Security gets a new voice

Passwords and PINs are passé. Security experts agree these antiquated stalwarts provide weak security. And users are crying out for release from their bondage to endless sequences of letters and digits to access systems.New approaches are needed to fortify system security. While biometrics reading retinas, vein patterns and other funky body parts have been proposed to identify users, none show as much promise as voice biometrics, or speaker verification.“Voice is more realistic than other biometrics,” says Judith Markowitz, a Chicago-based independent consultant and thought leader. “You don’t need special readers for mass deployment.”So are conditions right for mass deployment in the near future, particularly as more mobile applications proliferate? Voice pitchIn the past three years, speaker verification technology has improved significantly, says Chuck Buffum, VP of authentication solutions at Burlington, MA-based Nuance Communications Ltd., a voice solutions provider. “It’s gotten good enough for prime time. You can get a spoken token from a voiceprint.” Recent implementations by major companies are soothing concerns about the technology’s accuracy and consumer acceptance, he says. Bell Canada enrolled 600,000 customers last year to allow them to access call centre agents using their voices as passwords. Aeroplan also deployed speaker verification to allow its customers to access their frequent flyer accounts, and TD Waterhouse is in the middle of a big deployment. “No one wants to be first to deploy new technology, so now organizations can be second,” says Buffum.Studies show speaker verification is more accurate than other biometrics except retinal scanning, he says. But it offers other practical advantages: there’s already a huge installed base of microphones in most computers and handheld devices, so no extra equipment is need to capture voiceprints.Nor is any special user training needed, as is the case with fingerprint scanners where users need to learn how to roll their fingers across readers properly, he says. And user acceptance is high. According to an international survey conducted by Nuance, over 50% of consumers said they viewed speaker verification as a competitive advantage. Moreover, speaker verification can be easily implemented as a two-factor security solution by combining voiceprint matches with a passphrases, he says. “Alone, it has a 95% accuracy rate, but if a multi-factor security solution is used, it’s 99%.” Although background noise may cause problems, most false rejections are due to cross-channel mis-matches, he explains. “If someone enrolled on a landline home phone, but then calls on a cell phone, the system may reject the user. The audio acoustics are different, and data gets mixed in with voiceprints.” Since most users in fact enrol on their home phones, this has a security upside. “The odds of someone who knows your passphrase breaking into your house to impersonate you are pretty low.”Speaker verification is not really new technology, as it’s been used in niche applications for about a decade, he says. It was first used in Canada to manage telephone privileges in prisons. Today, the technology is used by law enforcement to track the movements of parolees, offenders under house arrest and people with temporary visas.A more recent application is using the technology to automate password resets, which comprise about 30% of call volumes at IT help desks, he says. “Employees are enrolled into the system with voiceprints, which are used to validate they are who they say they are if they call later to reset their passwords. About 40 corporations use it for this purpose, including Marriott Hotels and some big banks.”But the killer app for speaker verification lies in mobile applications, particularly mobile banking, he says. “You need to certify the right person is using the phone or making the transaction, which may translate into a call back and a voiceprint match to validate it. Regulatory bodies recently approved the use of a voiceprint as a valid alternative to a signature.”To pursue this burgeoning market, Nuance announced a partnership with the Mobile Commerce Group this year to develop a biometric payment and financial transaction processing service that can integrate with current financial systems. “We’ve been inundated with calls from the mobile divisions of financial institutions,” says Buffo.Speech impedimentsBut analysts paint a less rosy picture. It’s both a blessing and a curse for the emerging speaker verification industry that the lucrative target markets are financial institutions and government, says Dan Miller, founder of Opus Research, a San Francisco-based research consultancy. “More than ever before, solutions are being made that integrate speaker authentication with enterprise security,” he says. “But major banks have first-order issues around the sub-prime mortgage and liquidity crisis, and upgrading phone networks is not a priority. The industry is a victim of circumstance.”Uptake by government entities is also slow, as these are reluctant to implement new technology. “But there’s been significant spending on speaker verification on the forensic side by law enforcement to catch bad guys via wiretaps, and this may help subsidize more commercial uses.” However, a push to develop mobile speaker verification is coming from surprising quarters. There are thousands of transient workers in the Middle East working on building projects, and Nuance is working to develop a bank system without a bank for them, says Miller. “Many of these individuals don’t have bank accounts but want to transfer funds back to their home countries. To avoid fraud, a way to authenticate the person and not just the device used is needed, and voiceprints make sense.”There are signs the North American market is being primed for mass deployment, he says. Almost all contact centre and IVR providers are now offering speaker verification for phone-based commerce. And system integrators such as IBM and EDS are also working to incorporate voice biometrics into their solutions. “Vendors are greasing the gears to get speaker verification on demand. But how deeply integrated these solutions are in operations remains to be seen.”The next phase once these teething pains are over will be integrating speaker verification with CRM and other back-end databases, he says. “Voiceprints should be thought of as another data descriptor in a CRM. There’s a movement to integrate verification early in the call in the background so companies can recognize who’s calling and associate it with their customer’s call history.”The best customer service applications know as much as possible about the caller so they can be profiled and serviced accordingly. “I call it the Googlization of customer service. Google treats everyone a bit differently based on what they’ve done in the past. It’s starting to dawn on implementers that similar pattern recognition can be used for customer service systems to make them as predictive as possible.”Broken spoken tokenIn the US, regulatory bodies are mandating multi-factor security for financial transactions, says Markowitz. “Voice is inherently multi-factor if you have to say your password or account number.” While this may appear to favour voice biometrics over other solutions, there are some impediments within the industry.“No reliable third party testing has been done on more than two or three products, “she says, adding that even these were conducted in controlled laboratory conditions with landline phones. “And a 99% accuracy rate is not that great. It means one out of 100 fails, but that translates into thousands of rejections in high volume areas.” To avoid the wrath of legitimate users who may be rejected by these systems, implementers will likely revert to PINs, passwords or other less secure back doors that can be used by wily hackers. Users who are fed up of being forced to remember complicated passwords or account numbers aren’t entirely off the hook. “Some people’s names are too short to provide enough syllables and resonance from their vocal cords to get a good voiceprint,” she explains. Longer passphrases containing numbers or other words are needed to make them harder to spoof with tape recorders. Other factors may also create false rejections. While most devices have microphones, the quality in many low-end devices is poor, she says. Cellular and landline networks and phones are so different that if people enrol on one, a false rejection may result every time they use the other to access a system.While these are issues that will likely resolve over time as the technology and system design matures, the lack of common standards is a key show-stopper. “With speech recognition, the voice XML standard is what opened the market and made it possible to integrate it in applications without being tied to proprietary systems. This revolutionized the IVR market, but we’re not there yet with speaker verification.”As a consequence, the industry will likely grow by a modest third over the next couple of years, as lack of standards will inhibit uptake in the industry’s target markets, she says. “Government entities won’t do wide deployments, as they’re mandated to use technology that has standards. And banks are stuck between a rock and a hard place. They need multi-factor security, but they’ll likely look for other security factors to bolster PINs and passwords.”

Security gets a new voice

News | 08/25/2008 2:57 pm EDT

To keep reading, get a free trial.

Already a Subscriber?

Reuse & Permissions

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us