What Is Iris Scanning? Answers for People Who Have to Deploy It
Iris scanning means photographing the colored ring of the eye in infrared light and using its texture to recognize a person. When we at Iriscan talk to project teams, the questions are rarely about the algorithm. Is it safe for the eyes? Will it work with glasses? What hardware is needed and what exactly is stored? I collected the answers below.
Is it a laser? Is it safe?
No laser is involved. An iris scanner is a camera with near-infrared LEDs, similar in power to the illumination of a security camera or a TV remote. The light levels are limited by the eye safety standard IEC 62471, and the exposure lasts a second or two. Iris scanning is often confused with retina scanning, an older and rarer technique which looked at the blood vessels at the back of the eye and required putting the eye close to an eyepiece.
What does the scanner see?
A grayscale image of the eye in which the iris shows its fine structure: crypts, furrows, rings and freckles. Eye color plays no role, because in infrared light both dark and light irises show their texture. From this image the software builds an iris code, a string of bits, and the image itself can be discarded. How it works is described in how iris recognition works.
Who does it work for?
Almost everyone. Glasses are usually fine, although the person may need to tilt the head to move a reflection off the iris. Clear contact lenses are fine as well. Patterned cosmetic lenses are not, because they print a fake texture over the real one. People with some eye conditions (aniridia, certain cataract surgeries, severe nystagmus) may not be enrollable, so every system needs a fallback such as face or fingerprint.
Consider manual workers, farmers and the elderly: their fingerprints are often worn down, while their irises are not. This is one of the reasons why humanitarian agencies and national ID programs add iris to fingerprints. Small children can be enrolled from around two or three years old, mainly limited by how long they can keep still.
How long does it take?
With a cooperative person and a decent scanner, it takes two to five seconds per eye, including positioning. Dual-iris cameras capture both eyes at once. Matching is fast: comparing iris codes is bit counting, and a single CPU core gets through about a million comparisons per second.
What hardware is needed?
For enrollment and verification at a desk or at a field station, a USB scanner costing from under €100 to about €170 is enough. Monocular handheld units such as Iritech IriShield plug into a laptop, a tablet or an Android phone. Dual-eye and iris-plus-face cameras, such as Vista EY2, cost more and work faster. Rugged tablets like BIOSID combine biometric capture with card reading in the field.
Standard phone cameras have no infrared illumination and do not resolve the iris well enough, so mobile apps use face recognition instead. Our Biometric SDK covers both: face on the phone, iris with a connected scanner.
What gets stored?
A well-designed system stores iris codes, not photos, and keeps them apart from names and other personal data. An iris code cannot be turned back into an image of the eye. Some programs still keep the original images, to be able to re-process them with a better algorithm later. This is a decision to take deliberately, with encryption and a defined retention period.
In addition, use standard formats (ISO/IEC 19794-6 or 39794-6) for everything you keep. Templates in a vendor's own format tie the database to this vendor's matcher.
Where is it used already?
India's Aadhaar uses iris together with fingerprints to de-duplicate more than a billion residents. The UAE has been screening arriving travelers by iris since the early 2000s. UNHCR and WFP use it to register refugees and to deliver food and cash assistance (more on this in biometrics in the humanitarian sector). Lenders use it to stop the same person from borrowing under several names (see biometric verification against identity fraud).