Plug-and-Play Biometrics

	A U.S. paratrooper uses a handheld identity detection device to scan an Afghan man's iris while on patrol in Afghanistan's Ghazni province.

Government scientists have introduced a command and control protocol designed to bring interoperability to the world of biometrics. Manufacturers now can experiment with the open design in their products, offering more flexible, less expensive technologies for authenticating identities.

This National Institute of Standards and Technology (NIST) project enables the sharing of data among biometrics sensors over wired or wireless networks via Web services (WS). Called the WS-Biometric Devices, or WS-BD, the protocol allows developers to create connections among biometric capture devices and clients connected on a network or through the Internet. “We did a lot of work to make it modality-agnostic,” Kevin Mangold, a computer scientist at NIST, explains. “You can use the same interface for ... pretty much any biometric you can think of.”

The WS-BD protocol is published in the document Specification for WS-Biometric Devices, which lays out how developers can create interoperable components for biometrics sensors. These pieces can be embedded in a device or software but would follow the same guidelines from the specification. Impetus for the effort began with frustrations over the proprietary software and downlink requirements common in today’s technologies. With current set-ups, if systems owners want to upgrade from a fingerprint scanner to an iris scanner, they have to purchase entirely new systems.

In contrast, with WS-BD systems they can swap out one sensor for another, reducing costs, training time and procurement processes. And because a cable tethered to specific devices is not required for the operation of systems using WS-BD, a single client could take in information from multiple capture devices or vice versa. To illustrate, an enrollment center with five fingerprint scanners in five booths would only require one client machine, and conversely, multiple clients could share a single fingerprint scanner.

According to the document, “Each implementation of WS-BD will be realized via a mapping of logical to physical components. A distinguishing characteristic of an implementation will be the physical location of the sensor service component.” The WS-BD can support physically separated services wherein the sensor service and the biometric service are hosted on different components, and it can support physically integrated services.

Mangold says the protocol is a recommendation for developers, directing them to use Web services because of the benefits they offer. NIST has awarded a small-business contract to jump-start work in the area, though at the time of publication the institute was not prepared to release the name of the company that won the work. Procurement offices cannot ask for WS-BD conformant scanners because no manufacturers make them yet. Conversely, manufacturers may not want to develop a product no one is demanding. “Somebody has to kind of take the first step,” Mangold explains. However, the specification is free and in the public domain, so anyone is welcome to begin using it. NIST would like credit as the original creator of the protocol, but such acknowledgement is not a requirement for use.

The selected contractor mainly will work on an independent basis, but it will deliver bi-monthly status reports, giving NIST personnel a chance to participate in the development process. During the first phase, the company will conduct a feasibility study. Phase two will involve developing a device. For the concept to transfer to practical use, system purchasers will have to buy devices with the Web services running on them.

The WS-BD also will enhance security, according to Mangold, because rather than transferring the biometric data to computers via some type of unencrypted cable, the Web services will send information through an https address with built-in security factors. However, specific security measures are not addressed in the specification.

Potential cost-savings inherent in the Web services biometric technology is advantageous in the current budget-reduction environments of governments around the world. The WS-BD helps save money several ways including through use of plug-and-play components that by nature eliminate a vendor lock-in, and competition lowers prices. Through the Web services technology, biometrics systems owners can choose whichever company’s products work best, even buying the capture technology for different modalities from different groups.

Approximately a decade ago, NIST worked on a similar endeavor as a .net solution, not as one using Web services. “It was basically like a software interface to a device,” Mangold states. At a high level, both projects operated the same way, but the earlier effort focused on technology within a single machine, requiring proprietary hardware. Web services were not as readily available then. Developers examined the end of the .net research to determine how they could leverage both it and Web services to advance interoperability among biometric devices. “This is pretty much piggy-backing off that project,” Mangold says.

Using the lessons learned from the previous work helped the WS-BD developers, but the team still required two years to move the project to its current state. Much of that effort was expended in analysis and ensuring that design decisions would help manufacturers who want to use the specification. “So we spent a lot of time making sure this works well with computer-aided software engineering tools,” Mangold states. Team members released five drafts publicly via the NIST website on the road to the current version in part because they wanted an accurate understanding of what people were looking for in this type of offering. Readers provided suggestions and comments that helped decide the direction of the effort.

NIST is not the only organization examining the need for interoperability in the biometrics community. In 2010, the National Academies released Biometric Recognition: Challenges and Opportunities, a study that says developers and procurement professionals should look into interoperable options for components with short life spans such as algorithms and devices themselves. “That study fit well with what we’re working on,” Mangold says.

The WS-BD developers want to see Web services used more often and believe that their protocol can benefit most people involved in biometrics. Not only does it reduce costs and training time, but it also eases the design and implementation of biometrics systems. And with fewer device-specific drivers and cables, operators have less equipment to carry. In addition, smartphones, tablets and other devices lack a universal serial bus, or USB, port, so current systems demand larger devices in order to connect. With the wireless options, users can choose to network via smaller, handheld devices, often ones they would carry anyway. For technologies such as smartphones and tablets, the end products could be developed as an app or an HTML 5 Web page that would mimic an app.

So far, reception to the WS-BD has been positive. Mangold says everyone NIST has briefed about the project is excited to see how the idea will come to fruition in the real world, though he has no idea who will take the first steps toward implementing it into operations. During the 2010 Biometrics Consortium Conference, project personnel gave a talk about the protocol, alerting many in the biometrics field to its existence. In addition, they sought input that ranged from comments to funding from government, private industry and academia during the production of the specification.

Though the WS-BD guidance is ready for use now, it is not final. Developers have plans to add security guidance, profiles, performance testing and a live-preview option that would allow users to see what a final product would look like before capturing the information. That technology would prevent people from having to take mulitple pictures without obtaining a usable result because of problems such as closed eyes or a turned-away face. Since the current protocol version published, NIST has not received any comments on it, but developers want to hear from others in the biometrics community using the specification so they can include that information in their plans for the future.

Mangold says a goal now is to spread the word about the protocol so stakeholders can consider and begin employing it.