Eye-tracking biometricsNew biometric system harder to fool than other approaches

The way you view the world is unique, so a company in Israel has developed a security system that exploits a person’s unique pattern of eye movements to identify them. Most biometric security systems measure physical features that are constant, such as fingerprints or iris patterns. An eye-tracking system has the potential to be harder to fool and easier use, its creators say.

Duncan Graham-Rowe writes that the new system tracks the way a person’s eye moves as he watches an icon roam around a computer screen. The way the icon moves can be different every time, but the user’s eye movements include “kinetic features” — slight variations in trajectory — which are unique, making it possible to identify him.

This is less complicated than using a long pass phrase or a smart card to gain access to a computer system or a building.

“The interface is really very simple,” says Daphna Palti-Wasserman, CEO of ID-U Biometrics, the company that developed the technology. “The user watches a target moving on a screen and a camera monitors their eye movement responses.”

Eye tracking also requires no specialist hardware, other than a camera and a display, so it is cheaper and easier to deploy, Palti-Wasserman says. Using a standard video camera, the system can identify users with an accuracy of 97 percent, she says. Many cell phones and laptops already have this kind of hardware, so ID-U’s system could be deployed widely for both desktop and mobile computing. The company is currently working on an app for the iPhone 4.

Other biometric systems can be fooled by a very accurate copy of, for example, a fingerprint or retina. This new system uses a biometric pattern that’s very hard to copy, Palti-Wasserman says. “What we’re doing is a challenge-response sequence,” she says. “The whole process depends on what is being shown on the screen,” she says.

Kevin Bowyer, a biometrics expert at the University of Notre Dame, notes that some voice, keystroke, and handwriting-based security systems already use a challenge-response approach. “The main advantage is to control the situation more in order to get better information and improve the confidence in your results,” he says.

ID-U’s system moves an icon across a screen in a way that elicits about a dozen distinct characteristics as the viewer’s eyes move. These tiny movements are sampled 30 times a second. “When the target jumps, it activates specific mechanisms of eye movement, but when it moves smoothly or slowly, different mechanisms are activated,” says Palti-Wasserman. ID-U will not reveal precisely which metrics its system uses, but Palti-Wasserman says it is analogous to watching the trajectories of two different people driving around the same track — they follow the same route, but there will be distinct differences.

Bowyer says the biometric system will need to be tested on hundreds of different people, with significant time intervals between tests, to prove it is reliable. “There are lots of cases of people getting great performance numbers when they bring a set of people in and take several images of them in one session,” he says. “But then if they took the same number of images at weekly or monthly intervals, the performance drops drastically.”