Iris Recognition - Security Considerations

Security Considerations

As with most other biometric identification technology, a still not satisfactorily solved problem with iris recognition is the problem of live-tissue verification. The reliability of any biometric identification depends on ensuring that the signal acquired and compared has actually been recorded from a live body part of the person to be identified and is not a manufactured template. Many commercially available iris-recognition systems are easily fooled by presenting a high-quality photograph of a face instead of a real face, which makes such devices unsuitable for unsupervised applications, such as door access-control systems. The problem of live-tissue verification is less of a concern in supervised applications (e.g., immigration control), where a human operator supervises the process of taking the picture.

Methods that have been suggested to provide some defence against the use of fake eyes and irises include:

• Changing ambient lighting during the identification (switching on a bright lamp), such that the pupillary reflex can be verified and the iris image be recorded at several different pupil diameters
• Analysing the 2D spatial frequency spectrum of the iris image for the peaks caused by the printer dither patterns found on commercially available fake-iris contact lenses
• Analysing the temporal frequency spectrum of the image for the peaks caused by computer displays
• Using spectral analysis instead of merely monochromatic cameras to distinguish iris tissue from other material
• Observing the characteristic natural movement of an eyeball (measuring nystagmus, tracking eye while text is read, etc.)
• Testing for retinal retroreflection (red-eye effect)
• Testing for reflections from the eye's four optical surfaces (front and back of both cornea and lens) to verify their presence, position and shape
• Using 3D imaging (e.g., stereo cameras) to verify the position and shape of the iris relative to other eye features

A 2004 report by the German Federal Office for Information Security noted that none of the iris-recognition systems commercially available at the time implemented any live-tissue verification technology. Like any pattern-recognition technology, live-tissue verifiers will have their own false-reject probability and will therefore further reduce the overall probability that a legitimate user is accepted by the sensor.