Getting Started: An Introduction to Voice Biometrics 2008

customer care solutions from Nuance white paper :: A Nuance Education Paper Getting Started: An Introduction to Voice Biometrics 2008 NUANCE :: customer care solutions Biometrics 101: An Introduction to Voice Biometrics introduction This paper addresses the topics and areas of uncertainty that are most common for organizations beginning to consider voice biometrics as a security option for their business. The goal is to inform, to provide insight as to the possibilities of voice biometrics, and to help decision-makers answer initial questions. This paper does not provide an in-depth view of the Nuance Verifier technology, as that is available via other collateral on the Nuance web site at www.nuance.com. Topics discussed in this paper are: • Use cases • Common questions • Important terms and concepts • Key considerations use cases Current security practices of PINs, passwords and secret personal questions are not very secure, easily lost or forgotten, and regularly require being reset. Voice biometrics provides a relatively easy and cost effective solution to these problems. Voice biometrics is most commonly applied via contact centers for telephone applications during which callers attempt to access sensitive data or services. Typically, voice biometrics are employed to verify a person’s identity prior to granting access to a protected asset such as a bank account or authorizing an action such as a password reset. Voice biometrics is also used outside of contact centers to provide secure access to physical locations or facilities. A simple handset is made available at a secure building or location entrance; an authorized person simply speaks into the phone to get verified via an automated application. Other uses include law enforcement’s tracking of parolees who must call in to validate their location, military personnel call-home privileges, digital signature provision and employee scheduling systems. The applications are many, the security is high. Who Where How What • Consumers • Banking • Call center • Applications • Constituents • Government • Telephone • Information • Customers • Health Care • VolP • People • Employees • Telco • Wireless • Physical • Travel • Wireline locations • Utilities • Virtual locations Figure 1: Use Cases for Voice Biometrics 2 common questions What is a biometric? A biometric system uses specific behavioral or physiological characteristics to determine or verify a person’s identity. There are a many different types of biometric measures including iris scans, fingerprints, facial recognition, retina scans, spoken voice, signatures, keystrokes or even gait. What is biometric authentication? “Biometric authentication” is a generic term for the process of verification. It involves presenting a biometric for query, comparing the presented biometric to a stored template or model, and determining whether the individual has made a legitimate claim. What is multi-factor authentication? At its most basic, multi-factor authentication, sometimes referred to as “strong authentication”, refers to using more than one method to authenticate. Two-factor authentication, for example, uses two different factors for purposes of authentication. Human authentication factors are typically classified into three categories: • Something the user has (e.g., ID card, security token, software token, phone, or cell phone) • Something the user knows (e.g., a password, pass phrase, or personal identification number (PIN)) • Something the user is or does (e.g., fingerprint or retinal pattern, signature or voice recognition, or another biometric identifier) Using more than one category of factor, such as requiring a password plus a biometric verification, offers stronger authentication assurance than just a single factor. The need for multi-factor authentication depends on the level of security required for a particular application. What are the components of a biometric system? A typical biometric system is comprised of five integrated components. 1. A sensor is used to collect the data and convert the information to a digital format. 2. Signal processing algorithms perform quality control activities and develop the biometric template. 3. A data storage component keeps information that new biometric templates will be compared to. 4. A matching algorithm compares the new biometric template to one or more templates kept in data storage. 5. Finally, a decision process (either automated or human-assisted) uses the results from the matching component to make a system-level decision. 3 NUANCE :: customer care solutions What are the processes of a biometric system? Biometrics systems follow four basic processes: collection, extraction, comparison and decision. 1. Collection involves using a sensor to capture the biometric traits and convert them to a digital format. 2. Extraction takes the digital data and converts the distinctive features into a compact template. 3. In the comparison step, the biometric system measures the likeness of the template to those in the database. 4. Based on the likeness, the system decides whether or not the submitted biometric matches one of the templates in the database. How do I select a biometric technology? The effectiveness of a biometric technology is dependent on the how and where it is used. Each biometric modality has its own strengths and weaknesses that should be evaluated in relation to the application before implementation. Key decision factors for selecting a biometric technology include evaluating the environment, throughput needs, population size and demographics, ergonomics, interoperability with existing systems, user considerations, etc. The careful evaluation of the key decision factors plays a crucial role in the success of the selected technology. What is enrollment? In a biometric system, an initial sample must be collected from known users to generate a reference model that will be used to evaluate all future samples collected. Since this model represents the secret code that will be used to lock out fraudulent access to the biometric system, it is important that the enrollment sample is collected from the correct person. Therefore, an enrollment process typically involves authenticating a caller by some alternate means (perhaps by asking for a password or a series of knowledge questions) and then collecting a biometric sample from that person. Voice biometrics typically collects a series of sample phrases from the enrollee and uses them to generate the initial voice print. What is speaker verification? Peoples’ voices are unique, just like their finger prints. Speaker verification, an application of voice biometrics, analyzes voice samples to extract key characteristics of a person’s voice. This set of characteristics taken together is called a “voice print” (sometimes referred to as “voice template” or “voice model”). When a person enrolls into a system, a sample is collected. A voice print is extracted out of that sample and stored for future use. Simplistically, for verification, a voice sample is collected during a phone call and compared to the previously stored voice print. If they match, the speaker is verified. Speaker verification is sometimes referred to as voice authentication. 4 What is the difference between speaker verification and speaker identification? Speaker verification is the process of verifying that an individual is who he or she claims to be via submission of an identity claim such as a name or account number. Verification checks that you really are Susan, seeking to pay a bill from your bank account. Speaker identification is the process of associating an unknown speaker with a member in a population. Speaker identification, more commonly used in law enforcement, may capture a voice and cross-check it against a database of criminal’s voices, looking for a match and therefore the identity. Speaker verification is usually used in applications which require secure access. The systems operate with the user’s knowledge and typically require their cooperation. Speaker identification systems are more likely to operate covertly without the user’s knowledge. What is the difference between speaker verification and speech recognition? Speech recognition systems aim to understand the words that are being spoken. Speaker verification systems strive to confirm who is saying those words. How secure is speaker verification? Speaker verification technology from Nuance satisfies the most stringent security requirements. Nuance solutions capture specific physical characteristics of the human voice, using those characteristics to identify callers, something that other security measures just cannot do.