How do eye & iris scan biometrics work?

Iris scan biometrics is one of two techniques that use unique eyeball characteristics for security and identification purposes. The other technique is retinal scanning. Iris scans are more commonly used because they are quicker and less invasive, but retinal scanning can be more accurate. The two techniques also have different applications.

A retinal scan requires the subject to look into an eyepiece for several seconds while the image is captured. It uses a specialized device that sends a beam of light into the eye and scans the retina. Retinal scans are not generally used for security applications. They are used for eye exams and to identify specific medical conditions.

An iris scanner does not scan the iris; it takes a detailed picture of it. The retina is inside the eyeball, behind the pupil. The iris is the colored part of the eyeball around the pupil and behind the cornea. The scanner’s position allows it to be easily accessed and protects it, making it suitable for biometric authentication applications (Figure 1).

Common iris recognition systems take infrared (IR) images. More sophisticated systems use a multimodal design that combines IR and visible light images. Image analysis software identifies the boundaries of the iris and then processes the iris’ portion of the image.

The result is a detailed description of a person’s iris pattern, including feature size, color, shape, and texture, that supports high-accuracy authentications with a false acceptance rate (FAR) of one in ten million.

Iris recognition systems can be subject to various attack vectors. Presentation attacks have been common. They are based on acquiring an image of the victim’s iris with sufficient detail to create a false iris to fool the imaging system. Modern iris recognition systems incorporate a liveness detection function and cannot be easily fooled with a static image.

Most iris recognition systems are based on close-up imaging. However, advanced systems have been do to operate with imaging distances up to 5 meters.

Limitations of iris scanning

Iris scanning has limitations, including:

It is not applicable for individuals unable to look directly at the camera due to a disability; individuals wearing contact lenses or glasses can interfere with the accuracy of the scan.
Vulnerable to environmental factors like distance, reflection, poor lighting, shadows, and moisture, especially wet eyes
It’s relatively expensive. Iris scanners cost more than other biometric identification schemes, like fingerprints. They also require more maintenance and adjustments to produce high performance.

‍Iris recognition standards

Iris scanners are subject to various standards, such as IEC 608251-1 (safety of laser products), UL 294 (performance and operation of access control systems), and UL 60950-1 (general equipment safety).

There are also specific standards for enrollment providers who capture iris recognition data and central identity management system (CIMS) providers that maintain databases of iris biometrics. Examples of iris recognition standards include (Figure 2):

ANSI/INCITS 379, Iris interchange format: Defines a format for representing iris images
ISO/IEC 19794-6, Biometric data interchange format: Defines two formats for representing iris images, including a rectilinear specification and a polar image format
OSAC 2024-N-0004, Standard for Capturing Iris Images: Defines guidelines for capturing iris images, including:
- Subject positioning
- Glasses and contact lens considerations
- Distance between the iris capture device and the eye
- Occlusions such as those from interference from eyelashes

Summary

Retinal scanners are used for medical diagnostic purposes, while iris scanners are used for biometric identification. Iris scanners are highly accurate and produce very few false positives, but they have some limitations. In addition, iris scanners and the associated databases are highly regulated and subject to numerous national and international standards.