Voice Biometrics Basics - Enrollment

Enrollment is the process of creating a “base” voiceprint for a person. Typically, the person (after their identity is verified) will be prompted to repeat a pass phrase three times. For example, “my voice is my password.” The voice biometrics system captures the person’s data and converts it to a “base” voiceprint. The “base” voiceprint is stored in a database for future use (i.e., identity verification).

Voice Biometrics Basics: Voiceprints

A voiceprint is a mathematical representation of the physical characteristics of a person’s vocal tract (shape and motion patterns). A voiceprint is not an audio recording of a person’s voice.

Components of a Vocal Tract

• Nasal cavity
• Palate
• Soft palate vellum
• Uvula
• Tonsils
• Tongue
• Pharynx
• Epiglottis
• Vocal cords (glottis)
• Larynx
• Esophagus
• Thyroid cartilage
• Hyoid
• Lower jaw
• Lips
• Teeth
• Alveolar ridge
• Upper gums (alveolus)

Voiceprints are unique to each person (similar to fingerprints). A person's identity can be verified by matching a “sample” voiceprint with a “base” voiceprint.

Star Trek meets Voice Biometrics?

I recently found what appears to be an obsolete Website page that described a cool voice biometrics product for the consumer market. The application -- "Star Trek: Deep Space Nine Voice Print Security Program" -- was designed to secure home desktops/laptops, and Windows applications, using voice biometrics. The user enrolled their base voiceprint and were granted access if their sample voiceprint matched. If the voiceprints didn't match, the user was rejected and a Star Trek "red alert" shield was displayed along with the "Warning! Intruder alert. Unauthorized user - access denied" sound effect. The Company claimed 99% accuracy.

Countering Voice Biometrics Hacking

Whenever I give a presentation on voice biometrics, invariably, someone in the audience will bring up the 1992 movie “Sneakers.” You may recall that the main character is able to successfully hack a voice biometrics system by recording the authorized individual and splicing together the pass-phrase “my voice is my password.” Of course, this reference always leads to spirited discussion about the risks of hacking voice biometrics.

Fortunately, there are several methods to counter hacking of voice biometrics systems. In an interview with Canadian Security Magazine, I discussed one such approach. It involves asking users to repeat a series of words or numbers during the enrollment process. When the user subsequently accesses the system, they are prompted to repeat a randomly generated sequence of words or numbers. This method works well, as it’s improbable that a hacker would know the random sequence of words or numbers the user will be asked to repeat.

Voice Biometrics Enables Mobile Banking

According to an article on TMCnet.com, mobile banking is growing rapidly. Voice biometrics is playing a major role preventing identity fraud and ensuring the security of transactions. One company, VoiceCash Bank is pioneering the delivery of global money transfers, via mobile banking, to millions of expatriate workers throughout the world. The process works as follows:

• All customers enroll by providing a base voiceprint which is linked to their mobile phone number
• Whenever a customer processes a transaction involving a transfer of funds, the automated system calls the customer's mobile phone and asks them to provide a sample voiceprint
• If the voiceprints match, the customer is positively identified and the transaction goes through

This is a very exciting application for voice biometrics!

Voice Biometrics Can Help Stem the Rising Tide of U.S. Identity-Theft

Identity-theft is on the rise in the U.S., according to recent study by Javelin Strategy and Research (Wall Street Journal -- 2/10/2010). A record 11.1 million adults, up 12% from 2008, were victims. The total cost was $54 billion, up 12.5% from 2008. The article goes on to say that incidents of identity-theft show no signs of decreasing in the foreseeable future.

Voice biometrics can help stem the rising tide of U.S. identity-theft. For starters, financial institutions could deploy voice biometrics in their call centers. Fraudsters, who may have stolen the answers to challenge questions (e.g., mother’s maiden name, date of birth, etc.), would be thwarted when their sample voiceprint is compared to the identity-theft victim’s base voiceprint. Our phones should be ringing off the hook!

Voice Biometrics Monitors Persons on House Arrest, Parole or Probation

Yesterday, we discussed how voice biometrics can be deployed to monitor inmate phone calls from prison. Another related application, is the use of voice biometrics to ensure that persons on house arrest, parole or probation are where they should be, when they say they are. The current approach is to use ankle bracelets to monitor these individuals. However, there is always the potential for these bracelets to be removed and placed on another person or object – rendering them worthless.

The voice biometrics process works as follows. A person who needs to be monitored at home is required to have a land line phone, and provide a base voiceprint. When the person is required to be at home, an automated system calls them, at scheduled or random intervals, and requests a sample voiceprint. If the sample voiceprint matches the base voiceprint, the system is able to verify that the correct individual is where, and when, they should be.

To those of us with teenagers, I can think of some additional applications!

Voice Biometrics Prevents Time and Attendance Fraud

Voice biometrics can be deployed to prevent remote employee time and attendance fraud. One of my former clients managed several group homes which were staffed round-the-clock. The client wanted to ensure that the correct employee was on-site when scheduled. Unfortunately, there had been a history of fraud; for example, time card starting/ending times were falsified, etc.

I proposed a solution using voice biometrics. At the start and end of each shift, the group home employee would be required to call an IVR and verify their identity (i.e., provide sample voiceprint). The system was also able to detect the phone number (i.e., group home) the employee was calling from. Problem resolved -- time and attendance fraud eliminated!

Speech Recognition vs. Speaker Recognition

People often get confused between speech recognition and speaker recognition. Let’s explore the difference.

Simply stated, speech recognition is the ability to recognize what a person is saying. Speaker recognition on the other hand is the ability to identify the person speaking.

Speech recognition has been in use for decades. Today, many organizations have replaced live agents with automated interactive voice response (IVR) systems. The IVRs may prompt users to speak their entries. For example, when calling directory assistance, users are prompted to speak the name of the individual or business that they are inquiring about. The system converts the spoken phrases to text, recites them back to the user for verification, and searches the database for a match.

Speaker recognition is a relatively new technology. Using voice biometrics, a speaker recognition system is able to identify, or verify the identity, of a person who has previously enrolled (i.e., provided a base voiceprint) in the system. A voiceprint is a stored set of measurable characteristics of a human voice that are unique to each individual. A sample voiceprint can be compared to a base voiceprint to identify, or verify the identity, of a person. Speaker recognition is an ideal way to verify the identity of a person remotely (e.g., performing a financial transaction via telephone).

Speaker Verification vs. Speaker Identification

Voice biometrics applications can be classified as speaker verification or speaker identification. Let’s examine the difference.

Speaker verification is a one-to-one process of confirming the identity of an enrolled person. The person provides a sample voiceprint which is compared to their base voiceprint in the database. If the voiceprints match, the person’s identity is verified (accepted), if they don’t match, the person’s identity is not verified (rejected). Most commercial applications are classified as speaker verification.

Speaker identification is a one-to-many process of determining the identity of an unknown person. The person provides a sample voiceprint which is compared to all of the base voiceprints in the database. If there is a match, the person is identified; if there is no match, the person is not identified. Speaker identification has been successfully used in law enforcement and intelligence applications.

Article about Voiceprints in Life Magazine - September 28, 1962

On September 28, 1962, Life Magazine published the following fascinating article about voiceprints:

"Device picks Jack from all the pack"

"The Kennedy mimics may sound just like the President to people, but they do not fool a highly sensitive machine which makes voice-prints that may be as infallible in identifying individuals as fingerprints are. The device was developed by Bell Telephone for a very serious purpose: to help law-enforcement agencies identify persons who have been heard but not seen. The tape of a voice, perhaps recorded on the phone or by wiretapping, is fed to a stylus which transcribes electronic impulses into squiggly graphs. The squiggles trace volume, resonance and pitch which are never the same for any two people. As the voice-prints at left and below show, the machine can unmask even the cleverest of imitators."

An accompanying caption mentions that the voiceprint technique was created by Dr. Lawrence Kersta of Bell Laboratories. Check out this video.

Why are Help Desk Agents Still Resetting Passwords?

I’ve seen estimates that 40%+ of help desk transactions are password reset related. Voice biometrics can enable users to reset their own passwords without help desk intervention. Automated self-service password reset applications provide significant benefits to the IT organization, including:

1) Reduces costs – no need for live agent
2) Improves service – available 24/7, never a wait for a live agent and faster service
3) Increases security – voice biometrics is more secure than challenge questions to verify a user’s identity questions

Automated password resets is a relatively simple process. The user calls the help desk IVR, selects the password reset option, enters one factor of authentication (e.g., account number) and validates their identity by providing a voiceprint sample. Once the user's identity is verified, the system generates a new password and either emails or speaks it over the phone.

Voice Biometrics – Text-Dependent vs. Text-Independent

Voice biometrics systems come in two flavors: text-dependent and text-independent.

Let’s explore the difference…

Text-dependent systems require a person to speak the same pass phrase(s) during enrollment and identity verification. The system compares the base voiceprint from enrollment with the sample voiceprint from verification. The majority of voice biometrics systems are text dependent.

Text–independent systems do not require a person to speak a specific pass phrase during enrollment and verification. The base voiceprint and sample voiceprint can be obtained in the background – even without the person’s knowledge (ideal for forensic applications). Text-independent systems usually require a longer enrollment process to ensure verification accuracy.

Voice Biometrics Process

The voice biometrics process is relatively simple...

Enrollment:

1. Person repeats a pass phrase three times (creates "base" voiceprint)
2. Base voiceprint is saved in the database

Verification:

1. Enrolled person repeats a pass phrase (creates "sample" voiceprint)
2. The "sample" voiceprint is compared to the "base" voiceprint
3. If the voiceprints match (based on a probability score), the person’s identity is verified
4. If the voiceprints don’t match, the person is directed to an alternate business process

Voice Biometrics Defined

Voice biometrics is the measurement of the unique characteristics of an individual’s voice. These characteristics, which are based on an individual’s vocal tract shape and motion patterns, are converted into a mathematical formula known as a voiceprint. This is accomplished by acquiring a live voice sample from an individual and applying a specialized algorithm to convert the sample into a digitized "base" voiceprint.

The voice biometric identity verification process is conceptually similar to comparing fingerprints, and no two voiceprints are exactly the same. By comparing a "sample" voiceprint with the "base" voiceprint, one is able to positively verify the identity of any enrolled individual.