On supporting science journalism
If you're enjoying this article, consider supporting our award-winning journalism by subscribing. By purchasing a subscription you are helping to ensure the future of impactful stories about the discoveries and ideas shaping our world today.
The image of a spy headquarters protected by a series of high-tech gadgets that scan faces, fingers and other body parts to keep out evildoers has been with us since the dawn of the Cold War. Such gadget-heavy security systems have yet to prove themselves outside of Hollywood (think James Bond and Get Smart), but Japan's Fujitsu Ltd. is hoping to change that with a device that checks identifications based on the unique pattern of veins in a person's palm.
The company's so-called PalmSecure system is a biometric security device that works by matching the vein pattern of a person seeking access, for example, to an automated teller machine (ATM), with scanned biological information stored in its database. Starting next month, Fujitsu will begin selling software that enables PalmSecure to be used with home PCs.
Fingerprints (each person has unique ridges on his or her fingertips) are the features most commonly used in biometric security systems; you're given access if your print matches the copy stored in the system. The trouble is, such scanners are expensive to set up and manage—and there is little evidence that they provide better security than less costly passwords.
Fujitsu's goal is to enhance reliability by using blood vessels in the palm rather than fingerprints. Although vascular-recognition systems are still relatively new, they promise to trump fingerprint-based biometrics in a few ways: Fingerprint scanners require a finger to touch the scanner, which can create smudges that impair accuracy and potentially spread germs. PalmSecure users, however, do not have to touch the device—which is a square with 1.4-inch (35-millimeter) sides and standing about one inch (27 millimeters) high—for it to read their hand's vascular pattern. PalmSecure can read a palm as long as it is placed within two inches (50 millimeters) of the device, so direct contact is not necessary. Such a pattern is also more difficult to fake because it requires that blood be flowing through the hand; experiments have shown that fingerprint scanners can be duped by photocopied prints, cadaver fingers and prints captured in Play-Doh.
Japanese businesses and schools have successfully used PalmSecure since 2004 to secure doors, computer log-ins and ATMs. "More than one million people are using this technology at Japan's largest bank [Tokyo-Mitsubishi UFJ] to access their bank accounts," says Hiroko Naito, business development manager for Fujitsu Computer Products of America, based in Sunnyvale, Calif. "When these customers try to do a transaction, they use their ATM card, a personal identification number and their palm; it's three-factor authentication."
PalmSecure uses light waves near the infrared section of the electromagnetic spectrum to scan the palm of a person's hand and identify patterns of veins, which like fingerprints will not change in his or her lifetime except in the case of injury or disease.
Another class of biometric devices offered by Fujitsu (as well as by rival Hitachi) scans the capillaries in a person's finger to identify that person. While this method avoids the sensor smudging problem and cannot be beaten by cadavers, Naito says that it, too, is flawed. "Scanners that search for veins in the finger have to look for capillaries to get enough information to verify a finger," she says. "But the finger's capillaries are extremely sensitive to temperature and can disappear if the finger is too warm."
Systems that scan the iris, or colored part of the eye, are considered to be the most accurate type of biometric security device because, like the palm, the iris has distinct blood vessel patterns that change little, if at all, over time. But iris scanners are not for the squeamish, because they require a beam of infrared light to be shined into the eye—while the head is held very still—to illuminate the blood vessels. Iris recognition may also be impeded by eyelids or eyelashes.
But not everyone is convinced, particularly given the lack of hard numbers outside Fujitsu's study. Mark Ombrellaro, a vascular surgeon at Eastside Vascular in Bellevue, Wash., who is also chief executive officer of Redmond, Wash.–based health care technology company TouchNetworks, is skeptical of PalmSecure's ability to identify specific blood flow patterns. "You need to tune it so that you're not getting too much noise, otherwise you get more of a blobogram," he says. Fujitsu states that its technology maps only the blood vessels carrying oxygen-free blood back to the heart—these blood vessels absorb PalmSecure's near-infrared light waves and look darker than the surrounding tissue.
While Fujitsu's claim that every person has a unique vascular pattern in the palm of his or her hand, sounds "reasonable," Ombrellaro says, "I honestly don't think anyone knows for sure."
* Correction (6/26/08): Due to a numerical error, this story has been modified since its original posting.