Mobile ID World president Peter O’Neill recently conducted an interview with Jeff Harris, senior vise president of ImageWare Systems. The conversation begins with some background on the biometric identity services company before looking at its recent CTIA award and Harris’ thoughts on the ongoing debate over authenticating on-device and in-the cloud.
Peter O’Neill, President, Mobile ID World (MIDW): Can you please provide our readers with a brief background of the company?
Jeff Harris, SVP, ImageWare Systems (IWS): Between new login convenience tools like single sign on (SSO), requests for password resets, and even stolen identities, how do you know that the person requesting access is genuine? Biometrics is the most reliable and secure method to verify a person’s identity prior to granting them access.
ImageWare Systems, Inc. is a leading provider of biometric-based identity enrollment, management, and verification services. Our core product GoCloudID, powered by our unique IWS Biometric Engine, offers Biometric Identity Verification Software as a Service. We enable customers to verify user identities before they access their network, their applications, or their sensitive data.
IWS offers a family of mobile and fixed-station biometric enrollment and identity verification applications connected to a secure cloud-based biometric matching engine. Customers requesting identity verification for their SSO or active directory users, to verify financial transactions, records release approvals, or even a sensitive data folder or document, can all leverage our biometric platform. Our mobile client application, GoVerifyID, makes enrollment and identity verification fast and easy on virtually any modern smart device. It requires no special hardware or user configuration.
ImageWare is the only biometric identity management company in the market capable of supporting virtually any biometric modality, offering multi-biometric fusion, and securely storing and matching biometric data in the cloud anonymously. Multi-modal fusion capable of continuously leveraging the latest best-in-class biometric algorithms from the widest range of vendors, and secure anonymous storage of biometric data – that is what we do.
MIDW: You recently won an award from the CTIA-The Wireless Association, for your GoMobile Interactive product. Can you please tell us about the product and the award?
IWS: CTIA is an international authority in the wireless and cloud markets. Their membership is a who’s who of the industry, so to be selected as “Best in Class” in their emerging technology area for securing mobile payments is quite exciting. GoMobile Interactive is the mobility-enabling engine we connect to our GoCloudID identity verification engine. It is what allows us to securely and anonymously connect our GoVerifyID mobile enrollment and verification client application to our GoCloudID biometric storage repository. Together they enable banking transactions to be reliably and securely verified with biometrics using an innovative out-of-band method. When a bank receives what they believe is a questionable financial transaction, their server can request their user be biometrically verified by sending a message to GoMobile Interactive’s API. The customer, who had already downloaded our GoVerifyID application and enrolled their face and voice, will receive a text message from GoMobile Interactive requesting both face and voice identity verification. The customer will capture an image of their face and speak their pass phrase on their smartphone, the match occurs in the cloud, and bank server receives the transaction approval. GoMobile Interactive is part of ImageWare’s GoVerifyID SDK and is going to be a very powerful resource for reducing fraud in the banking and mobile payment industry.
MIDW: You mentioned the GoMobile product and your cloud service, can you run through your full product lineup for us?
IWS: At the heart of IWS’ product offering is GoCloudID, our cloud-based biometric management and identity verification service. GoCloudID contains our patented Biometric Engine that securely and anonymously stores and matches customer biometrics in the cloud. GoCloudID can store as many biometrics as a customer desires and thanks to our patented multi-modal fusion, IWS is the only company able to offer both single biometric verification AND multi-biometric fusion, the industry’s highest identity verification assurance method. Connecting to GoCloudID are our client applications, the most popular of which is our GoVerifyID. Soon to be downloadable directly from the Apple and Google Play sites, GoVerifyID can be tied directly to a customer’s account for enrollment and verification of face and voice biometrics. It is simple, quick, and easy to use for applications capable of leveraging biometric sensors found on typical modern mobile devices, such as cameras and microphones. Thanks to big strides from our partner, Fujitsu, IRIS cameras are scheduled to enter the market in 2015 as well. In addition to our mobile clients, we also offer a series of PC-based client applications when customers want to employ non-mobile biometric modalities requiring special sensors, such as DNA, heart rhythm, etc. GoVerifyID offers complete out-of-band identity verification for any application. Customers love it because not only can GoVerifyID verify a user’s identity quickly and accurately, but our patented two-way push-messaging can make each message have the customer’s look and feel. Your bank transaction request will arrive in your bank’s logos, fonts, and colors while your corporate password reset request will come in using your company colors, fonts, and logo. We can even send customized interactive surveys using the same push-messaging channel. It is an exciting capability.
MIDW: There has been a fair bit of debate regarding cloud versus on-device biometric mobile solutions; can I get your view on this debate? Obviously you are moving to the cloud method.
IWS: If you are looking at biometrics as a ‘convenience feature’, then on-device makes a lot of sense. There are lots of times when your device is not connected to the cloud and you still need access. Where the debate looms is when biometrics are desired as a ‘security feature.’ When it comes to security, there are several reasons why ImageWare’s cloud-based storage will be more robust and more secure than on-device approaches. Let’s take the example where a single biometric is used to approve a financial transaction:
- In the on-device case, a request from a bank server connects directly to a user’s mobile device asking them to authenticate using a biometric. The user, who previously enrolled their fingerprint on the device, is asked to authenticate. They do and a ‘yes’ is sent back to the requesting server.
- In our case, a request comes to GoCloudID from the bank asking for identity verification for a record number. GoCloudID does not know to whom that record belongs to – only a biometric stored with a registered push message ID number that came when they initially enrolled. GoCloudID sends a verification request to that ID number and that user receives a text message asking them to verify with their enrolled biometric. They use their face or voice to verify and the match is completed anonymously in the cloud, resulting in a secure match approval back to the bank.
- Which case sounds more secure?
Unfortunately, no single biometric works all the time. In noisy environments, voice can experience errors. In dark environments, face recognition is not as effective. When hands are wet or a finger is injured, fingerprints can fail. No single biometric will give you a 100 percent match, but fusing the results from multiple biometrics provides a much higher probability and higher assurance match. This is where match in the cloud is significantly more secure than on-device.
Finally, there is the concept of future-proofing. When the biometric industry started, the focus was primarily on creating better sensors. Biometric recognition algorithms were always embedded inside the hardware solution. As new capabilities were developed, upgrading meant customers often had to rip out their existing biometric solution and replace it. GoCloudID is designed to take advantage of new biometric algorithm developments and integrate them without impacting the end users. As biometrics become part of SSO systems, banking transaction approvals, password resets, and more, would you feel more secure using a single biometric on your phone, that you have to re-enroll every two years when you upgrade devices? Or is an anonymously stored set of biometrics that provides high-reliability fused identity verification results and takes advantage of hardware improvements automatically as they come on the scene, a better choice?
MIDW: Well thank you Jeff, I think you summarized that really well and having just returned from the Mobile World Congress in Barcelona, certainly cloud is playing a critical role in what I saw there. And speaking of all the different vertical markets that are now being affected by all this growth in mobility, which vertical markets are you focusing on?
IWS: With the exponential increase in cybercrime the past few years, the need for identity verification has never been more pronounced. This past year, retail, banking, and health records were all hit hard by cybercriminals. Add to this the expansion of SSO capabilities to make logging-in easier, and you see the major pain points in the markets. Finance, healthcare, and of course, IT will all gain huge benefits from improved user authentication. There are over 1400 Jeff Harris’ on LinkedIn alone and I do not want any of them accessing my medical or financial records. Of the 1 billion identities stolen in 2014 alone, I am sure mine was in there somewhere, and IWS does not want any of them accessing our corporate network either. Biometric verification provides the highest assurance to secure all of these points of access, and our IWS team will not rest until they are all secure.
MIDW: Thank you very much Jeff. It is fascinating what is going on in the marketplace with mobility being the major driver. Congratulations again on your award from the CTIA and I look forward to hearing more on ImageWare’s progress over the coming year.
IWS: Thank you so much, Peter. We are excited to be at the crossroads where the rapid advancements in mobility are helping accelerate the rollout of a security protection that will make all of us feel more secure.