Fingerprinting Puts a More Foolproof Touch on Prime Time

When NASA needed a foolproof way of controlling who entered its new Triana Science and Operations Center at the University of California in San Diego, it went for fingerprint-based access. Security was crucial for the facility, which is part of the Scripps Institution of Oceanography, since it develops Earth-imaging tools for spacecraft and is tied closely to NASA networks. And even though the fingerprint system cost 50 percent more than the access-card approach, it was the most secure choice as far as operations manager R.B. Smith was concerned."You can loan someone your card and personal identification number, but not your finger," Smith said.So in January, the center installed eight fingerprint-reading units, one for each entrance and office, provided by BioScrypt Inc. of Toronto, an authentication solutions company. Without using personal identification numbers, keys or pass cards, employees now gain entry by merely placing their fingers on a reader. Access is granted or denied by a database of fingerprints from 200 authorized users. BioScrypt's NASA work may be typical of the niche fingerprint authentication market these days, but fingerprint scanning is nearly ready for far wider deployment, experts said. Thanks to dropping hardware prices and new interoperability standards, fingerprint scanners may soon be standard gear in laptop and desktop computers, cell phones, handheld computers and even smart cards. Market research firm Frost & Sullivan Inc., San Antonio, estimates spending on fingerprint systems will grow from $25 million in 2000 to $290 million by 2006, not including sales of high resolution units used by law enforcement agencies to identify criminals."It is a very dynamic market," said Prianka Chopra, a Frost & Sullivan analyst. "There are a number of vendors, which makes it very competitive." As a result, fingerprinting units that used to cost $500 each a few years ago are dropping to less than $100 now. The remaining challenge is for software developers and solution providers to integrate this technology into enterprisewide systems, industry experts said."Fingerprinting is good because it is very simple," Chopra said.A form of biometrics, fingerprinting identifies a person by his or her unique characteristics. When coupled with digital certificates and public key infrastructure tools, this authentication tool can guarantee the security needed for electronic exchanges, according to supporters. At the enterprise level, this convenience can actually save money. For an organization with 10,000 users, password management can run as high as $350 per person per year because of help-desk calls for forgotten passwords, said Damon Wait, director of investor relations at identification solution provider Identix of Sunnyvale, Calif., who quoted a study from market research company Gartner Inc., Stamford, Conn.In contrast, an Identix-based fingerprint authentication solution that eliminates passwords can be installed for around $150 per seat plus a maintenance cost of about 15 percent, Wait said. Although fingerprinting scanners have long been used in specialty areas, the industry is being invigorated by recent price drops in silicon-based microchips. A design for chips costing $10 to $20 each, developed by now-defunct authentication technology developer Veridicom Inc., was sold in July to solutions provider Precise Biometrics AB, Sweden. The technology was also licensed to information technology manufacturer Fujitsu Ltd.Semiconductor company Authentec Inc., Melbourne, Fla., has stepped up with its own series of chips that cost $25 to $30 and are expected to drop below $10 each by year's end, according to industry sources. Optical-based scanner producers such as Identix have responded to this competitive heat as well, Chopra said. For instance, Identix has recently released a scanner on a PCMCIA card."Systems integrators have to stay on top of the biometrics field. Almost every company has a biometrics division," said Michael Thieme, senior consultant at the International Biometric Group, a New York-based integration and consulting firm. For example, eTrue, Southborough, Mass., which signed a deal to provide NASA with Internet-based biometric authentication system for remote log-ons, has signed partnerships with SRA International Inc., PriceWaterhouseCoopers LLP and Sytex Inc.Spyrus Inc., San Jose, Calif., provides biometric solutions to three of the five prime contractors in the General Services Administration's Smart Access Common ID Card contract, a $1.5 billion, 10-year contract awarded in May 2000. Spyrus is on teams led by Electronic Data Systems Corp., KPMG Consulting Inc. and Litton PRC Inc., now part of Northrop Grumman Corp.'s Logicon Inc. unit.Identix has also formed partnerships for this GSA contract with EDS, PRC, Maximus Inc. and Logicon. Logicon and PRC won their contracts before Northrop Grumman acquired Litton Industries Inc. earlier this year. The biometrics companies are also securing their own government contracts. Identix was selected by the Florida Supreme Court to secure its 650-seat, wide-area network enterprisewide, which encompasses five District Courts of Appeal and the State Supreme Court. And Aug. 7, an unnamed Arizona county contracted Identix's solutions for a 1,000-seat network to ensure that only authorized attorneys are able to access sensitive court records. "You still see contracts coming in for several tens of thousands of desktop seats," Thieme said. "The pace is quickening, but with 50 million seats out there, it still isn't making a big dent." According to Thieme, the barrier to mass acceptance resides in the work needed to be done to modify enterprise-level, back-end systems."Companies have done a fine job at bringing hardware to acceptable levels. It's the software that is the problem," Thieme said. "If you have 15 or 20 applications that need biometric verification where a password used to be, that's where the biggest obstacle is." Single sign-on solutions can address this problem, but "when you have one sign-on for 20 applications, you better make sure that is the right person signing on," said Henry Kunicki, vice president of sales for eTrue.Thus the need for more expensive multiple-form authentication, where fingerprinting is paired with PKI verification, he said.Bill Bialick, technical director at Spyrus, pointed to another problem: slutions vendors offering proprietary models. Because of this, agencies are reluctant to trust one vendor's standard for an organizationwide authentication. Part of the solution here may come from the BioAPI Consortium, which announced the final release of the BioAPI specification last March. BioAPI defines an open system standard application program interface, or API, for applications to interface with a broad range of biometric technologies."It would be nice if this standard gains acceptance, but it's still young," said Barry Keyes, vice president of eTrust Security Solutions at Computer Associates International Inc., Islandia, N.Y. At present, Computer Associates works with individual biometrics vendors to assure interoperability with its eTrust single sign-on and eTrust Web Access Control tool sets."We have the back-end software that can provide multiple authentication across the enterprise with complete policy management," Keyes said. However, the adoption rate would increase with a common standard, he said.Once standards are recognized industrywide, then fingerprinting technology is almost certain to gain mass adoption. "Everyone wants to get rid of PIN numbers," Bialick said.XXXSPLITXXX-While low-cost fingerprint scanners may be the next wave in authentication, the need for high-end systems will remain strong, thanks to a growing thirst of law enforcement agencies for automatic fingerprint identification systems.In 1999, the FBI introduced the Integrated Automated Fingerprint Identification System, which allows law enforcement agencies to rapidly identify suspects through fingerprint matching. And this past July, the Justice Department awarded $16 million to 26 states to integrate information networks for sharing crime-related data, including fingerprints.To take advantage of these efforts, agencies need fingerprint scanners capable of higher resolutions than what is offered by low-cost models and pre-computer-era, ink-based techniques. The FBI requires a resolution of 500 dots per inch, or DPI, per image for comparisons, said Frances Zelazny, director of corporate communications for Visionics Corp., Jersey City, N.J., a biometrics solutions company offering "forensics quality" fingerprint systems. Thus far, Visionics has sold 560 fingerprint-based biometrics systems to law enforcement departments. Earlier this month, the company won a $660,000 order from the Alabama Bureau of Investigation to install 30 live-scan fingerprint systems in state jails and courthouses.These systems run anywhere from $25,000 to $50,000 per workstation, depending on customization, Zelazny said. Besides law enforcement, Visionics has been supplying systems to airports, hospitals, banks, border-patrol agencies, day-care facilities and other businesses that run criminal background checks on potential employees and others.Another player in this market is identification systems integrator Printrak, a Motorola company in Anaheim, Calif. In May, Printrak was awarded a $5 million contract with the Oklahoma Bureau of Investigation to provide an enhanced identification solution that included fingerprinting and connection to the FBI's database.Printrak is also enjoying an uptick of sales in fingerprint-based national identification systems. In July, the company won a contract to provide a national identification system for the Swiss Federal Office of Police. And in April, it secured a $3 million contract to provide a similar system to the Republic of El Salvador.