What is biometric authentication?

Hackers increasingly target users’ credentials to break into corporate networks and wreak havoc. In fact, according to the IBM Cost of a Data Breach Report, stolen credentials are among the most common attack vectors behind data breaches.

Many organizations adopt biometric authentication to help thwart these kinds of cyberattacks and protect user accounts. Because biometric information pertains to who a person is, it is typically harder to steal or forge than other credentials, such as passwords and security tokens.

Biometrics can also provide a more convenient user experience because people don’t have to remember anything or carry special items to prove their identities. Biometric technology helps enable passwordless authentication, which can be both more secure and more streamlined than other types of authentication.

All authentication systems rely on authentication factors, or pieces of evidence that prove a person is who they say they are. Biometric authentication specifically uses physical and behavioral modalities to identify people.

Inherence factors, also called physical factors, are physical traits unique to a person, such as the pattern of blood vessels in their retina.

Biometric authentication systems use physical identifiers that are measurable, distinct and highly unlikely to change. Common physical biometric authentication methods include facial recognition and fingerprint scans. Characteristics such as weight and hair color can change, making them inappropriate for authentication.

New options for unique inherence factors are continually being investigated, such as thermal imaging of feet and lip shape.¹ 

While most inherence factors remain consistent, difficulties might arise if an injury alters a person’s characteristics, such as changing their fingerprints or facial features.

Another potential difficulty with inherence factors is that, if an attacker steals a physical authentication factor (such as pilfering fingerprint scans from a database), it cannot be changed. People can change their passwords, but they can't change their fingerprints.

In addition, there are potential privacy concerns around how organizations use people's biometric data after collecting it.

Inherence factors currently in use or under evaluation include:

Behavioral biometrics uses the unique patterns in a person’s activity to identify them. Common behavioral characteristics that are used for authentication include:

Multimodal biometric authentication (MBA) systems use two or more methods of biometric authentication to identify a person. For example, an MBA system might require both a fingerprint scan and a retinal scan, or facial recognition and typing pattern analysis, before allowing a user in.

The intent of multimodal biometric authentication is to significantly strengthen security measures. It is very hard for a hacker to successfully spoof multiple biometric identifiers during the authentication process.

The basic functions of biometric authentication are straightforward. The first step is the enrollment process, when a record of a person’s biometric information is digitally stored in a biometric system. Whenever the user returns to the system to be authenticated, this original template is compared to the user’s characteristics. If the biometric features match, authentication is confirmed.

To save digital storage space and speed the comparison of verifying factors, templates often store only key points. For example, with facial scans, many systems store only specific features of the face rather than the entire face. Sometimes, such as with fingerprint scans, the entire image is stored.

Stored biometric data requires strong data security measures because, if stolen, the data can be used for identity theft. And because biometric data cannot be changed, theft can potentially create a lifetime of difficulty for the victim, putting further personal data at risk.

Biometric systems often use advanced artificial intelligence (AI) to speed the recognition process. Deep learning—and convolutional neural networks (CNNs or ConvNets) in particular—show great promise for identifying patterns in templates and scans, such as for fingerprints.

Establishing a person’s digital identity is crucial before granting that person access to sensitive apps or data. Biometric security systems can help prevent presentation attacks, in which a hacker attempts to gain access to a system by spoofing a valid user’s identity.

Biometric authentication measures can also be used to protect sensitive physical locations. Government agencies might use a microchipped passport that contains a photo and fingerprints of the passport holder so that the individual’s identity can be verified against biometric information on file. In healthcare, biometrics can be used to verify that medications are given to a patient and procedures are conducted on the correct person.

Biometric factors can be used with other authentication factors to provide extra cybersecurity to multifactor authentication (MFA) implementations.

MFA might include both information—such as a password—together with a biometric factor—such as a fingerprint scan. By requesting two or more means of identification—at least one of which cannot easily be stolen—MFA makes it harder for attackers to hijack users’ accounts.

Biometric information can be used to observe individuals and track their movements. For example, law enforcement agencies often use the biometric scanning of facial features and fingerprints to identify individuals of interest.

The use of biometrics for payment processing can help speed the verification of financial transactions and streamline user experience. For example, people can use fingerprint readers to confirm payments on smartphones or voice recognition to verify online banking instructions.

Some physical retail stores are also experimenting with biometric payments, such as the installation of palm readers in Whole Foods stores.⁷

Biometric authentication systems can provide significant benefits to organizations and consumers. Being both unforgettable and unique, biometrics are often fast and easy to use, quickly providing trustworthy positive identification.

Passwords and ID cards are easier to steal than fingerprints, whereas copying an iris scan or other physical marker is extremely difficult for a hacker (except maybe in the movies).

This is not to say that biometric security systems are perfect. False rejections—when a system wrongly denies a user access—can still happen. False acceptances can also happen, when systems allow the wrong users in.

Some less sophisticated biometric systems can have vulnerabilities to spoofing, such as facial recognition systems that can be fooled by printed photos or prerecorded videos, whether of real people or deep fakes.

Because biometric authentication relies on a physical aspect of a person, that identification is always available. A palm print remains at hand, while a chipped ID card might be misplaced and a complicated password can be forgotten.

Users might be able to log on to equipment, such as a bar code reader in a retail environment, more quickly using biometrics. It generally takes less time to scan a fingerprint than it does to enter a passcode.

Biometrics can also be more secure than passcodes, which are often as simple as “1111111” on shared equipment in retail and similar environments.