Iris recognition

Iris recognition is an automated method of biometric identification that uses mathematical pattern-recognition techniques on video images of one or both of the irises of an individual's eyes, whose complex patterns are unique, stable, and can be seen from some distance. The discriminating powers of all biometric technologies depend on the amount of entropy^[1] they are able to encode and use in matching. Iris recognition is exceptional in this regard, enabling the avoidance of "collisions" (False Matches) even in cross-comparisons across massive populations.^[2] Its major limitation is that image acquisition from distances greater than a meter or two, or without cooperation, can be very difficult. However, the technology is in development and iris recognition can be accomplished from even up to 10 meters away or in a live camera feed.^[3]

Retinal scanning is a different, ocular-based biometric technology that uses the unique patterns on a person's retina blood vessels and is often confused with iris recognition. Iris recognition uses video camera technology with subtle near infrared illumination to acquire images of the detail-rich, intricate structures of the iris which are visible externally. Digital templates encoded from these patterns by mathematical and statistical algorithms allow the identification of an individual or someone pretending to be that individual.^[4] Databases of enrolled templates are searched by matcher engines at speeds measured in the millions of templates per second per (single-core) CPU, and with remarkably low false match rates.

At least 1.5 billion people around the world (including 1.29 billion citizens of India, in the UIDAI / Aadhaar programme as updated on 30 November) have been enrolled in iris recognition systems for national ID, e-government services, benefits distribution, security, and convenience purposes such as passport-free automated border-crossings.^[5]^[6]^[7]^[8]^[9]^[10]^[11]^[12] A key advantage of iris recognition, besides its speed of matching and its extreme resistance to false matches, is the stability^[13] of the iris as an internal and protected, yet externally visible organ of the eye.

In 2023, Pakistan's National Database & Registration Authority (NADRA) has launched IRIS for citizen registration/ Civic Management during registration at its offices for the National ID Card. After its initial stage, the eye-recognition verification access will be available for LEAs, banking sectors, etc.

History

Although John Daugman developed and in the 1990s patented the first actual algorithms to perform iris recognition, published the first papers about it and gave the first live demonstrations, the concept behind this invention has a much longer history and today it benefits from many other active scientific contributors. In a 1953 clinical textbook, F.H. Adler^[14] wrote: "In fact, the markings of the iris are so distinctive that it has been proposed to use photographs as a means of identification, instead of fingerprints." Adler referred to comments by the British ophthalmologist J.H. Doggart,^[15] who in 1949 had written that: "Just as every human being has different fingerprints, so does the minute architecture of the iris exhibit variations in every subject examined. [Its features] represent a series of variable factors whose conceivable permutations and combinations are almost infinite." Later in the 1980s, two American ophthalmologists, L. Flom and Aran Safir managed to patent Adler's and Doggart's conjecture that the iris could serve as a human identifier, but they had no actual algorithm or implementation to perform it and so their patent remained conjecture. The roots of this conjecture stretch back even further: in 1892 the Frenchman A. Bertillon had documented nuances in "Tableau de l'iris humain". Divination of all sorts of things based on iris patterns goes back to ancient Egypt, to Chaldea in Babylonia, and to ancient Greece, as documented in stone inscriptions, painted ceramic artefacts, and the writings of Hippocrates. (Iris divination persists today, as "iridology.")^{[citation needed]}

The core theoretical idea in Daugman's algorithms is that the failure of a test of statistical independence can be a very strong basis for pattern recognition, if there is sufficiently high entropy (enough degrees-of-freedom of random variation) among samples from different classes. In 1994 he patented this basis for iris recognition and its underlying computer vision algorithms for image processing, feature extraction, and matching, and published them in a paper.^[16] These algorithms became widely licensed through a series of companies: IriScan (a start-up founded by Flom, Safir, and Daugman), Iridian, Sarnoff, Sensar, LG-Iris, Panasonic, Oki, BI2, IrisGuard, Unisys, Sagem, Enschede, Securimetrics and L-1, now owned by French company Morpho.

With various improvements over the years, these algorithms remain today the basis of all significant public deployments of iris recognition, and they are consistently top performers in NIST tests (implementations submitted by L-1, MorphoTrust and Morpho, for whom Daugman serves as Chief Scientist for Iris Recognition). But research on many aspects of this technology and on alternative methods has exploded, and today there is a rapidly growing academic literature on optics, photonics, sensors, biology, genetics, ergonomics, interfaces, decision theory, coding, compression, protocol, security, mathematical and hardware aspects of this technology.

Most flagship deployments of these algorithms have been at airports, in lieu of passport presentation, and for security screening using watch-lists. In the early years of this century, major deployments began at Amsterdam's Schiphol Airport and at ten UK airport terminals allowing frequent travellers to present their iris instead of their passport, in a programme called IRIS: Iris Recognition Immigration System. Similar systems exist along the US / Canada border, and many others. In the United Arab Emirates, all 32 air, land, and seaports deploy these algorithms to screen all persons entering the UAE requiring a visa. Because a large watch-list compiled among GCC States is exhaustively searched each time, the number of iris cross-comparisons climbed to 62 trillion in 10 years. The Government of India has enrolled the iris codes (as well as fingerprints) of more than 1.2 billion citizens in the UIDAI (Unique Identification Authority of India) programme for national ID and fraud prevention in entitlements distribution.^[5] In a different type of application, iris is one of three biometric identification technologies internationally standardised since 2006 by ICAO for use in e-passports (the other two are fingerprint and face recognition).^[17]

Visible vs near infrared imaging

Iris melanin, also known as chromophore, mainly consists of two distinct heterogeneous macromolecules, called eumelanin (brown–black) and pheomelanin (yellow–reddish),^[18]^[19] whose absorbance at longer wavelengths in the NIR spectrum is negligible. At shorter wavelengths within the VW spectrum, however, these chromophores are excited and can yield rich patterns. Hosseini, et al.^[20] provide a comparison between these two imaging modalities. An alternative feature extraction method to encode VW iris images was also introduced, which may offer an alternative approach for multi-modal biometric systems.

Visible wavelength iris image	Near infrared (NIR) version	NIR imaging extracts structure

Visible light reveals rich pigmentation details of an Iris by exciting melanin, the main colouring component in the iris.	Pigmentation of the iris is invisible at longer wavelengths in the NIR spectrum.	Even "dark brown" eyes reveal rich iris texture in the NIR band, and most corneal specular reflections can be blocked.

Operating principle

A, now obsolete, IriScan model 2100 iris recognition camera

Iris scanner PIER 2.3 (Portable Iris Enrollment and Recognition) from SecuriMetrics

First the system has to localize the inner and outer boundaries of the iris (pupil and limbus) in an image of an eye. Further subroutines detect and exclude eyelids, eyelashes, and specular reflections that often occlude parts of the iris. The set of pixels containing only the iris, normalized by a rubber-sheet model to compensate for pupil dilation or constriction, is then analyzed to extract a bit pattern encoding the information needed to compare two iris images.

In the case of Daugman's algorithms, a Gabor wavelet transform is used. The result is a set of complex numbers that carry local amplitude and phase information about the iris pattern. In Daugman's algorithms, most amplitude information is discarded, and the 2048 bits representing an iris pattern consist of phase information (complex sign bits of the Gabor wavelet projections). Discarding the amplitude information ensures that the template remains largely unaffected by changes in illumination or camera gain, and contributes to the long-term usability of the biometric template.

For identification (one-to-many template matching) or verification (one-to-one template matching),^[21] a template created by imaging an iris is compared to stored templates in a database. If the Hamming distance is below the decision threshold, a positive identification has effectively been made because of the statistical extreme improbability that two different persons could agree by chance ("collide") in so many bits, given the high entropy of iris templates.

Advantages

The iris of the eye has been described as the ideal part of the human body for biometric identification for several reasons:

It is an internal organ that is well protected against damage and wear by a highly transparent and sensitive membrane (the cornea). This distinguishes it from fingerprints, which can be difficult to recognize after years of certain types of manual labor. The iris is mostly flat, and its geometric configuration is only controlled by two complementary muscles (the sphincter pupillae and dilator pupillae) that control the diameter of the pupil. This makes the iris shape far more predictable than, for instance, that of the face.

The iris has a fine texture that—like fingerprints—is determined randomly during embryonic gestation. Like the fingerprint, it is very hard (if not impossible) to prove that the iris is unique. However, there are so many factors that go into the formation of these textures (the iris and fingerprint) that the chance of false matches for either is extremely low. Even genetically identical individuals (and the left and right eyes of the same individual) have completely independent iris textures. An iris scan is similar to taking a photograph and can be performed from about 10 cm to a few meters away. There is no need for the person being identified to touch any equipment that has recently been touched by a stranger, thereby eliminating an objection that has been raised in some cultures against fingerprint scanners, where a finger has to touch a surface, or retinal scanning, where the eye must be brought very close to an eyepiece (like looking into a microscope).^[22]

The commercially deployed iris-recognition algorithm, John Daugman's IrisCode, has an unprecedented false match rate (better than 10⁻¹¹ if a Hamming distance threshold of 0.26 is used, meaning that up to 26% of the bits in two IrisCodes are allowed to disagree due to imaging noise, reflections, etc., while still declaring them to be a match).^[23] While there are some medical and surgical procedures that can affect the colour and overall shape of the iris, the fine texture remains remarkably stable over many decades. Some iris identifications have succeeded over a period of about 30 years.

Iris recognition works with clear contact lenses, eyeglasses, and non-mirrored sunglasses. The early Sensar technology worked by first finding the face, then the eyes, and then took the Iris images. This was all done using infrared lighting. It is possible to identify someone uniquely in a dark room while they were wearing sunglasses.

Mathematically, iris recognition based upon the original Daugman patents or other similar or related patents define the strongest biometric in the world. Iris recognition will uniquely identify anyone, and easily discerns between identical twins. If a human can verify the process by which the iris images are obtained (at a customs station, entering or even walking by an embassy, as a desktop 2nd factor for authentication, etc.) or through the use of live eye detection (which varies lighting to trigger slight dilation of the pupil and variations across a quick scan which may take several image snapshots) then the integrity of the identification are extremely high.

Shortcomings

Many commercial iris scanners can be easily fooled by a high quality image of an iris or face in place of the real thing.^[24] The scanners are often tough to adjust and can become bothersome for multiple people of different heights to use in succession. The accuracy of scanners can be affected by changes in lighting. Iris scanners are significantly more expensive than some other forms of biometrics, as well as password and proximity card security systems.

Iris recognition is very difficult to perform at a distance larger than a few meters and if the person to be identified is not cooperating by holding the head still and looking into the camera. However, several academic institutions and biometric vendors are developing products that claim to be able to identify subjects at distances of up to 10 meters ("Standoff Iris" or "Iris at a Distance" as well as Princeton Identity's "Iris on the Move" for persons walking at speeds up to 1 meter/sec).^[22]^[25]

As with other photographic biometric technologies, iris recognition is susceptible to poor image quality, with associated failure to enroll rates. As with other identification infrastructure (national residents databases, ID cards, etc.), civil rights activists have voiced concerns that iris-recognition technology might help governments to track individuals beyond their will. Researchers have tricked iris scanners using images generated from digital codes of stored irises. Criminals could exploit this flaw to steal the identities of others.^[26]

The first study on surgical patients involved modern cataract surgery and showed that it can change iris texture in such a way that iris pattern recognition is no longer feasible or the probability of falsely rejected subjects is increased.^[27]

Security considerations

As with most other biometric identification technology, an important consideration is live-tissue verification. The reliability of any biometric identification depends on ensuring that the signal acquired and compared has actually been recorded from a live body part of the person to be identified and is not a manufactured template. Besides a person's physical characteristics, which includes the eyes, one's voice and handwriting too, are not protected by the Fourth Amendment even though they are all constantly exposed.^[28] Many commercially available iris-recognition systems are easily fooled by presenting a high-quality photograph of a face instead of a real face,^[29]^[30] which makes such devices unsuitable for unsupervised applications, such as door access-control systems. However, this is not the case with all iris recognition algorithms. The problem of live-tissue verification is less of a concern in supervised applications (e.g., immigration control), where a human operator supervises the process of taking the picture.

Methods that have been suggested^{[citation needed]} to provide some defence against the use of fake eyes and irises include changing ambient lighting during the identification (switching on a bright lamp), such that the pupillary reflex can be verified and the iris image be recorded at several different pupil diameters; analysing the 2D spatial frequency spectrum of the iris image for the peaks caused by the printer dither patterns found on commercially available fake-iris contact lenses; analysing the temporal frequency spectrum of the image for the peaks caused by computer displays.^{[citation needed]}

Other methods include using spectral analysis instead of merely monochromatic cameras to distinguish iris tissue from other material; observing the characteristic natural movement of an eyeball (measuring nystagmus, tracking eye while text is read, etc.); testing for retinal retroreflection (red-eye effect) or for reflections from the eye's four optical surfaces (front and back of both cornea and lens) to verify their presence, position and shape.^[31] Another proposed^{[citation needed]} method is to use 3D imaging (e.g., stereo cameras) to verify the position and shape of the iris relative to other eye features.

A 2004 report^{[citation needed]} by the German Federal Office for Information Security noted that none of the iris-recognition systems commercially available at the time implemented any live-tissue verification technology. Like any pattern-recognition technology, live-tissue verifiers will have their own false-reject probability and will therefore further reduce the overall probability that a legitimate user is accepted by the sensor.

Privacy considerations

Deployed applications

IrisGuard Inc. UAE enrolment station

United Arab Emirates IrisGuard's Homeland Security Border Control has been operating an expellee tracking system in the United Arab Emirates (UAE) since 2003, when the UAE launched a national border-crossing security initiative. Today, all of the UAE's land, air and sea ports of entry are equipped with systems. All foreign nationals who need a visit visa to enter the UAE are now processed through iris cameras installed at all primary and auxiliary immigration inspection points. To date, the system has apprehended over 330,000 persons re-entering the UAE with either another name or nationality (which needs a visa), or even fraudulent travel documents.^[32]^[33]
Bank United of Texas. In 1999 Bank United became the first bank in the world^[34] to deploy iris recognition ATMs. These ATMs were manufactured by Diebold using Sensar iris recognition technology. The pilots deployed by Bank United received national television coverage. Coverage and interviews of Sensar executives and Bank United executives included Good Morning America, USA Today, and many other national television shows.

IrisGuard Inc. First Cash Withdrawal on Iris Enabled ATM

Hashemite Kingdom of Jordan - 2009, IrisGuard^[35] deployed one of the world's first operational iris-enabled automated teller machine at Cairo Amman Bank, where bank customers can seamlessly withdraw cash from ATM's without a bank card or pin but simply by presenting their eye to the iris recognition camera on the ATM. Since June 2012, IrisGuard is also providing financial inclusion to UNHCR^[36] registered Syrian refugees in Jordan on ATM's. The system is designed to facilitate cash-supported interventions that help deliver financial assistance to refugees with speed and dignity while lowering overhead costs and boosting accountability.^[37]
Aadhaar began operation in 2011 in India, whose government is enrolling the iris patterns (and other biometrics) of more than one billion residents for the Aadhaar scheme for entitlements distribution, run by the Unique Identification Authority of India (UIDAI).^[5] This programme at its peak was enrolling about one million persons every day, across 36,000 stations operated by 83 agencies. By October 2015, the number of persons enrolled exceeded 926 million, with each new enrollee being compared to all existing ones for de-duplication checks (hence 926 trillion, i.e. 926 million-million, iris cross-comparisons per day).^[38] Its purpose is to issue residents a biometrically provable unique entitlement number (Aadhaar) by which benefits may be claimed, and social inclusion enhanced; thus the slogan of UIDAI is: "To give the poor an identity." Iris technology providers must be granted a STQC (Standardisation Testing and Quality Certification) certificate in order to supply iris scanners for the project. By far, there are providers such as: IriTech Inc. (dual iris scanner IriMagic 100BK), Cogent (CIS-202), Iris ID (icam TD 100), Iris Guard (IG-AD-100), etc.^[39]
Police forces across America planned to start using BI2 Technologies' mobile MORIS (Mobile Offender Recognition and Information System) in 2012. The New York City Police Department was the first, with a system installed in Manhattan in the fall of 2010.^[40]
Iris recognition technology has been implemented by BioID Technologies SA in Pakistan for UNHCR repatriation project to control aid distribution for Afghan refugees. Refugees are repatriated by UNHCR in cooperation with Government of Pakistan, and they are paid for their travel. To make sure people do not get paid more than once, their irises are scanned, and the system will detect the refugees on next attempt. The database has more than 1.3 million iris code templates and around 4000 registrations per day. The one-to-many iris comparison takes place within 1.5 seconds against 1.3 million iris codes.
In early 2013, United Nation High Commissioner for Refugees (UNHCR) also installed a new biometrics identity management system (BIMS) by IriTech Inc. for the refugees in the Malawi Camp. During the pilot program, which lasted four weeks, more than 17,000 people enrolled their iris biometric data and had their identities verified. After the successful pilot in Malawi, Thailand was recently chosen to be the first site of the global roll-out. After 5 months, in June 2015, UNHCR has completed its registration for nearly 110,000 Myanmar refugees in Thailand's border camps with the help of the new system.^[41]
At Amsterdam Airport Schiphol, Netherlands, iris recognition has permitted expedited, passport-free border security passing since 2001 through the Privium program.^[42]
Canadian Air Transport Security Authority's Restricted Area Identity Card (RAIC) program is the world's first dual-biometric program deployed around major Canadian airports for staff and aircrews to access the restricted areas using separate channels from passengers.^[43]^[44]
In a number of Canadian airports, as part of the NEXUS program that facilitates entry into the US and Canada for pre-approved, low-risk travellers.^[45]
In several Canadian airports, as part of the CANPASS Air program that facilitates entry into Canada for pre-approved, low-risk air travelers.^[46]

A U.S. Marine Corps Sergeant uses a "PIER 2.3" iris scanner to positively identify a member of the Baghdadi city council prior to a meeting with local tribal leaders, sheiks, community leaders and U.S. service members.

UK's Iris Recognition Immigration System, which started operating in 2004 but which was closed to new registrations in 2011 and which has been phased out in 2012 and 2013.^[47]^[48]^[49]
Used in 2002 to verify the recognition of the "Afghan Girl" (Sharbat Gula) by National Geographic photographer Steve McCurry.^[50]
Since at least 2011, Google uses iris scanners to control access to their datacentres.^[51]
In 2010, Leon, Mexico, deployed iris scanners in public spaces, that can identify up to fifty people at once.^[52]
On May 10, 2011, Hoyos Group demonstrated a device called EyeLock using iris-recognition as an alternative to passwords to log people into password-protected Web sites and applications, like Facebook or eBay.^[53]
Princeton Identity has been developing an "Iris on the Move" system and set of products, primarily for U.S. Government clients, capable of identifying 30 people per minute.^[25] Most recently, they have specialized in a product where drivers can be identified without needing to leave their vehicle.^[54]
M2SYS Technology has deployed their RightPatient biometric patient identification system using iris recognition at 11 Novant Health hospitals in the Charlotte and Winston-Salem markets. The RightPatient iris biometric patient identification system is designed to capture both the face and the iris pattern of patients and uniquely link them to their electronic medical record.^[55]^{[citation needed]}
In March 2015, India's Andhra Pradesh state has launched an iris-based identity management solution developed by IriTech for enhancing pension distribution system. The Chief Minister N. Chandrababu Naidu demonstrated IriShield USB MK2120U device during a launching event of Andhra Pradesh state's iris scanning facility for pension distribution. "The state's decision to use iris technology as a primary method to issue Aadhaar verified DBT (Direct Benefit Transfer) will address concerns of total inclusiveness of its residence as well as providing a more accurate and a hygiene solution," says Binod E. Mathai, Director of Biometronic Technology.^[56]
On May 28, 2015, Fujitsu released ARROWS NX F-04G the first smartphone with an iris scanner.^[57]
On mid 2015, the Kenya Ministry of Education, Science and Technology in order to provide an accurate attendance tracking for all students in classes (roll-call) or school buses (getting on/off tracking) has implemented iris biometric system. The solution includes IriTech's IriShield camera connecting to a low cost Android phone or tablet via USB cable. Iris matching is done on-board of IriShield whose internal gallery can hold up to 500 identities (expandable to 5,000 identities) which is more than enough for most of the schools. The local matching capability is a particular advantage in the school-bus scenario because it does not require wireless/3G communication between the biometric terminal in the bus and a back-end server.
At the end of 2015, Microsoft launched two Lumia phones (Lumia 950 and Lumia 950 XL) featuring iris scanning as a way to authenticate the user.
In August 2016, Samsung released their first smartphone with iris recognition technology, the Galaxy Note 7, using a front-facing camera and infrared illumination.^[58] This technology was provided as an option to unlock the smartphone, and to authenticate the users for different features such as Knox security framework, and to restore the Samsung account password.^[59]^[60]
May 1, 2017, the first iris-enabled humanitarian blockchain system in the world was deployed in Azraq Refugee camp in Jordan by IrisGuard. More than 10,000 Syrian refugees use only their eyes without any token to pay for their food on WFP Building Blocks (a Private Ethereum Blockchain on AWS) to redeem their assistance. The project expanded to 100,000 refugees in January 2018.
March 2018, World Food Program (WFP) started to implement iris recognition in its food distribution system for the first time in Uganda. The country is hosting approximately 1.4 million refugees and asylum-seekers. It is one of the countries with the highest number of refugees in the world. IriTech's iris scanner BK 2121U is being used to deliver the right food to the right refugees, making sure that they get the food assistance they are entitled to. WFP plans to scale up the system to 180 food distribution sites across Uganda by the end of the year.^[61]
Sept 2019, ZainCash started to deploy iris recognition to perform cash distribution for refugees and IDPs for the first time using IrisGuard EyePay mobile phone in Kurdistan, Iraq using ZainCash mobile wallet. The world first mobile iris deployment is carried out with United Nations High Commissioner for Refugees (UNHCR) IrisGuard and Zain Iraq.^[62]
In June 2023, Apple introduced the Vision Pro mixed reality headset^[a] with a biometric security authentication technology called Optic ID. According to Apple, Optic ID analyzes a user’s iris through LED light exposure and then compares it with an enrolled Optic ID stored on the device’s Secure Enclave. The system can, reportedly, differentiate between the irises of identical twins.^[63]