How it works: Iris scanning improves smartphone security


You hold your smartphone in front of your face, the angle and distance guided by on-screen feedback. It flashes near-infrared (NIR) light into your eyes -- a brief dull-red glow. Your smartphone recognizes one or both of your irises, and unlocks itself.

At least, that's the new smartphone login scenario. Previously seen mostly in military devices and fixed installations, iris scanning is joining other biometric authentication methods (such as fingerprint scanning, facial recognition and voice recognition) intended to move mobile devices beyond the limitations of password-based security.

But how exactly does iris scanning work? And is it really more secure than any of the other methods? Read on.

How it works

The iris is the colored ring in the eyeball between the central pupil and the sclera (the outer white area). It contains muscles that control the aperture of the pupil along with interlaced ligaments of connective tissue.

While the color of the iris is determined by genetics, the patterns in the ligaments are created by random tissue folding during gestation and are unique to each eyeball. The odds of any two irises being identical has been calculated to be one in 10 raised to the power of 78. Barring injury, the patterns remain stable through life, unlike faces, voices and even fingerprints.

blausen 0389 eyeanatomy 02 BruceBlaus

While the color of the iris is determined by genetics, the patterns in its ligaments are created by random tissue folding during gestation and are unique to each eyeball.

"There are 225 different points of comparison that are unique to each iris, compared to 40 on a fingerprint," says Patrick Moorhead, analyst at Moor Insights & Strategy. "So iris scanning can be more accurate. And fingerprints get worn, calloused, and dirty -- and in winter you have to wear gloves."

So it's no wonder that smartphone vendors are adding iris scanning capabilities to their new devices. As of this writing, smartphones with iris scanning included the Microsoft Lumia 950 and 950 XL, the Samsung Galaxy Note7, the Fujitsu Arrows NX-F-04G, the ZTE Nubia Prague S, and the new HP Elite x3.

As for how they work, published specifications and responses from corporate spokespeople are sketchy -- for a reason. "No one is very boastful about how secure they are, since it would make them a target for black hats," says Moorhead. "They want to keep it a mystery. The more people you tell the details to, the less secure it will be."

Less reticent is Daehoon Kim, founder and CEO of IriTech, a Virginia-based maker of stand-alone iris scanners and component modules for smartphones.

"Due to advances in [image] capturing technology, iris scanners no longer require dedicated and bulky camera sensors and lens," he says. "Instead, high quality iris images can now be captured using [off the shelf] CMOS sensors, with negligible extra cost for an NIR LED."












Another example of the accuracy of iris scanning can be found in India. The Unique Identification Authority of India (UIDAI) has been conducting an on-going effort to give each of India's 1.2 billion citizens a unique identifying number, backed by both iris and fingerprint biometrics. In 2015, the UIDAI tested ten different mobile iris scanners from different vendors, scanning 3,300 citizens who had already been enrolled to see if they could be matched in the government database. Accuracy (meaning they could be matched) averaged 99% and was as high as 99.76%. Failure to scan averaged 0.1% and was as low as 0.03%.

By the way, don't be afraid that someone will get into your smartphone by showing it a photo of your eye. In theory, iris scanners cannot be spoofed using a picture or model of an eye (or by the movie cliché of an enucleated eyeball) since the scanners actually use short videos rather than still images, and so can spot the normal fluctuations of a live eye, explains Ukonaho.


Unlocking a device involves comparing the iris of the would-be user to the description of the iris created during initialization, in a manner similar to that used by other biometrics. Frank Dickson, an analyst at Frost & Sullivan, notes that when a password is stolen, you can change that password. But if biometric data is stolen, you're defenseless, since there is no way you can change your biometrics.

Consequently, the approach used by the vendors is the one advocated by the FIDO Alliance (FIDO stands for "Fast IDentity Online"): Keep the biometric data within the device and never post it online. Brett McDowell, executive director of the FIDO Alliance, explains that FIDO requires that biometric data and authentication remain restricted to a co-processor on the device called the Trusted Execution Environment (TEE). Electronic wallet software also typically resides in the TEE, he adds. Since the encrypted representation of the scanned iris (and fingerprint or other biometrics) remains in the TEE, he says, there is no online repository of credentials that hackers can raid, as happens with passwords.

All the major vendors of smartphones with biometrics are either FIDO compliant or have equivalent technology and intend to become fully compliant, he says.

Steve Brasen, analyst at Enterprise Management Associates, notes that one in 11 enterprise-owned mobile devices is lost or stolen every year, and a thief could break in by figuring out the device's password, or (if it uses a fingerprint scanner) by potentially lifting the user's fingerprint from its exterior. But with iris scanning the hacker would have to both steal the phone and then make a surreptitious iris scan of the owner.

"It would take a covert operation to even attempt a surreptitious iris scan -- you'd be getting into the James Bond world," Brasen adds. But he also predicts the appearance of "eye-scan phishing" devices in public places that will attempt to get iris scans through false pretenses.

Meanwhile, there have been no reported cases of biometric descriptions being stolen, Dickson says.

Moorhead is more cautious about iris-based security. "Every biometric security implementation needs to be examined by third-party researchers, and that has not happened yet with iris scanning. But iris scanning should be the wave of the future if it's as good as they say," says Moorhead.

Join the newsletter!




Error: Please check your email address.

Tags Phones

More about Enterprise Management AssociatesGalaxyHPMicrosoftSamsungZTE

Show Comments