For security, Fujitsu talks to the hand

Computerworld - Fujitsu Computer Products of America, Inc. on Wednesday announced the global launch of its PalmSecure biometric authentication system. The contactless system identifies users by examining the layout of the veins in the palms of their hands.

The PalmSecure device uses a near-infrared beam, similar to that used by television remote controls, to map the layout of veins carrying oxygen-depleted blood back to the heart. According to Joel Hagberg, vice president of marketing and business development for Fujitsu, those vein patterns are unique in every person -- even more so than fingerprints or DNA.

The PalmSource scanner, which is a bit larger than a mobile phone, can be incorporated into dedicated hardware such as ATMs, or connected to a network via USB. Several versions of the scanner include "grips" to help users steady the hand during the 1-to-1.5-second authentication process. The system records both palms two times to register an initial dataset; after that, either hand can be used. The infrared beam can't penetrate heavy gloves, but field tests indicate that thin latex-type gloves, such as those used in hospitals, pose no impediment to the recognition process. Hagberg envisions that home-based scanners could even be used for remote authentication for such processes as banking or e-voting.

An early version of the system began user testing in Japanese markets in early 2004 and included banks, ATMs, universities and businesses evaluating employee-attendance systems as well as network security. Around 10,000 units were deployed in those tests. In addition, some 140,000 Fujitsu employees consented to testing over a period of several years, to help researchers ascertain that vein layouts don't change in adult hands. The Fujitsu group included several sets of identical twins, which helped confirm that vein patterns are indeed unique to each individual. The device announced Wednesday is smaller than the first-generation project and cuts the time needed to scan and process the vein image by over half.

Fujitsu claims a false-positive rate of 0.00008% and a false-negative rate of 0.01% -- an error rate in line with biometric technologies such as iris scanning, and higher than that of options such as face recognition. Hagberg notes that user interviews indicated a much higher degree of personal comfort with the palm-scanning technique than with scans involving the eye, with many users citing concerns about possible long-term vision problems after daily iris scans. The contactless palm scanner was also appealing to hygiene-conscious users leery of fingerprint readers and other devices requiring contact. Additionally, readings work only when blood is moving through the veins, eliminating the grisly prospect of thieves separating palms from their owners for nefarious purposes.

Fujitsu representatives did not release information on specific partnerships, but stated that firms currently working with PalmSource include banks, software companies, and a variety of government agencies working with intelligence and defense. Software developers working with the PalmSecure have a choice of working with a Fujitsu-proprietary SKY or with an industry-standard API. The company stated that developers have already begun work with the new generation of PalmSource devices, and that initial products likely to ship during the second quarter.

Martyn Williams of IDG News Service contributed to this story.

Read more about Security in Computerworld's Security Topic Center.