Biometric Hand and Head Scanning on College Campuses

A wide variety of identification and authentication technologies are well entrenched at universities nationwide, and it seems biometrics is starting to make noise on campuses where speed and security are both needed.

Hand geometry readers have been fairly common on campus for years but more recent deployments are leveraging fingerprint and even iris biometrics to link students with transactions. Physical access is the hallmark biometric application but the technology has been gaining popularity in food service and other sectors to expedite transactions.

The social stigma attached to biometrics is also being lifted, as students are becoming more comfortable with the technology, says Brian Adoff, executive vice president at NuVision. The inclusion of a fingerprint scanner on the latest iPhone is just one indication that the younger generation is comfortable with biometrics.

“Administrators have a greater fear of the technology than students,” says Bob Lemley, director of software development at the CBORD Group. “Students are growing up with the technology so they don’t think about it as much as the older generations.”

Georgia Southern University can attest to that fact. The school deployed iris biometrics at its dining hall and only two students out of 5,400 refused to enroll, says Richard Wynn, director of the university’s Eagle Card Program.

The impetus for deploying iris at Georgia Southern was the construction of a new dining hall and the addition of a new meal plan structure, Wynn explains. When the new facility opened in the fall, the meal plans became all access, enabling students to go into the dining hall as many times as they wanted. The previous plan required students purchase a set number of meals per week, and cashiers swiped student IDs to grant or deny access.

“With the new meal plan, Georgia Southern wanted a self-service system for students that would also be hygienic,” Wynn says. Biometrics seemed an obvious solution, specifically the iris modality because students simply look at a specific spot and do not touch anything.

Wynn identified a number of solutions with the desired sub-second response time, but most were too expensive. Readers from Iris ID, however, were in line with campus expectations. It cost the school $35,000 to outfit five lanes in two facilities, where comparable solutions could have cost $40,000 per lane, Wynn says.

Next, Wynn had to figure out how to integrate the iris system with the Blackboard Transact campus card system. After different attempts at a workaround, the school decided to use the Wiegand output from the iris cameras to instruct a physical access door controller to signal a red light or green light.

The next issue Georgia Southern had to conquer was enrolling the students in the system without disrupting current processes, Wynn says. The school issues campus IDs during orientation, distributing as many as 350 cards in just two hours. That time frame was already tight so the iris enrollment had to be squeezed in to an already compressed period.

“After taking photos there’s a 20 to 30 second window while the card is printing and the student is waiting,” Wynn explains. “Now we use that time to enroll them into the iris system before the card falls into the hopper.”

As for using the system on a day-to-day basis, it’s gone well, Wynn says. Students walk up to the camera, look at a spot on the device from a foot or two away and are verified in less than two seconds. Since its deployment in August, the iris system has successfully processed more than 375,000 transactions.

For the most part the system has worked very well with one of the only issues being students with dirty glasses, Wynn says. “Spots on the glasses and strong prescriptions can interfere with authentication,” he adds.

Other campus entities are considering the iris system as well. The student rec center has a fingerprint system for access and is considering a switch so students won’t have to enroll in more than one system. The data center and other high-security facilities are also considering iris for physical access.

Georgia Southern’s ID card already supported prox and mag stripe so why didn’t the school use one of those existing technologies for access to the dining halls instead of adding another technology? The university wanted to tie the identifier to the student rather than simply to the card, Wynn says. “You know it’s that person with the biometric,” he adds.
Boston University goes with fingerprints

At Boston University’s Marciano Commons, fingerprint scanners are used in conjunction with the school’s contactless ID cards. Serving more than 5,000 meals daily, the new location’s six points of entry are controlled by turnstiles that combine the campus card and biometric fingerprint technologies.

University officials say that the inspiration behind the use of biometrics was the prevention of meal plan sharing between students. Boston University uses CBORD’s CS Gold campus card system and HID Global’s iCLASS contactless cards for functions including meal plan management, access control, payments and privilege verification.

The biometric data is stored exclusively on the cards and is never logged in a backend database. The use of the biometric is an opt-in function so students who wish to forgo the fingerprint capture–an uncommon choice thus far–can simply present their card to the cashier at the gate for further verification.

The new turnstiles are simple to operate. Students first present their card to the turnstile reader and are then prompted to present their finger for biometric authentication.

The bioCLASS reader from HID Global then interacts with CS Gold’s access control module to determine that the card’s biometric template matches the presented sample and that the user has enough meals remaining on their plan to complete the transaction. Provided the above conditions are met, the turnstile opens and grants access to the hungry student–a process that takes just seconds.

“Students love the biometric solution and they know it is cutting edge,” says Marc Robillard, BU’s Executive Director of Auxiliary Services. “We had very little pushback, especially since all the biometric data is stored on the card rather than in a database. By and large, they love the speed and convenience of biometrics.”
Winthrop trials biometrics for variety of applications

Winthrop University rolled out iris biometrics in the fall and is capturing the data from all incoming students as it contemplates expanding use of the security technology. The university’s 6,170 students will begin testing the iris scanners at an on-campus pre-school where the university’s education majors are trained, says John Hammond, associate vice president for information technology at Winthrop.

The identities of parents and guardians will be verified using the technology when they pick up their children. Winthrop officials did review other options before going with iris, Hammond says. ID cards were dismissed because there were concerns about parents and guardians having to carry them all the time.

The system is also deployed for access at the Carroll Capital Markets Training & Trading Center, a mock high-tech trading floor on campus. Students can use their iris to scan into the facility.

Fingerprint was considered but the university had previous experience with the modality and wasn’t pleased with the results. There were also hygiene concerns with a fingerprint modality. Iris had always intrigued Hammond but he had assumed it was too expensive. “But then we saw the price went down,” he says.

Winthrop found positive results with iris readers from Iris ID, but there was integration required to make it work with the existing campus card and physical access control systems. The Weigand output didn’t integrate with Winthrop’s systems so a programmer on staff had to work to make it match up, says Hammond.

Another programmer worked to ensure the information housed in the database was the same format as the card access system. “The card access system thinks you’re using a card but it’s actually using the iris,” he explains.

Enrollment stations are operational in the card office, Hammond says. Parents and guardians are enrolling so when the system goes live in the fall, it can be used right away. Winthrop is also enrolling anyone that comes into the card office for any type of maintenance as well as all incoming freshmen to prepare for future uses.

To enroll, individuals stand 12 to 14-inches away from the scanner and look into a mirror. An LED inside let’s the subject know when they’re in the correct position and the scanner captures the image to create the template, Hammond says.

While the scanners will initially be in the lab school only, Hammond envisions other uses including residence hall and rec center access where it is inconvenient to carry an ID card to work out or swim.

The Chemistry Department has also approached Hammond about using the scanner for physical access in some of their areas. This application would be a combination of security–making sure the unauthorized don’t have access to chemicals–and convenience because students would be wearing gloves and often have their hands full when trying to access a door.

Winthrop isn’t mandating that everyone enroll in the system. There have been about 10 people who haven’t wanted to participate because of personal beliefs. “For people who decline to participate we’re telling them that access to some services might not be as convenient,” Hammond explains. “They might have to be buzzed in or wait a little longer.”

The main criticism of the system has been cost, Hammond notes. The iris cameras are around $2,500 per door whereas a magnetic stripe reader is a fraction of that. “We believe it’s justified with the added security and convenience,” he adds.
Biometrics expanding on campus

Biometrics in high-security areas using multi-factor authentication for physical access is not new on campus; nor is the technology’s deployment for niche applications like rec center access. But additional everyday uses are being considered more often, says Kent Pawlak, director of product strategy at Blackboard. “In the last few years the use of biometrics for convenience has taken off and I think we’ll see more of that,” he adds.

The recreation center is a prime example of a convenient use of biometrics, an example that is being followed by some major fitness chains that have also deployed fingerprint sensors for access to their facilities. The use of identification technology in the food service arena, however, is less about convenience than protecting a valuable asset, Pawlak says. “There are more unlimited meal plans out there and greater concern for sharing ID cards,” he explains.

Classroom attendance is another application that could leverage biometrics, says NuVision’s Adoff. Trade schools that have hourly requirements are using biometrics to keep track of attendance rather than requiring students to swipe an ID. It also prevents a fellow student from swiping another student’s ID card.

There are also the high-security areas, where biometrics has long been used. Some campuses have labs that may store nuclear materials and the Department of Energy requires three-factor authentication for those facilities, says CBORD’s Lemley.

Also bolstering adoption is the increased reliability and accuracy of biometrics. “Biometrics is mature enough and you can get the speed you need with the reliability and low false rejection rates,” Pawlak says.

The algorithms that run the system are also faster, says Lemley. The systems can perform checks on larger databases quicker so students aren’t waiting for the system to respond.
Privacy and biometrics

Not storing an image but a template

It is a common refrain that biometrics are well received on campus because students are comfortable with new technology.

It also helps, however, to explain that systems aren’t storing images of a fingerprint, iris or other body part. Rather mathematical representations, or templates, are created and the actual image is never stored in the system. When an individual is enrolled into a biometric system–no matter the modality–the algorithm picks out a select number of points and then translates that into a mathematical template.

That information is typically encrypted and rechecked when a user attempts to authenticate to the system at the time of service delivery.

There are several advantages to using a biometric template instead of an image. For one, they are smaller in size and make it easier to store biometric information on a smart card or other memory-restricted system. Additionally, it ensures that an actual image could not be reverse-engineered from a compromised or stolen template.
Combating biometric spoofing

Spoofing is an attempt to defeat a biometric system through the introduction of fake biometric samples. Common spoofs include photos of face or iris, latent fingerprints, artificial fingers, and voice recordings. There are several categories of anti-spoofing approaches commonly used in biometric deployments.

Attended, supervised sample collection
By placing a human watcher at the point of biometric sample collection–such as a border control agent at an entry point–spoofing attempts can be made more complicated. In most cases, however, this is an unpractical and cost prohibitive approach.

Challenge and response procedures
With certain modalities, the specifics of the sample can be customized and changed at the collection point. Facial recognition systems can randomly ask for changes in face characteristics, for example smile and alter gaze or direction.

Liveness detection
Making sure a biometric sample is from a living, breathing human being is a key tool in the prevention of spoofing. Techniques for liveness detection vary from modality to modality and vendor to vendor. Iris and face vendors look for subtle, often involuntary movements that occur in human samples.

There are a number of different approaches fingerprint vendors take to ensure that the biometric is not coming from a plastic mold or other spoof. Some look below the surface of the skin to detect the presence of tissue, veins or other features. Others look for the naturally occurring pulsation, electric conductivity, radio waves, perspiration, heat or other byproducts of live tissue.
Iris biometrics: A primer

Iris biometric systems have typically been deployed in high-security environments, such as airports, data centers and border control areas. Early iris systems required the user to be just inches from the camera in order to authenticate.

The technology has since improved, enabling users to authenticate from as much as six feet away. These systems are deployed at airports across the Middle East to spot individuals who may not be welcome in certain countries. The technology is also catching on in the U.S. and other Western countries where military bases, corporate centers and government offices are utilizing iris for secure, convenient authentication.

One issue with iris has been it’s high cost, especially compared to fingerprint scanners. When comparing iris systems, with the greater distance comes increased cost. Typically, devices with shorter reach are less costly and thus more likely to be the choice of universities and convenience-focused applications. [end] CR80News