Mobile Biometrics for Authentication and Authorization

Enterprises face constant cyber-attacks targeting financial data, PII, health records, government information, and intellectual property. As digital identity becomes the new perimeter, authentication functions as the gateway, yet password-based authentication remains widespread despite being inadequate. Passwords are forgettable, reset processes are costly, and compromise of usernames/passwords underlies many major breaches. Organizations must satisfy overlapping regulatory requirements (e.g., GDPR, PSD2, PCI-DSS, HIPAA, SOx) and internal policies while also enabling cross-enterprise collaboration, SaaS/IaaS adoption, and secure use of mobile devices, including BYOD. Because authorization depends on authentication, assurance levels directly affect what actions users may perform.

Biometrics and mobile authentication are positioned as practical alternatives. Five major biometric categories are discussed: fingerprint, facial, voice, iris, and behavioral. Implementers must evaluate usability and security using FAR, FRR, and EER; lower EER indicates higher accuracy. “Liveness detection” is essential for pattern-matching biometrics to mitigate spoofing via photos or recordings. Each biometric has distinct constraints: fingerprints can fail with wet skin or older users; face recognition varies with lighting and appearance changes and cannot distinguish identical twins; iris recognition offers high uniqueness and stability over time; voice recognition is affected by noise and user condition; behavioral biometrics support continuous authentication but are probabilistic and raise potential policy/legal concerns if data resembles keylogging.

Smartphones can serve as identity platforms using Secure Elements and Trusted Execution Environments. Mobile push/out-of-band verification adds a second channel for transaction confirmation. Derived PKI Credentials extend PKI to mobile with NIST LOA 3/4 guidance and GlobalPlatform standards for secure storage/execution. Standards—especially FIDO and GlobalPlatform—are emphasized to reduce lock-in, improve interoperability, preserve privacy, and enable a gradual phase-out of passwords, while calling for more independent biometric testing and measurement standards.

• Enterprises are attacked daily, with targets including financial information, PII, patient health information, government data, and intellectual property.
• Password resets impose costs through help desk workload and lost productivity.
• Apple stated in 2013 that Touch ID had a False Acceptance Rate of 1:50,000.
• Facial recognition cannot distinguish between identical twins.
• Iris patterns are formed randomly during embryonic gestation, so identical twins do not share the same iris patterns.
• Irises have 266 degrees of freedom, meaning 266 analyzable features.
• Iris recognition has the lowest Failure to Enroll Rate among the biometric solutions described.
• In a cited NIST test example, NEC’s facial recognition algorithm achieved a 2.1% FAR and 0.1% FRR.
• FIDO Alliance has more than 250 members across industries.
• As of 2015, twenty-one European countries were using electronic ID (eID) cards, and twenty of them wanted to use eIDs for authentication, authorization, and digital signatures to hundreds of thousands of online services.

• “If digital identity is the new perimeter, then authentication is the gateway.”
• “There is no such thing as a strong password.”
• “Biometrics are not a panacea, and face different kinds of threats and risks.”
• “FAR is how often an impostor could trick the mechanism into wrongfully allowing access.”
• “Iris scanning technology can distinguish between identical twins”
• “Check with legal counsel before deploying behavioral biometrics”
• “Users appreciate the value of mobile push apps for transaction verification”
• “Where users want mobility, CISOs want security.”
• “More international standards for biometric measurements are needed”
• “To prevent spoofing, use liveness detection”