Standards for Biometrics

Dr. Pushkin Kachroo

Introduction

• Standards needed for interoperability

• At all levels of the system– hardware level (using one company’s

fingerprint scanner with other parts from other vendors)

– Application level, database level, etc.

Layers

Sensors Feature Extractor Matcher Application

Devicedriver

Templateformat

API

API

• Application Programming Interface• Ongoing active work….• Examples:

– BioAPI– SVAPI– BioAPI for Java Card– BAPI

BioAPI

• BioAPI:– Most popular– For any biometric– Allows applications to manage

• Enrollment on client/server• Verification on client/server• Identification on client/server• Biometric signal acquisition on a client

BioAPI…contd.

• …defines at the highest level• Biometric Service Provider (BSP)• Three Steps to BSP

– Capture, Process, and Match

• Data returned to the application: Biometric Identification Record (BIR)

• Three classes of functions in the API– Enrollment, verification, and

identification

BioAPI Registry

• BioAPI components post information about themselves in the BioAPI Module Registry during installation

• Applications can check the registry for BSPs installed and their functionalities

• Device Specific parameters and status also in the registry

SVAPI

• API for Speaker Verification• has merged with BioAPI

BioAPI for Java Card

• Java Card:– Java Card technology provides a secure environment for

applications that run on smart cards and other devices with very limited memory and processing capabilities.

– Multiple applications can be deployed on a single card, and new ones can be added to it even after it has been issued to the end user.

– Applications written in the Java programming language can be executed securely on cards from different vendors.

– http://java.sun.com/products/javacard/

• BioAPI for Java Card: for security and maximum functionality…– Secure template matching , limiting attempts

BAPI

• The Biometric Application Programming Interface (BAPI) defines a standard software protocol and application programming interface (API) for communication between software applications and biometric devices. BAPI is designed to bring standards and compatibility to the biometric hardware and software markets.

• Microsoft bought it for integration• http://www.iosoftware.com/pages/Products/Biometric

%20API/index.asp

Databases

• For impartial evaluation of biometric systems, there is a need for large public databases.

• NIST: National Institute of Standards and Technologies (http://www.nist.gov/)– Leader– Fingerprints, mugshots, voice samples

• Face recognition, many universities• Speaker recognition, also academic

institutions• Iris: No known large databases present

Certification

• Certified products and solutions generally don’t exist yet, except finger printing.

• FBI fingerprint scanners• WSQ specification for Wavelet

Scalar Quantization• Common Criteria (for ISO generic

security requirements)

Legislation

• USA Patriot Act: Tools for strengthening law enforcement

• Aviation Security using Emerging Technologies• Enhanced Border Security and Visa Reform Act• Govt. Paperwork Elimination Act• Health Insurance Portability and Accountability

Act• State Level: Driver’s license related, also

privacy issues with biometric data