Giving access management a voice

The term 'biometrics' used to conjure images of top secret security missions in action films. There is some truth in this, as voice biometrics have been in use by military and police intelligence agencies around the world for years, and have become an integral part of many such operations.

This technology has now matured to the point where thinking has shifted from “what if” to “how to”, as voice biometrics is deployed across a whole host of real-life scenarios.

The flexibility of this identification tool lends itself to some particularly innovative applications, such as an access control tool for miners, whose fingerprints are often not usable in biometric devices, and the monitoring of inmates under house arrest. Because of its proven efficacy across language and accent differences, voice biometrics are emerging as a potential means of curtailing the fraudulent use of credit cards over the Internet.

One of its most popular business applications is as a customer interaction solution, where voice biometrics offers realistic and affordable means of enhancing security, adding value and trimming costs associated with customer service.

Simon Cranswick, General Manager for Dimension Data Customer Interactive Solutions in the Western Cape, supports voice biometrics as an ideal business solution. “It not only addresses a need for tighter security, but also business objectives around cost containment and increasing efficiencies and convenience,” says Cranswick.

To this end, Dimension Data South Africa has recently developed voice biometrics solutions for kiosk, iPhone and PC applications using data networks and a graphics user interface. This has extended the functionality beyond contact centre and IVR (interactive voice response) self-service applications to effectively securing access to corporate systems, Web sites and buildings.

A voice biometric is the unique representation of the characteristics of an individual's vocal tract. To produce sound, air from your lungs is passed through one or more 'resonators' ie, your larynx, nose and mouth. Similar to a fingerprint, these physical components combine to produce a unique sound which can be analysed, measured and stored. This 'voiceprint' forms the basis of voice biometric technology.

To use a voiceprint as a means of identification, a sample of speech is analysed as part of an enrolment process. Measurements are taken from the sample and the results entered into a complex algorithm. “It is a common misconception that the audio sample itself is stored,” says Cranswick. “This unique algorithm is actually what is encrypted and securely stored. Since each algorithm only takes up just a few kb's of space, it's extremely economical.”

To verify identity, a new sample of speech is analysed and the measurement process is repeated. If the result of the calculation matches the result obtained during enrolment, then identity can be confirmed. While a fingerprint has approximately 40 unique characteristics, a voiceprint has over 100 such characteristics, making it an extremely secure means of verification. The reliability of voice biometrics has been proven to be at least on par with that of fingerprints.

Identity theft has become one of the fastest growing crimes in the world, and many countries are investigating instituting compulsory multifactor authentication as a counter measure. But even this is not foolproof. Identification and recognition methods such as challenge questions and PIN (personal identification number) codes have become the conventionally accepted means of access control to sensitive data. However, their inability to verify physical identity over the phone means that criminals can gain access to information, such as financial accounts, through legitimate means, simply by having a few personal details on their target.

As technology develops it will become even easier for criminals to assume the identity of customers over the phone, and there is little a company can do if the person on the end of the line answers security questions correctly. Voice, unlike other biometrics, does not require physical proximity, which makes it ideal for remote authentication. It also utilises existing telephony channels and fixed line and wireless data networks. As a phone-centric model, no additional hardware is required, other than a telephone or a microphone for voice identification.

In addition, voice offers a high degree of user acceptance as speaking is a natural process that we do every day. Voice authentication doesn't call for any unusual behaviour during either the enrolment or verification stages, making it an unobtrusive way of verifying identity - and one that is nearly impossible to forge.

Implementing voice as part of a two-part verification process looks set to put a significant damper on fraudulent activity. Its strong business case has seen a global rise in the adoption of voice biometrics by financial services and telcos seeking to mitigate the risk and costs of conventional PIN systems.

“The next time you are asked to provide a PIN, password or your mother's maiden name as a form of identification, think about how easy it would be for someone to obtain this information, then think about how difficult it would be to obtain your voice print,” says Cranswick.