Move over, fingerprints; iris scanners are coming

By Judith Myerson

Fingerprint scanning has been available for some years in smartphones, laptops, and tablet computers as a biometric alternative to using passwords for device access. But the approach has its limits, including a number of vulnerabilities that allow the system to be fooled. Now, companies are looking at iris scanning as an alternative that may offer better protection.

The iris is the colored part of the eye between the pupil and the sclera, or “white” of the eye, and is composed of pigmented, connective tissue attached to muscles. The detailed structure of an iris is the result of random tissue development during gestation, and so is unique to each individual. Iris scanning is different from retina scanning, which examines blood vessels at the back of a person's eye, and is more convenient to use.

It's not really a scan, though. Iris scanning techniques use near-infrared illumination and a camera to take a snapshot of a person's eye. For iris scanning to work best, the eye should be three to 10 inches from the scanning camera. Once the image is captured, the system performs mathematical operations on that image to isolate the iris by locating the center of the pupil, the edge of the pupil, the edge of the iris, and the eyelids and eyelashes. The near-infrared light makes a person's pupil appear very black, simplifying the task of isolating the pupil and iris.

When the iris part of the image has been isolated, the system calculates a digital template based on the iris's characteristics. Generally only a portion of the iris image is used for verifying identity. Sections of the top and bottom of the iris image are ignored to account for eyelashes and eyelid occlusion. Comparing the template result to a reference template created during enrollment, or first scan, provides the recognition decision. 

Iris scanning has several advantages over fingerprint recognition in verifying user identity. One is a wide difference in the number of reference points used in each biometrics technology. Generally, the higher the number of points of reference used in comparing a scan against an enrolled reference, the lower the error rate. A fingerprint scan typically uses no more than 60 to 70 reference points. An iris can contain more than 200 points of reference. Companies such as Iris ID that offer iris scan technology estimate that the chances of two irises being identical are roughly one in 1,078, although practical template sizes yield a more modest false acceptance rate (FAR) of one in 1.5 million. Still, this is far greater than fingerprint recognition's typical FAR of one in 10,000. 

A second advantage of iris scanning is that iris patterns do not appear to change over time unless injury has occurred. And unlike fingertips, the iris is protected against wear, dirt, casual damage, and other agents that are known to compromise fingerprint scanning efforts. The result is more consistent recognition.

Furthermore, there is no touching involved. This can be an advantage in environments where users might be expected to be wearing gloves or when touching is impractical. Eyeglasses and clear contact lenses are not usually a problem, nor are conditions such as cataracts that affect the lens but not the iris. Iris scanners typically work well with these items, although they may have trouble with dark glasses or colored contact lenses. Even blind people's eyes have distinct irises and pupils, so as long as they don't wear sunglasses, they are good candidates to have their eyes scanned for identification. 

These advantages are stimulating a growing iris recognition market, according to a report by Triactica. Principal analyst Keith Kirkpatrick writes in the report's summary that “Iris recognition is now gaining traction as a secure and consumer-friendly biometric modality, thanks to growing competition and innovation.” This increasing competition for a share of the iris recognition market, in turn, will help to drop the prices for iris recognition to become part of the mobile device market. 

Practical iris recognition systems are already out there. There are numerous iris recognition use cases, such as the iris-scanning ATMs in Japan. More than 80,000 such ATMs were installed in response to legislation requiring banks to pay for fraudulent charges because they are seen as a better way to combat unauthorized ATM withdrawals and other types of fraud. ATMs with fingerprint readers did not work as well. The installation costs for the iris-scanning ATMs were lower than the fines that the banks would pay in the long run. Now, banks in other countries are moving toward the new technology in rural areas. 

Mobile devices are also starting to employ iris scanning. The Microsoft Lumina 950 XL, introduced in 2015, can scan your iris and store the information in its central security system. You can then use your eyes to unlock your phone. Newer mobile phones that are rumored to sport iris scanners include the iPhone 8, the LG G6, the Moto Z 2017, and the Samsung Galaxy S8, all scheduled for release in Spring 2017 or later. 

Most recently, Qualcomm, in conjunction with EyeLock, demonstrated iris recognition at Mobile World Congress. The EyeLock technology has been integrated into the Qualcomm Snapdragon 835, meaning that future mobile device designs are even more likely to offer the technology.

Iris scanning can still be spoofed, of course; no security technology is perfect. A high-resolution photo of an eye can, in some cases, yield a false recognition. But the convenience of touchless operation, the use of IR lighting, “liveness” checks, and the larger number of reference points in use may well ensure that iris scanning overshadows fingerprint recognition for mobile biometric security.