Finger, facial and iris recognition in field studies

For several years now, the BSI has been carrying out investigations on the various biometric technologies in relation to their performance, security and suitability for daily use.

In addition to numerous laboratory tests, an extensive field test programme on finger, facial and iris recognition was carried out through the project series "BioP I and II".

BioP I

The BioP I project was carried out under the overall project management of the BSI in partnership with the Federal Criminal Police Office (BKA) and implemented by the company secunet Security Networks AG as a BSI contractor in the period from January to August 2003 in Wiesbaden with employees of the BKA as test participants.

Investigating biometric facial recognition procedures as part of this project helped make statements on the performance of the facial recognition systems currently available on the market with regard to various aspects and gain knowledge on the use of facial recognition in relation to identity documents.

As part of BioP I, facial recognition systems from two different manufacturers were tested in verification mode (1:1), where one of these systems simultaneously provided several facial recognition algorithms from different suppliers. These systems were chosen on the basis of a selection test carried out priorly.

With the choice made, the following comparisons were possible:

• Comparison of two complete systems
• Comparison of different algorithms within a complete system
• Comparison of one algorithm within two complete systems

In addition, several reference bases were examined in terms of the varying photographs in order to make statements about whether and with which results the tested systems can process photographs of different types and quality as part of a verification process.

Lastly, the test participants were asked about their general assessment of biometrics, facial recognition in particular and the specific systems used. BioP I has demonstrated that facial recognition can deliver good recognition performance if the following general conditions are met and the basic prerequisites described are fulfilled:

• The reference base is made available on the identity document. The best results are achieved when using a template. However, an image file being provided in accordance with International Civil Aviation Organisation (ICAO) is more realistic in terms of international applicability. For this option, however, the existing optimisation potential must be utilized even more in order to achieve better results. Using an existing ICAO photo on ID cards seems to be possible, but this requires a great deal of effort from the algorithm manufacturers in order to achieve satisfactory recognition performance.
  

  

• Creating a controlled environment in terms of light influence is an important framework condition for the successful use of facial recognition.
• Improving the level of security is a key requirement for the use of facial recognition systems. While circumventing security checks using photos does not seem to be a major issue due to presumably monitored identity checks, confusing people with similar features is unacceptable.
• Regarding the suitability of facial recognition for identity documents, the caveat also applies that the effects of ageing have not been satisfactorily investigated yet. This is particularly relevant in the context of the validity of these documents.
• The framework conditions specified imply that changes are necessary to German passports and identity cards in order to achieve high-quality facial recognition. In order for reference bases to provided in a suitable way, the identity card should be also be made available on storage medium. As a fallback solution or for parallel use, the photo on the ID card is definitely an option, provided that the current guidelines for taking photographs are adapted. In this regard, the ICAO guidelines for taking passport photos for use in biometric applications should be followed. The same guidelines should be adhered to for the image files created using the storage medium of the ID card.
• The results obtained in BioP I will be verified as part of the BioP II project on the basis of a significantly larger test group and compared to the biometric procedures of iris and fingerprint recognition. The algorithm comparison developed in BioP I indicates a definite preference for Algorithm 1, which was chosen for these investigations. It was also possible to make a clear recommendation in the system test, as System B was able to produce better results in the BioP I scenario in terms of the criteria considered relevant in addition to recognition performance, such as error behaviour, reliability, manufacturer support and acceptance by the test participants.

BioP II

The second project phase, BioP II, was a direct continuation of BioP I. In this phase, the test winner from BioP I underwent a comparative system test with the two other biometric procedures of fingerprint and iris recognition systems. In addition to the facial recognition system, an iris recognition system and two different fingerprint systems were used. The two companies Fraport AG and Deutsche Lufthansa AG were recruited for the implementation of BioP II. After the necessary agreements and joint determination of the framework conditions, the test was carried out on site at Frankfurt Airport at four different locations between November 2003 and November 2004. The group of project partners involved was the same as for BioP I, except for the additional involvement of the two companies mentioned above. The main roles of Fraport AG and Deutsche Lufthansa AG were providing the necessary infrastructure for the test environments and supervising the test participants.

The interesting issues in this phase included the performance and security of the systems being tested as well as a study on acceptance and usability. Overall, the key questions were related to the practical suitability of the procedures investigated with a large user group as well as possible recommendations for future use in identity documents. The focus was on making basic statements about the different biometrics and not on the selection of the system to actually be used in the future.

The test objective of carrying out these investigations with more than 2,000 users to obtain statistically significant findings was achieved. Taking into account the recommendations of the ICAO as well as current developments at the international standardisation level (ISO SC 37), four systems between the two procedures were installed at the four installation sites (face and finger 1, iris and finger 2) according to predefined specifications. The two companies involved had the help of expert support

to develop a comprehensive communication strategy to motivate employees to participate in the test and to keep them engaged during it. Working closely with the company's Data Protection Officers and Works Councils made it possible for questionnaires to be distributed and also for interviews and focus group top be held as part of the acceptance and usability study.

Before, during and after the field test, particular emphasis was placed on ensuring the data protection of the participants involved. A plan for the protecting personal data and for data security was coordinated with the internal boards (Data Protection Officers and Works Councils) and implemented accordingly. Detailed and clear information on the test procedure and basic explanations of the biometric procedures were provided online and in paper form for the participants of the participating companies. The same also applied to the mandatory data protection statement for each test participant. Regular reporting in the company's internal media meant that participants as well as all other employees knew about the further progress of the project.

The first step of practical implementation was enrolling employees willing to participate, issuing personalised RF tokens and a test verification. With a pre-assigned user ID, each participant was given a contactless card that held their data and worked using RFID. Both ICAO images and system-specific templates were used as reference data. Both were prepared for the field test on site taking the greatest possible care.

On top of the verifications carried out on the systems in 1:1 or 1:2 mode, a significant number of verifications were performed on the database to determine the false acceptance rates and other figures following the field test. On the basis of the data material gathered and the experiences on site, it will be possible to make meaningful statements on the suitability of the fingerprint, facial and iris recognition procedures used for the target scenario mentioned above as well as on their practical suitability. In this respect, the security aspect is also of great importance from an IT security perspective. The storage of biometric data on mobile storage units such as RF tokens as well as the practical suitability of the recommendations endorsed by the ICAO were also examined. The acceptance and usability study will yield essential findings on the assessment of users of biometric systems and recommendations on how biometric systems can be improved in order to meet the demands of users for convenience and comfort.