Take Off Your Mask and Smile at the AI, Data Center Visitor

AI-powered facial recognition has been getting bad rap lately due to some significant concerns about bias and privacy. But that shouldn't deter data center managers from deploying AI-powered facial authentication technology.

Facial recognition gets its bad reputation when it's used on unsuspecting members of the public, not on professionals working in highly secured environments like data centers. In the latter context, it’s used to confirm that people are who they say they are – for example, when employees, customers, or contractors attempt to enter secure areas of a data center. Facial authentication can also be used to track people as they move around inside a data center, or when they attempt to access particular server rooms or workstations.

Recent advances in AI technology – especially in image recognition – and in 3D sensors have made facial authentication easier, faster, cheaper, and more accurate than ever. Smaller facilities that aren't ready to invest in the required hardware can take advantage of the facial recognition capabilities of employees' personal or company smartphones.

Using mobile device-based authentication also eliminates the need for the data center to keep biometric identification information in a central database, which is a security risk. After all, it's easy to issue an employee a new login and password if stolen, not so much a new face.

Related:The Ideal Data Center Access Control Device May Be in Your Pocket

And while it's unfortunate that facial recognition can be used to violate citizens' civil rights, the fact that governments are spending massive amounts on the technology has the side-effect of improving accuracy and driving down costs for enterprise security deployments. According to Adroit Market Research, the global facial recognition market is estimated to surpass $12 billion by 2025, up from $4.5 billion in 2019. (It’s worth keeping in mind that in the wake of the pandemic many analysts are revising their growth predictions downward.)

The COVID-19 Challenge

Facial recognition reduces the need for data center visitors to touch number pads or hand ID cards to security guards. In a pandemic, that's a very good thing.

But enterprises have less money to spend on new technology than before. Plus, the pandemic is disrupting supply chains, and much of the facial recognition equipment and its components are made in China.

Last year Stockholm-based research firm Memoori predicted that the AI video analytics market would grow to $3.5 billion, accounting for 15 percent of all video surveillance business.

About two weeks ago, however, Memoori managing director James McHale said that supply constraints, budget constraints, and pandemic-related project postponements have caused demand for this technology to fall significantly.

Related:Five Tips for Remote Data Center Manager Security During the Pandemic

"Buyers' priorities have of course changed, projects may have been shelved," McHale told DCK. "The recession will probably exacerbate this."

Finally, facial authentication is too ineffective when people wear masks. According to Mei Ngan, a NIST computer scientist and author of a recent report about the failure rates of facial recognition technology, many algorithms fail 20 to 50 percent of the time when a person wears a mask. Without masks, the most accurate algorithms had a failure rate of less than 1 percent.

"A lot of algorithms are based on the relationship between the eyes, nose, and mouth," said Tom Coughlin, president of technology consultancy at Coughlin Associates and an IEEE fellow. "With a mask, you can't get a good view of the mouth. This is a big issue right now in the COVID-19 world."

Visitors may need to take off their masks, he said, creating a risk that they might breathe in the virus, or sneeze and release the virus into the air. "And now you're having to have people come in and clean," he said.

He suggested that data centers backstop facial recognition systems with another no-touch option, such as voice authentication, or with a video feed to a human security staffer. "That's probably the easiest and quickest thing," he said. "Get a person that you can interact with remotely who can confirm that you are who you say you are."

Must-Have Features

Data centers that are looking to invest in facial authentication technology today or are planning ahead for such investments when things return to normal should look for a few key features in the technology.

Infrared sensors: Facial recognition systems aren't always located in the most optimal environment. If the sensor is near an entrance, there may be a lot of natural light coming in, making it difficult for lower-end cameras to make out faces. More advanced readers employ multiple wide-angle and narrow-angle infrared LEDs to allow image capture under any lighting condition.

3D analysis: People don't always look at a camera from the same angle at which they took their employee ID picture. The latest systems can analyze a face in 3D, allowing them to identify employees even from their profiles.

Live face detection: In movies criminals can easily bypass facial recognition systems by wearing masks. Security researchers were able to do the same in real-world testing. Vendors have been stepping up to address this problem, using both software and hardware approaches. On the software side, the systems can look for realistic human motion and appropriate skin temperatures. On the hardware side, in addition to temperature readings, some vendors are also looking at facial vein detection.

Apple, for example, was recently granted a patent to use facial vein detection as part of its Face ID authentication. That would allow the company to not just avoid being spoofed by disguises, but even to tell twins apart.

Multi-factor authentication: In situations where the highest possible levels of security are required, or when facial recognition can fail because of masks or other issues, additional authentication mechanisms such as voice recognition, smart badges, fingerprint scanners, or keypads can play a role.

"Security is never totally foolproof," said Coughlin. "But it can be made so it requires more and more effort to try to break it. That's the key to multifactor authentication."

Human backups: As a final resort, data centers should be prepared to have humans as a final backstop to authentication. This doesn't mean a live guard at every entrance – the same goal can be accomplished with a video screen or intercom, allowing the security staffers to be located at a safe distance or even in a work-from-home situation.