New Security System Based On Flawed Assumption

The news story that is the subject of this blog talks about a new security system that tracks eye movements. The creators claim this system can be used to identify people uniquely because the way the eyes move is unique.

While it is most likely true the movements of the eye are unique, the assumption that the eye movements will never change is false. The movements of the eyes can be changed. A human being who changed the way their eye moves would not match the previously recorded eye movements that were on file.

Assuming that eye movements cannot be changed and can therefore be used for identification is a flawed assumption. 

The original news story is copied below


What if you could be recognized by the way your eyes moved? An Israeli company believes that tracking the unique signatures in the movement of your eyeballs could be the most foolproof biometric system ever. What’s more, its setup could be used as a lie detector, or a drug and alcohol test.

In ID-U Biometrics’ system, the user has to watch a moving object onscreen, while the camera observes the motion of their eyes. Since the way our eyes move is based on a combination of factors –such as anatomy, physiology, behavioral characteristics, eye structure–it’s a signature that simply can’t be duplicated or forged, according to its developers.

Dr. Daphna Palti-Wasserman, CEO of ID-U Biometrics, says she designed the system by drawing up a wish list for the ultimate identification technology. “We explored the possible human signals and mechanisms that could deliver our dream biometrics,” she told¬†Fast Company. “It brought us to the visual system and to the dynamic approach.”

This approach differs radically from eye-related biometrics we’ve written about previously, such as iris scanning. Iris scanning systems rely on matching the image of your iris structure with a stored pattern of your iris. In contrast, the pattern the ID-U technology is based on consists of dynamic movements made by your eyes as they track a target, something that cannot be controlled or learned. “Most of the eye movement components are involuntary, and we are not aware of them at all,” says Palti-Wasserman.

The system requires only a screen, a camera and the ID-U software to obtain the identification signature. It can authenticate the user in as little as four to fifteen seconds and has a two percent error rate. Since it requires no specialized hardware, it can be easily deployed across a variety of platforms from homeland security applications to ATM transactions. It could one day replace conventional passwords in smartphones and PCs.

The system still has its skeptics. “The idea is novel, but untested,” says Dr Barrett Katz, Professor of Ophthalmology, Neurology & Neurosurgery, Albert Einstein College of Medicine. “I know of nothing in the literature that delineates uniqueness to eye tracking patterns. The eye movements would be re-fixation saccades [extremely fast, ballistic eye movements], and could easily be suppressed.”

Palti-Wasserman believes that we do not control our saccades–and says she has three years of tests to prove it. Professor Moshe Gur, Associate Professor of Biomedical Engineering at Technion, Israel Institute of Technology, who conducted an independent study of the system, agrees. “Don’t we have typical running or dancing styles?” he asks. “Executing eye movements is a complex task involving many muscles and millions of neurons. It is no wonder that individuals will have different patterns of movements.”

Another controversial feature of the technology: it can tell when you’re stressed, tired, drugged or drunk, since these factors affect your eye movements. Palti-Wasserman says she spent years selecting ‘good’ features from thousands of features that they extracted from the eye tracking signal to locate those were not affected by fatigue, migraine, stress, or alcohol.

However users needn’t worry at any point about whether their ATM’s will one day detect how many beers they’ve had. While the core technology will be the same, different stimuli and data analysis methodologies are used for detecting drunkenness or other features. So when the system is developed further, each will be a stand-alone application.

While the promise of the technology is exciting–it was the winner of the European Regional Finals of the best security start-up of the Global Security Challenge 2010–the next step is more independent analysis and demonstrations for those skeptical experts. “Their hypothesis has yet to be tested,” says Katz. “Eye movements and tracking patterns of man can be measured–they have been, for years–but what this technology offers in terms of incremental change or disruption is yet to be demonstrated.”

Leave a Reply

Your email address will not be published. Required fields are marked *