Biometric signatures

Because the enterprise has become the extended enterprise, involving internal and external participants, it has become vital to extend the work group to the world. Many companies have built extranets to facilitate a more secure route for the exchange of confidential information. Firewalls, 128 bit encryption, public key interface (PKI), biometric signatures, and identity management are all components of the advancing state... 

Non-biometric signatures must employ at least two distinct identification components such as an identification code and password. 

There is no doubt that the FDA would prefer the use of biometric signatures, i.e., a signature based on a unique physical attribute, such as a fingerprint or a retinal scan. When the rule was first drafted, this type of technology was not nearly robust enough. That situation is changing quickly, and devices are appearing where the necessary robustness is within reach. Nevertheless, systems will continue to be developed for some time where a unique combination of an identifier and a secret password will be necessary. 

These are the only controls currently required for the use of biometric signatures. Nonbiometric signatures are quite a different matter. A range of additional controls is necessary to give the FDA the confidence it needs to ensure that the signatures were applied by their real owners. 

The first draft of the new requirement had draconian security requirements, softened (as is common) after a comment period Demands for biometric identifiers were replaced with password control options. But the revised final regulation was still broad in scope and necessitated extensive documentation and testing for all systems used in the industry (with even stronger controls if the user opted for electronic signatures). 

Electronic signatures based on biometrics shall be designed to ensure that they cannot be used by anyone other than their genuine owners. 

Biometrics involves measuring the unique physical characteristics or traits of the human body. Any aspect of the body that is measurably different from person to person—for example, fingerprints or eye characteristics—can serve as a unique biometric identifier for that individual. Biometric systems recognizing fingerprints, palm shape, eyes, face, voice, and signature comprise the bulk of the current biometric systems. 

W. Winter and L. Huber, Implementing 21CFR Part 11 Electronic Signatures and Records in Analytical Laboratories Biometrics-Based Authentication—Limitations and Possibilities, Advanstar Communications, Biopharm, Suppl., pp. 40-43, Nov. 2000. 

Test identification code/password or biometric electronic signature/de-vices (as applicable)... 

Electronic signatures without biometric/behavioral identification... 

The purpose of the following checklist is to help to determine if a computer system complies with the FDA Rule 21 CFR 21 Part 11 for electronic records and electronic signatures. This audit questionnaire apphes to systems that meet the definition of a closed system as defined in Section 11.3 (b)(4) of the rule and which do not utilize biometrics identification methods. 

The above hardware was used to create at NASK a multimodal biometric database BioBase, which at present contains images of iris, face, hand shape, and handwritten signatures, of couple of hundred volunteers. BioBase will be employed here to test the proposed approaches. 

Confirm the integrity of electronic signatures including, where appropriate, the use of biometrics. 

Access to the system must be limited to authorized persons. The type of security will depend on whether the system is open or closed. Electronic signature technologies include identification codes (user names, passwords) or more sophisticated biometric systems (based on measurement of physical features such as palm prints, finger prints, or iris or retinal pattern scanners). The latter is expensive and less likely to be implemented, especially for multiple users. User names and passwords must be unique and never reassigned. Passwords should be changed periodically. 

In the training system, the following biometric data are used (a) file data from databases which are well structured and standard (b) appearance, or visual, data acquired mainly in real time (c) other appearance information, such as IR images, which requires specific skills for understanding and analysis and (d) various forms of behavioral biometrics (facial expressions, voice, signature, etc.) that are acquired in real time (during prescreening or check-in procedure). 

---