Voice Biometrics Basics - Enrollment

Enrollment is the process of creating a “base” voiceprint for a person. Typically, the person (after their identity is verified) will be prompted to repeat a pass phrase three times. For example, “my voice is my password.” The voice biometrics system captures the person’s data and converts it to a “base” voiceprint. The “base” voiceprint is stored in a database for future use (i.e., identity verification).

Voice Biometrics Basics: Voiceprints

A voiceprint is a mathematical representation of the physical characteristics of a person’s vocal tract (shape and motion patterns). A voiceprint is not an audio recording of a person’s voice.

Components of a Vocal Tract

• Nasal cavity
• Palate
• Soft palate vellum
• Uvula
• Tonsils
• Tongue
• Pharynx
• Epiglottis
• Vocal cords (glottis)
• Larynx
• Esophagus
• Thyroid cartilage
• Hyoid
• Lower jaw
• Lips
• Teeth
• Alveolar ridge
• Upper gums (alveolus)

Voiceprints are unique to each person (similar to fingerprints). A person's identity can be verified by matching a “sample” voiceprint with a “base” voiceprint.

Certified Biometrics Professional Programs

In yesterdays posting, I wrote that several colleges are offering degrees in biometrics. Today, I'd like to make you aware of two options for obtaining certification in biometrics (Note: this is not an endorsement of either program).

The first program, sponsored by the Institute of Electrical and Electronics Engineers, Inc. (IEEE), leads to the designation “Certified Biometrics Professional™.” According to the Website, “to earn the IEEE CBP credential, candidates must pass one rigorous, multiple-choice examination. Individuals who earn the CBP credential will be required to maintain their knowledge and skills by participating in continuing education and professional development activities.”

The exam covers the following topics:

• Biometrics Fundamentals
• Biometric Modalities
• Biometric System Design and Evaluation
• Biometrics Standards
• Social, Cultural and Legal Implications
• Biometrics Applications

Exams are given during two 1-month testing periods. Total fees are $495 for IEEE members and $595 for non-members.

The second program, offered by the Certified Biometrics Security Professional Institute, leads to the designation “Certified Biometrics Security Professional,” “Certified Biometrics Security Engineer” or “Certified Biometrics Solutions Developer.”

The “Certified Biometrics Security Professional” exam covers the following topics:

• Introduction to Biometrics
• Type of Biometrics
• Why Biometrics
• Usage of Biometric Technologies
• Biometrics In Operation
• Biometrics Standards
• Comparison
• Smart Cards
• Multistage Authentication With Biometrics
• Integrating Biometrics with other Technologies
• Privacy and Confidentiality Issues and Concerns
• Biometrics and Security Compliances
• Security Issues
• Basic Biometric Lifecycle
• Risks associated with users of Biometrics systems

Fees start at $995.

I’d be interested to hear if any of you have received any of these certifications.

Looking for a Degree in Biometrics?

Several colleges in the U.S. are now offering degree programs in biometrics. For example, Davenport University and West Virginia University both offer four-year programs.

Biometrics courses offered at Davenport include:
• Biometrics Fundamentals
• Applicable Biometrics
• Biometric Spoofing
• Information Warfare and Security
• Authentication and Audits
• Biometric ID and Privacy Laws
• Credential Hardening
• Biometric Security Architectures
• Advances in Biometric Technologies

West Virginia University appears to be a hub for biometrics research. According to their Website, they house the Center for Identification Technology Research and are the lead academic partner for the FBI’s Biometric Center of Excellence.

Back to school anyone?

Books on amazon.com that Reference Voice Biometrics

Believe it or not, there are 55 books listed on amazon.com that reference voice biometrics. The books range from the very technical to the self-effacing "Biometrics for Dummies." Many of the books look interesting and I look forward to the opportunity to review some of them in the near future.

If you have read any of the books, please feel free to post your comments.

Automated Speaker Verification (Voice Biometrics) - What's Everyone Waiting For?

Automated speaker verification uses voice biometrics to verify a caller’s identity by his or her spoken voice. Voice biometrics measures the person’s vocal tract characteristics (to produce a digitized voiceprint), and is unique to each individual. Voice biometrics is highly accurate, non-invasive and ideal for identity verification over the phone.

Automated speaker verification consists of two processes -- enrollment and verification.

Enrollment:
• Person enrolls (after their identity is verified) by repeating a pass phrase three times (text-dependent approach)

Verification:
• In subsequent calls, enrolled person is prompted by IVR to repeat their pass phrase
• Successful verification allows person to proceed in IVR or transfer to an agent (who is alerted to person’s verification status)

There are four compelling reasons why automated speaker verification should be deployed at call centers:

• Reduces costs
• Increases security
• Enhances customer experience
• Facilitates regulatory compliance

Reduces Costs

In today’s environment, most call centers ask callers a series of challenge questions (e.g., “mother’s maiden name”) to verify their identity. This process typically takes anywhere from 30-60 seconds. Automated speaker verification can do it in less than 5 seconds. Multiply the savings by 100s/1,000s of callers and the productivity gains start to add up. Of course, automating the identity verification process also allows agents to spend more valuable time actually servicing callers.

Increases Security

Identity fraud continues to be a growing problem for consumers and businesses in the United States. Through the use of social engineering techniques such as “pre-texting” or “phishing,” fraudsters can obtain personal information that allows them to assume the identity of another person. This is of particular concern to call centers, as a caller may know the answers to the challenge questions but in fact be an imposter. Automated speaker verification can significantly reduce this threat by ensuring that the caller is actually who they say they are.

Enhances Customer Experience

“Please verify your address.” “What was the name of your first dog?” “Who did you date in fifth grade?”

Automated speaker verification provides a quicker and more user-friendly process for verifying a caller’s identity. For starters, there is no need for the caller to remember or disclose personal information in response to all those annoying challenge questions. Callers get to the service or information they need quicker and spend less time on the call – and that’s a good thing!

Facilitates Regulatory Compliance

Regulations such as FFIEC and HIPAA mandate higher levels of identity verification, known as multi-factor authentication. The three primary factor categories are “something the caller knows” (e.g., account number), “something the caller has” (e.g., hardware token) and “something the caller is” (e.g., person’s voice characteristics). Call centers can use automated speaker verification, combined with another factor (such as account number), to ensure compliance with the multi-factor requirement.

Conclusion

Automated speaker verification is a proven technology which can reduce costs, increase security, enhance the customer experience and facilitate regulatory compliance.

What's everyone waiting for?

Israeli Company Secures Buildings with Voice Biometrics

An Israeli technology company, FST21 Ltd., has developed a unique product ("SafeRise") which combines facial recognition, behavioral patterns and voice biometrics to secure multi-tenant buildings. The application, developed for use by the Israel Defense Force, would replace the need for keys, access cards or codes. Instead, the authorized person would be granted access once their biometric characteristics are verified

According to their Website, FST21 is targeting real estate developers, property management companies, building systems integrators, contractors and architects. SafeRise was installed at a luxury apartment complex (300 units) in Israel at a cost of $100,000.

Very impressive!

Star Trek meets Voice Biometrics?

I recently found what appears to be an obsolete Website page that described a cool voice biometrics product for the consumer market. The application -- "Star Trek: Deep Space Nine Voice Print Security Program" -- was designed to secure home desktops/laptops, and Windows applications, using voice biometrics. The user enrolled their base voiceprint and were granted access if their sample voiceprint matched. If the voiceprints didn't match, the user was rejected and a Star Trek "red alert" shield was displayed along with the "Warning! Intruder alert. Unauthorized user - access denied" sound effect. The Company claimed 99% accuracy.

Countering Voice Biometrics Hacking

Whenever I give a presentation on voice biometrics, invariably, someone in the audience will bring up the 1992 movie “Sneakers.” You may recall that the main character is able to successfully hack a voice biometrics system by recording the authorized individual and splicing together the pass-phrase “my voice is my password.” Of course, this reference always leads to spirited discussion about the risks of hacking voice biometrics.

Fortunately, there are several methods to counter hacking of voice biometrics systems. In an interview with Canadian Security Magazine, I discussed one such approach. It involves asking users to repeat a series of words or numbers during the enrollment process. When the user subsequently accesses the system, they are prompted to repeat a randomly generated sequence of words or numbers. This method works well, as it’s improbable that a hacker would know the random sequence of words or numbers the user will be asked to repeat.

Voice Biometrics Goes to War

Some of the earliest voice biometrics applications were designed for military use. There are multiple ways for the military to deploy voice biometrics. For example, voice biometrics can be used to remotely verify the identity of forward air controllers (these are the folks that direct aircraft to attack enemy positions) when they call in an air strike. Imagine what would happen if an unauthorized individual (e.g., enemy combatant) gains access to the secure forward air controller channel and directs aircraft to attack the good guys. The results would be catastrophic.

I'm sure that there are many other top-secret uses of voice biometrics under consideration by the military. The good news for our industry is that technology that has its origins in military applications often ends up in widespread civilian use.

 

Voice Biometrics Conference - May 4-5, 2010

In 2007, I attended the first-ever Voice Biometrics Conference, presented by opusresearch, in Washington, DC. It was an excellent opportunity to meet and compare notes with every major voice biometrics player in the world.

This year's Voice Biometrics Conference will be held May 4-5 at the Hyatt Regency Hotel in Jersey City, New Jersey. The conference agenda and speakers look first-rate and I highly recommend those interested in voice biometrics attending. I definitely plan to be there and I look forward to meeting all of you.

Registration details are available by clicking here.

Voice Biometrics Enables Mobile Banking

According to an article on TMCnet.com, mobile banking is growing rapidly. Voice biometrics is playing a major role preventing identity fraud and ensuring the security of transactions. One company, VoiceCash Bank is pioneering the delivery of global money transfers, via mobile banking, to millions of expatriate workers throughout the world. The process works as follows:

• All customers enroll by providing a base voiceprint which is linked to their mobile phone number
• Whenever a customer processes a transaction involving a transfer of funds, the automated system calls the customer's mobile phone and asks them to provide a sample voiceprint
• If the voiceprints match, the customer is positively identified and the transaction goes through

This is a very exciting application for voice biometrics!

Who are You? Voice Biometrics Knows for Sure!

Most contact centers rely on a combination of "challenge questions" to verify a caller's identity. Examples of commonly asked questions follow:

What is your mother's maiden name?
What is your address, phone number?
What are the last 4 of your Social Security number?
What is the name of your favorite childhood friend?
What street did you live on growing up?
What was the last name of your favorite childhood teacher?
In what city or town was your first job?
What was the name of your elementary / primary school?
What is the street number of the house you grew up in?
What was the make and model of your first car?
What is the your pet's name?
What is your favorite team?
What is your favorite movie?
In what city were you born?
What is your favorite color?

Contact center agents can't assume that the caller answering the challenge questions correctly is actually who they say they are. For example, the fraudster may be an immediate family member (as shocking as that sounds!) who knows all the answers. Only voice biometrics can positively verify the caller's identity!

Voice Biometrics Can Help Stem the Rising Tide of U.S. Identity-Theft

Identity-theft is on the rise in the U.S., according to recent study by Javelin Strategy and Research (Wall Street Journal -- 2/10/2010). A record 11.1 million adults, up 12% from 2008, were victims. The total cost was $54 billion, up 12.5% from 2008. The article goes on to say that incidents of identity-theft show no signs of decreasing in the foreseeable future.

Voice biometrics can help stem the rising tide of U.S. identity-theft. For starters, financial institutions could deploy voice biometrics in their call centers. Fraudsters, who may have stolen the answers to challenge questions (e.g., mother’s maiden name, date of birth, etc.), would be thwarted when their sample voiceprint is compared to the identity-theft victim’s base voiceprint. Our phones should be ringing off the hook!

Voice Biometrics Monitors Persons on House Arrest, Parole or Probation

Yesterday, we discussed how voice biometrics can be deployed to monitor inmate phone calls from prison. Another related application, is the use of voice biometrics to ensure that persons on house arrest, parole or probation are where they should be, when they say they are. The current approach is to use ankle bracelets to monitor these individuals. However, there is always the potential for these bracelets to be removed and placed on another person or object – rendering them worthless.

The voice biometrics process works as follows. A person who needs to be monitored at home is required to have a land line phone, and provide a base voiceprint. When the person is required to be at home, an automated system calls them, at scheduled or random intervals, and requests a sample voiceprint. If the sample voiceprint matches the base voiceprint, the system is able to verify that the correct individual is where, and when, they should be.

To those of us with teenagers, I can think of some additional applications!

Voice Biometrics Goes to Prison

One of the more unusual applications of voice biometrics is the identification of prison inmates when they make a call. Correctional institutions are required to track all calls made by inmates to prevent and apprehend illegal activity. In most cases, inmates are assigned a calling PIN which they are required to use when they make calls. Some inmates “share” their PIN (voluntarily or involuntarily) with other inmates making it near impossible to accurately track who actually made the call.

Voice biometrics is able to ensure that the inmate making the call is who they say they are. When the inmate first arrives at prison, they provide a base voiceprint. Each time they make a call, their sample voiceprint is compared to their base voiceprint. If they match, the inmate is able to complete their call. Another benefit is the elimination "PIN sharing" -- which increases prison safety.

New Hampshire Seeks to Ban Use of Voice Biometrics

According to an article in SC Magazine, New Hampshire’s Legislatures is considering a bill that, if enacted, would profoundly affect the voice biometrics industry. The bill “would ban the use of ID devices or systems that require the collection or retention of an individual's biometric data” --including, voice biometrics.

New Hampshire claims to be acting out of concern for their citizen’s “privacy.” The fuss all started in 2008, when Bank of America began requiring non-customers to provide a fingerprint as identification, according to the Nashua Telegraph. Bank of America has since rescinded its policy.

New Hampshire is not the first state to consider banning the use of biometrics (including voice), nor will it be the last. Privacy concerns are a serious issue -- with many organizations frightening the public into believing that voice biometrics takes us one step closer to the Orwellian World depicted in “1984.” The voice biometrics industry must continue to address all real and imaginary privacy concerns. I'll have more to say about this in the near future.

Voice Biometrics Prevents Time and Attendance Fraud

Voice biometrics can be deployed to prevent remote employee time and attendance fraud. One of my former clients managed several group homes which were staffed round-the-clock. The client wanted to ensure that the correct employee was on-site when scheduled. Unfortunately, there had been a history of fraud; for example, time card starting/ending times were falsified, etc.

I proposed a solution using voice biometrics. At the start and end of each shift, the group home employee would be required to call an IVR and verify their identity (i.e., provide sample voiceprint). The system was also able to detect the phone number (i.e., group home) the employee was calling from. Problem resolved -- time and attendance fraud eliminated!

Voxeo’s Announcement

Today’s announcement that IVR provider Voxeo will partner with four voice biometrics vendors (CSIdentity, Persay, TradeHarbor and Vocalect) has promise. It offers 100,000 telephony/Web developers, who use Voxeo’s IVR developer portal, the opportunity to develop creative voice biometrics applications for their clients. This move has the potential to mainstream the use of voice biometrics in organizations large and small. The one thing I’m unclear about is how the developers are going to differentiate between the voice biometrics applications offered by the four vendors. Time will tell.

Speech Recognition vs. Speaker Recognition

People often get confused between speech recognition and speaker recognition. Let’s explore the difference.

Simply stated, speech recognition is the ability to recognize what a person is saying. Speaker recognition on the other hand is the ability to identify the person speaking.

Speech recognition has been in use for decades. Today, many organizations have replaced live agents with automated interactive voice response (IVR) systems. The IVRs may prompt users to speak their entries. For example, when calling directory assistance, users are prompted to speak the name of the individual or business that they are inquiring about. The system converts the spoken phrases to text, recites them back to the user for verification, and searches the database for a match.

Speaker recognition is a relatively new technology. Using voice biometrics, a speaker recognition system is able to identify, or verify the identity, of a person who has previously enrolled (i.e., provided a base voiceprint) in the system. A voiceprint is a stored set of measurable characteristics of a human voice that are unique to each individual. A sample voiceprint can be compared to a base voiceprint to identify, or verify the identity, of a person. Speaker recognition is an ideal way to verify the identity of a person remotely (e.g., performing a financial transaction via telephone).

Speaker Verification vs. Speaker Identification

Voice biometrics applications can be classified as speaker verification or speaker identification. Let’s examine the difference.

Speaker verification is a one-to-one process of confirming the identity of an enrolled person. The person provides a sample voiceprint which is compared to their base voiceprint in the database. If the voiceprints match, the person’s identity is verified (accepted), if they don’t match, the person’s identity is not verified (rejected). Most commercial applications are classified as speaker verification.

Speaker identification is a one-to-many process of determining the identity of an unknown person. The person provides a sample voiceprint which is compared to all of the base voiceprints in the database. If there is a match, the person is identified; if there is no match, the person is not identified. Speaker identification has been successfully used in law enforcement and intelligence applications.

Article about Voiceprints in Life Magazine - September 28, 1962

On September 28, 1962, Life Magazine published the following fascinating article about voiceprints:

"Device picks Jack from all the pack"

"The Kennedy mimics may sound just like the President to people, but they do not fool a highly sensitive machine which makes voice-prints that may be as infallible in identifying individuals as fingerprints are. The device was developed by Bell Telephone for a very serious purpose: to help law-enforcement agencies identify persons who have been heard but not seen. The tape of a voice, perhaps recorded on the phone or by wiretapping, is fed to a stylus which transcribes electronic impulses into squiggly graphs. The squiggles trace volume, resonance and pitch which are never the same for any two people. As the voice-prints at left and below show, the machine can unmask even the cleverest of imitators."

An accompanying caption mentions that the voiceprint technique was created by Dr. Lawrence Kersta of Bell Laboratories. Check out this video.

Early History of Voice Biometrics

Most people think of voice biometrics as a relatively new technology. However, according to a 2004 article by Lisa Myers (SANS Institute), the history of voice biometrics actually began in 1867. At that time, Alexander Graham Bell’s father began work on developing an early voiceprint. Jumping ahead to World War 2, the same article mentions the pioneering work by Bell Telephone Labs on spectrograms. The concept was to identify a specific enemy’s voice and track their movements by the location of their radio transmissions. Apparently, the technology did not work very well.

Fast forward two decades. According to the National Science and Technology Council, in 1960, a Swedish professor, Gunnar Fant, published a ground-breaking model describing the physiological components of acoustic speech production. Fant’s model was expanded in 1970, by Dr. Joseph Perkell, to include the tongue and jaw. In 1976, Texas Instruments developed a prototype voice biometrics system that was tested by the United States Air Force and Mitre Corporation. Voice biometrics was on its way!

Why are Help Desk Agents Still Resetting Passwords?

I’ve seen estimates that 40%+ of help desk transactions are password reset related. Voice biometrics can enable users to reset their own passwords without help desk intervention. Automated self-service password reset applications provide significant benefits to the IT organization, including:

1) Reduces costs – no need for live agent
2) Improves service – available 24/7, never a wait for a live agent and faster service
3) Increases security – voice biometrics is more secure than challenge questions to verify a user’s identity questions

Automated password resets is a relatively simple process. The user calls the help desk IVR, selects the password reset option, enters one factor of authentication (e.g., account number) and validates their identity by providing a voiceprint sample. Once the user's identity is verified, the system generates a new password and either emails or speaks it over the phone.

Three Good Reasons Why Call Centers Should Use Automated Speaker Verification

Call centers should all be using automated speaker verification (voice biometrics) in conjunction with their IVR systems. Here are three reasons why:

1) May reduce operating costs (e.g., eliminates the need for agent-led, manual verification of callers -- savings of 20-40 seconds per call)
2) Improves customer service (gets the caller to the service or information they need quicker)
3) Enhances security (reduces potential fraud due to social engineering)

Also, financial institutions and health care providers can satisfy multi-factor compliance by using voice biometrics.

Voice Biometrics – Text-Dependent vs. Text-Independent

Voice biometrics systems come in two flavors: text-dependent and text-independent.

Let’s explore the difference…

Text-dependent systems require a person to speak the same pass phrase(s) during enrollment and identity verification. The system compares the base voiceprint from enrollment with the sample voiceprint from verification. The majority of voice biometrics systems are text dependent.

Text–independent systems do not require a person to speak a specific pass phrase during enrollment and verification. The base voiceprint and sample voiceprint can be obtained in the background – even without the person’s knowledge (ideal for forensic applications). Text-independent systems usually require a longer enrollment process to ensure verification accuracy.

Advantages of Voice Biometrics

Before reviewing the advantages of voice biometrics over other biometrics (fingerprints, etc.), let’s take a quick look at the advantages of using any biometric to verify a person’s identity:

1) Only biometrics can verify that a person is actually who they claim to be
2) Passwords can be: forgotten, shared, observed and broken
3) Security tokens (smart cards, etc.) can be: lost, stolen, duplicated (some) and forgotten

Voice biometrics compared to other biometrics is:

1) User-friendly - speaking is natural and requires no special effort
2) Cost effective - verification is accomplished via telephone or microphone
3) Convenient - enables remote verification of a person’s identity
4) Secure – highly accurate