We look in more detail at biometric technology, to find the right Time and Attendance solution for your business.
In our last article we examined the various Time and Attendance options most commonly available, including looking at some aspects of biometrics.
This article explores the area of biometrics in more detail, helping you make the right choice for your business.
In recent times there has been a great deal of discussion about the proper use of biometric technology; the sort of tools we are talking about are:
- Hand scanners
- Fingerprint recognition
- Finger-vein recognition
- Facial recognition
For our purposes, we are not addressing the often controversial subject of facial recognition in public areas, where cameras continually scan faces to identify members of the public. Neither are we considering vocal recognition and links with virtual assistants, or iris recognition of the type you might see on Mission Impossible. These technologies serve a different purpose and are not commonly used for time and attendance, a part of effective workforce management, which is our focus here.
Similarly, we are not trying to make an argument for or against the use of biometrics, albeit there are many arguments on each side of that debate. As a supplier of biometric tooling, we clearly understand the appetite for them, and arguments for their use, so we can’t claim to be impartial. However, it’s worth noting a recent paper from the Institute of Electrical and Electronics Engineers (IEEE), which states:
“Biometrics are part of us, unique to us, and excellent for leveraging in a secure solution.”[i]
In our last article we compared technologies based on performance, convenience and cost, so we will take the same approach here when comparing these biometric options.
Dedicated biometric systems such as fingerprint, finger vein and facial identification have made significant technological leaps in recent years. This is partly due to the increased consumerisation of smartphones, tablets and cameras, driving the use of more powerful processors and greater storage (needed for the profiles you may need to match against).
Similarly, increased security investment since 9/11, added to greater public awareness of data privacy, has forced manufacturers to innovate like never before.
Consequently, performance should not just reflect speed but also security. Older biometric technologies like hand scanners still rely on matching images; photographs, if you like. This is no longer acceptable to many individuals and organizations. Newer systems rely on measurement and geometry, typically in three dimensions (3D), of a sort that is not easily fooled by high-resolution 2D imagery.
It should never be possible to reverse engineer an image of a face, a fingerprint or finger-vein pattern from the data that is collected. Clearly, if you could, you would have an immediate security concern, so any such technology should be avoided.
Best practice is to measure between points on a face, finger or vein structure, taking enough measurements to ensure that two individuals can never match, then embed that in a solution that further eliminates errors or at least alerts you to potential conflicts.
In terms of speed, in our last article we addressed the difference between verification (a two-step process) and identification (a one-step process), which can be important at busy times, but we didn’t address some of the other aspects.
For verification, it is common to rely on a PIN or smart card which contains the biometric profile to match against, but then to have the sensitivity to matching turned down. This means that the machine or terminal is less tuned to matching. ‘Resemblance’ may be a better way to describe the level of match.
Identification, on the other hand, relies on more measurements and geometry to ‘look up’ and confirm you are who you say you are. This is more secure. Sensitivity must always be set to ‘high’, as lower sensitivity creates too many failures.
In addition to these system-related challenges, physical failure modes may also be a factor, especially when dealing with fingerprints.
Fingerprints are friction ridges on a person’s finger. The valleys between the ridges can trap material such as oil, grease, dirt and moisture that will interfere with fingerprint measurement. Similarly, working with rough materials can wear down fingerprints and make them unreadable.
Depending on the nature of the work, these factors can limit the effectiveness of a fingerprint-based approach. A 1000-employee company in Hungary is reported to have deployed three different fingerprint scanning systems without success[ii].
It may be best to do a trial with a fingerprint reader before committing to this technology.
Systems based on finger-vein recognition are not impacted by the effects of materials and environment on fingerprints.
They work by shining near-infra-red light into the finger or thumb, then reading the vascular pattern. The light is absorbed by the hemoglobin in the blood, making the veins appear as dark lines on an image. Similar to a fingerprint, the pattern is unique to each individual.
As a technology, finger-vein recognition is now nearly 15 years old, and whilst not fully commoditised it is very cost-effective, and used more widely than many realise.
The weak point is the sensitive equipment. Rather than having a platen you rest the finger on, the finger or thumb is placed on a piece of glass. This is fragile and when subject to a little vandalism it quickly fails. If cared for, this technology is a very good way to identify your workforce and does not have any of the pitfalls associated with fingerprint recognition.
For years, facial recognition has seemed like the tool of spies, top secret bunkers and government agencies, and whilst that may be true, its introduction in the Xbox Kinect and more recently in smartphones has made it more readily available, more cost effective and more reliable.
This technology relies on three-dimensional (3D) measurements of facial geometry, using measurements in the X-, Y– and Z-axes. Note, however, that two-dimensional (2D) recognition is flawed, as it is easily duped by a flat image, such as a photograph or image on a high-resolution screen held up to the camera. Three-dimensional (3D) recognition, on the other hand, takes an advanced model to fool it, making it more than adequate for time and attendance purposes.
Facial recognition has the added benefit of being non-contact, reducing the risk of transmitting infection; it is also fast, secure and reliable, offering almost unparalleled advantages to over competing technologies.
Biometrics are very convenient once installed, while installation is sometimes a consideration you should make carefully.
Clearly, they will require mains power, or power over ethernet (PoE), and they will require connectivity to the internet (by SIM, Wi-Fi or ethernet), so installation isn’t as convenient as for some other options.
Similarly, the biometric profile of an individual needs to be registered on the units, so that when an employee next attends the terminal they will be identified as attending at that time in the location of the terminal. As a result, configuration isn’t as convenient at setting-up stage either.
That said, once installed and configured, the pace at which employees can register attendance, without reference to apps, phone lines, SMS and the like, makes it the fastest and most secure way to log employees in and out of a location.
As we have already noted, consumerisation has been a major factor in performance but it has also been a huge factor in reducing costs.
The cheapest biometric terminals for time and attendance cost just a few hundred dollars. At that end of the market, a system may have its flaws, and the devil is always in the detail. For example, terminals may not push data per time-and-attendance event, causing errors to monitoring and timesheets; they may not time-sync the terminal with time servers meaning you get ‘punch drift’; they may only be 2D, or they may suffer from Lumen/daylight interference or over exposure. They may also not store enough profiles. These are all factors you need to consider.
If you are not an experienced buyer of this technology we would hope that this paper has served you well, but it’s important to remember that you don’t have to make these decisions in a vacuum. Our advice would be to buy from the software partners you use, who themselves will have thought about this and sourced reputable, reliable options.
You can find some additional reading at:
- UK National Cyber Security Centre: Biometric recognition and authentication systems
- Gemalto: Biometrics: authentication & identification – 2019 review
At Innovise, we have provided biometric solutions for more than a decade already, finding partners and suppliers who understand our market and our requirements, and who offer us world class solutions and pricing appropriate to our marketplace.
Whether you purchase or rent units, cost is unlikely to be the biggest consideration; talk to us, and we’ll help guide you to the best solution.
[i] Institute of Electrical and Electronics Engineers (IEEE), 28th June 2019. IEEE Standard for Biometric Open Protocol [ONLINE] (p12). Available at: https://ieeexplore.ieee.org/document/8751181 [Subscription required]
[ii] Otti, Csaba; Institute of Electrical and Electronics Engineers (IEEE), 12th May 2016. Comparison of Biometric Identification Methods [ONLINE] (p1). Available at: https://ieeexplore.ieee.org/document/7507397 [Subscription required]