With the proliferation of the automated interactive machines, exemplified by the automated teller machines (ATM) for financial transactions, there has been an emerging need for a more reliable personal identification system for authenticating users who desire to conduct transactions remotely and automatically without human intervention. Conventionally, a person simply inserts her ATM card into the machine to have her account information and password, or PIN ("Personal Identification Number", used here interchangeably with the word "Password"), read. However, as the everyday life as a whole becomes more automated and security-conscious, a person often has to manage various different passwords and PIN's, for accesses to her banking account, her home security system, or her eMail account, to name just a few. This overflow of information has already contributed to the complexity of conventional personal identification systems in that without the correct password for an ATM, a legitimate user may be denied of her access to her account or her on-line brokerage account.
There is an often overlooked burden placed on the institutions providing on-line, or remote, transactions which are accessed through the customers' passwords or PINs. Maintaining the passwords or PINs forces the financial institutions to allocate additional machines and human resources to manage interface with customers when a customer forgets her Pin or when a customer requests her PIN be changed.
Also, passwords have been proven to be insufficient in preventing fraud, where all a would-be criminal needs is an ATM card and the password, which are both reasonably within the reach of those unscrupulous ones. This is just the first example of how the conventional personal identification paradigm is vulnerable, in addition to being complex as discussed above.
Another problem plagues the integrity of the supposedly secured financial transaction, where sometimes it is the actual account holder who defrauds the institution by first accessing her account and later denying such transaction from ever taking place. While there is a limit as to the extent of this sort of heinous behavior, it amounts to a significant sum even with just a small percentage of the ATM transactions considered. Without a more reliable identification system, institutions will just have to write off the losses or pass the losses to the rest of the consumers, thereby increasing everyone's cost of doing business.
Aside from the ATM transactions, with the increasing affordability, as well as sophistication, of personal computers and telecommunication hardware and software, it is more likely that one will soon be accessing a host of information or conducting a variety Of secured transactions using a PC, a modem and a common public switching network, such as Prodigy and Internet, etc. Authentication thus becomes an even more paramount task for the industry to tackle.
A simple personal identification system may address the above problems. Fingerprints have been known years ago to have a high degree of accuracy and reliability. One never forgets her fingerprints, or confuses the fingerprints with other information. Also, a criminal cannot steal or duplicate someone's fingerprints to impersonate the account holder, generally speaking. Therefore, fingerprints are essentially a personal identification with a one-to-one correspondence, given that the fingerprint recognition systems have progressed along with the information revolution. Companies such as Identix and Startech have developed front-end fingerprint image recognition systems to reliably and accurately analyze and recognize fingerprints.
At the back-end, major processor suppliers such as IBM and AT&T already have systems in place to provide a linkup with the fingerprint image recognition systems such that the massive fingerprint database may be linked and accessed for the institution to quickly authenticate the person in front of its machine, or the person seeking to access her brokerage account through a PC with a modem. To a certain extent, the present front-end and back-end suppliers have reached a point, where it is merely a matter of time before their capabilities and achievements can be fully utilized by the industry, especially the financial industry.
Even with reliable fingerprint image recognition systems at the front-end and quick-response processor at the back-end, there are still problems with this paradigm. Assuming it is reasonably affordable for a PC owner to have a personal fingerprint recognition device to provide access to her on-line brokerage account at a brokerage firm with a processor to facilitate authentication, there is still about 1% error rate, generally characterized by false rejection of legitimate users, due to the inherent imperfection of one's fingerprints. For example, if a person regularly works with abrasive chemicals, the quality of her fingerprints tends to deteriorate throughout the years. The degraded quality of the fingerprints, when faced with a security sensitive system as in most security-sensitive transactions, will certainly add to the agony of the users, thus further eroding the public's confidence toward the integrity of future systems.
On the other hand, if the security sensitivity is forced to be compromised to minimize false "rejection", then the error rate of false "acceptance" may increase and vice versa. Conversely, if the security sensitivity is forced to be compromised to minimize false "acceptance," then the error rate of false "rejection" may increase. Now that a half-way decent "match" will allow access erroneously. This is also not something which will contribute to the public's confidence toward fingerprint-based personal identification systems. Nor will it contribute to the industry whose primary application of the fingerprint-based personal identification systems is to protect their business and financial interests.
Furthermore, the creation of an initial file, i.e., when the account holder first sets up her account with her fingerprints at the institution's facility, may not be perfectly analyzed and stored as file data. The possibility of having less than perfect fingerprints on file makes the occurrence of false rejection/acceptance even more likely. For example, if the initial registration has a 90% accuracy, it would always be a 90% accuracy. It would still be a 90% match at best, even with a 100% accurate reading at the ATM at a later time. In other words, both ends of the overall system may contribute to the unreliability of the system.
Therefore, it is desirable to have a personal identification system for use with fingerprint recognition front-ends to raise the percentage of accuracy, thus minimizing the security risks in connection with secured transactions.
It is also desirable to have a personal identification system for taking advantages of the conventional fingerprint recognition devices to provide a flexible solution in light of the various vendors of the front-end and back-end systems.
It is further desirable to have a fingerprint-based personal identification system which will provide an easy-to-use solution to the security issues involved in accessing the information superhighway.