This invention concerns apparatus and a method for authenticating a subjectusing their eye as an identifying biometric,in particular the shape of their cornea. The apparatus comprises an imageprojection device to generate and project an imageof a pattern, made up of plural discrete points, onto at least a part of thecornea of an eye of the person. An image capture device tocapture an image of the pattern of plural discrete points, after reflection inat least a part of the cornea of an eye of the person. And,a computer processor to extract a data set defining the locations of thediscrete points in the captured image. The method comprisescapturing an image of an illuminated pattern, made up of plural discretepoints, after reflection in at least a part of the cornea of aneye of the subject. Comparing the locations of the discrete points in thepattern of the captured image against the locations of thediscrete points in the pattern of a reference image. And, authenticating theidentity of the subject depending on the similarity ofcomparison. In a further aspect the invention is software for performing themethod.