the software that drives it. “If devices can understand the Web inherently and the device changes,” explains Micheals, “you don’t have to rely on the software that hinders interoperability.”

These protocols will certainly help make our job easier.

Overcoming the challenges inherent in integrating diverse biometric hardware and software into coherent solutions delivered over multiple platforms is what SecurLinx does.