(Image source: http://www.hitachi.co.jp/products/it/veinid/solution/it_security/index.html)
What Is Finger Vein Authentication?
Finger vein authentication is a type of biometric authentication that uses pattern recognition based on images of the vein patterns beneath the skin of a finger. It can be applied to a wide range of use cases, including building entry and exit management, work attendance tracking, login authentication for computers and systems, identity verification at bank ATMs, and unlocking cars.
When a pre-registered finger is inserted into a finger vein authentication device, near-infrared light passes through the finger. Authentication is granted if the resulting vein pattern matches the pattern that was registered in advance.
(Image source: http://www.hitachi.co.jp/products/it/veinid/index.html)
In Japan, Hitachi, Ltd. holds the most patents in this field and leads the market. Other notable players besides Hitachi include NEC and Mofiria.
Finger Vein Authentication vs. Fingerprint Authentication
Like finger vein authentication, fingerprint authentication is another form of authentication that uses the finger. As is clear from its widespread use in smartphone authentication, fingerprint authentication has been adopted far more widely overall, but finger vein authentication is used extensively in industries that require a higher level of security.
Comparing fingerprint authentication and finger vein authentication in terms of "data reading method," "reader contact requirements," "difficulty of forgery (security)," and "adoption rate" yields the following results.
(Table source: http://www.hitachi-solutions.co.jp/johmon/sp/what/what.html)
Starting with the especially important factor of forgery resistance (security): fingerprint authentication requires the finger to physically touch a fingerprint reader, and because a fingerprint is left behind on contact, it can be relatively easy to copy. For this reason, it isn't well suited to use cases such as entry into buildings that store highly confidential information, access to advanced research data, or access to large bank deposits or financial assets.
Finger vein authentication, by contrast, relies on vein information located beneath the surface of the skin, making it significantly more secure. Even when a finger touches an object or a finger vein reader, no vein information is left behind, so it cannot be copied from whatever the finger touched. In addition, obtaining finger vein information directly from a person's finger is extremely difficult without specialized equipment.
Where finger vein authentication falls short compared to fingerprint authentication is in device miniaturization and adoption rate. Finger vein authentication devices are larger than fingerprint sensors, so they cannot be built into extremely compact form factors, such as embedding the sensor directly into a smartphone the way fingerprint sensors are.
Also, compared to fingerprint authentication, fewer companies offer finger vein authentication devices and solutions, and the devices themselves tend to be somewhat more expensive. As a result, adoption has so far progressed fastest in industries and use cases with especially high security requirements.
In 2016, Hitachi announced that it had developed a method of finger vein authentication using a smartphone's camera. This could potentially replace expensive finger vein readers with a smartphone camera, and practical implementation is highly anticipated.
Using Finger Vein Authentication in Multi-Factor Authentication
Multi-factor authentication is an authentication method that combines two or more of the three authentication factors: "biometric information," "knowledge information," and "possession information." Finger vein authentication falls under the "biometric information" category.
Among the three authentication factors, passwords (something you remember — knowledge information) are the most widely used, but a growing number of companies and services no longer consider password-only authentication secure enough, leading more of them to adopt multi-factor authentication.
Finger vein authentication can be used on its own, as with building entry authentication (in which case it's single-factor authentication), or it can be incorporated as part of multi-factor authentication.
For example, combining an IC cash card (possession information) with finger vein authentication (biometric information) results in two authentication factors, making it multi-factor authentication. Likewise, combining a login password (knowledge information) with finger vein authentication (biometric information) also qualifies as multi-factor authentication.
The strength of multi-factor authentication is defined in NIST SP 800-63-3, a guideline published by the U.S. National Institute of Standards and Technology (NIST). The strength of multi-factor authentication is expressed as an Authenticator Assurance Level, commonly abbreviated as AAL, with three levels ranging from weakest to strongest: AAL1, AAL2, and AAL3.
Multi-factor authentication using finger vein authentication falls under "two or more authentication types, at least one of which requires a physical device," since a physical device — a finger vein reader — is always required at the time of authentication. This places it at the highest level, AAL3. In other words, combining finger vein authentication with other factors makes it possible to achieve the highest level of security available among multi-factor authentication methods.
- Reference link
Global Electronic Authentication Standards Are Changing: Understanding NIST SP 800-63-3
Examples of Finger Vein Authentication Adoption
Examples of finger vein authentication adoption in Japan are shown below (compiled from the websites of companies that provide finger vein authentication devices or solutions).
Adoption is highest among local governments, which are likely to handle confidential personal information. In particular, municipal city and town offices handle highly private information such as family registry records, which is likely why they have adopted finger vein authentication — given its extremely low risk of duplication.
Financial institutions come next. Since they manage financial assets, including deposits, it's likely they determined that adding an extra layer of security on top of next-generation cash cards, IC chip-equipped cash cards, and 4-digit PIN codes would be the best way to help prevent unauthorized transfers and withdrawals.
Medical institutions such as hospitals manage sensitive information like medical conditions, histories, and medication records, so they have adopted finger vein authentication — which is difficult to duplicate — to ensure that only authorized personnel can view this information. Adoption is also spreading among educational institutions and general businesses.
Overseas, adoption is progressing mainly among financial institutions, including Bank of China (Hong Kong), the second-largest bank in Hong Kong, and Polish commercial banks such as Bank BPH and Bank PBS.
Until now, finger vein authentication has rarely been adopted from a multi-factor authentication standpoint, but as multi-factor authentication becomes increasingly standard, adoption in combination with other authentication methods is expected to grow.