The FIDO accredited biometric laboratory TÜViT tested against criteria based on FIDO Biometric Certification Requirements v1.1 (FIDO1.1) and ISO/IEC 30107-3:2017. The applied criteria are considered by TÜViT to be stricter than FIDO1.1, so as the test was successful, the FIDO criteria are also regarded as being met.

In 1000 spoofing attempts, various photos, paper masks and moving videos on different displays were used by TÜViT for challenging the anti-spoofing system. In addition, a bona-fide test with live persons, designed for auditing correct live classifications, was performed. The bona-fide test validates that the presentation attack detection mechanism, while being secure, is also appropriate for its intended application. Both tests were passed successfully.
 

ISO/IEC 30107 FOR PAD

ISO/IEC 30107-3 is the international standard for presentation attack detection. It includes methods for performance assessment of PAD mechanisms. It gives guidance on how to report testing results from evaluations of presentation attack detection mechanisms. Also, the ISO standard includes a classification of known attack types. The attack classes can be grouped into level A, B and C or are called level 1, 2 and 3. For an overview of different presentation attack classes go to this article on “Liveness Detection Certification”.

EUROPE’S FIRST ISSUED FIDO BIOMETRIC CERTIFICATION RELIES ON BIOID PAD

In addition to the independent testing procedure conducted by TÜViT, BioID’s liveness detection has also been validated during a customer’s FIDO biometric component certification in 2020. This certification is based on the standards ISO 19795 and ISO 30107. The solution including BioID PAD is one of the first in the world that achieved this certification. During the certification process, the accuracy of BioID’s liveness detection was evaluated with hundreds of spoofing attacks carried out using a variety of materials, including photo prints on different media and materials, 3D avatars and video projection. An overview on different testing metrics, certifications and evaluations available can be found here.

LIVENESS DETECTION FOR ANTI-SPOOFING IN IDENTITY VERIFICATION

BioID Liveness Detection requires only two selfies and ensures they were captured from a live person in real-time. Fakes like photos, videos or masks of various materials are reliably detected to ensure the integrity of a registration or authentication process. BioID’s Liveness Detection works with any standard RGB camera and does not require special sensors. It is used by customers worldwide in the private and banking sectors as well as by government service providers. In addition, it is a security mechanism for work-from-home authentication.

“As a pioneer for liveness detection since early 2000, BioID is proud of two different independent accreditations for our PAD technology. As we are working with multiple government suppliers, such objective third-party measurement is of great value. It complements the real-life approval from multiple years of efficient fraud prevention for our customers worldwide.”, says BioID CEO Ho Chang.

ABOUT TÜVIT INFORMATIONSTECHNIK GMBH

TÜV Informationstechnik GmbH is focused on the testing and certification of security in information technology. As an independent testing service provider for IT security, TÜV Informationstechnik GmbH is an international leader. Numerous customers already benefit from the company’s tested security. The portfolio includes cyber security, evaluation of software and hardware, IoT/Industry 4.0, data protection, ISMS, smart energy, mobile security, automotive security, eID and trust services, as well as testing and certification of data centers with regard to their physical security and high availability. TÜV Informationstechnik GmbH, founded in 1995 and headquartered in Essen, is a company of the TÜV NORD GROUP, which operates as one of the largest technology service providers with more than 14,000 employees and business activities in 100 countries worldwide.

TÜViT is the umbrella brand of the business unit IT, one of the six globally positioned business units in the TÜV NORD GROUP. The business unit IT is represented by the companies TÜV Informationstechnik GmbH and the consulting company TÜV NORD IT Secure Communications GmbH & Co. KG, which is based in Berlin.

AMONG THE FIRST SOLUTIONS IN THE WORLD TO RECEIVE FIDO BIOMETRIC CERTIFICATION

Two FIDO accredited laboratories were involved in testing and evaluating the biometric components facial matching and liveness detection. The French ELITT, a laboratory specialized in trusted transactions, and LETI ITSEF, a laboratory with IT security focus. These are jointly accredited by FIDO Alliance to carry out biometric tests in accordance with FIDO specifications based on the ISO19795 and ISO 30107 standards.

The IDCheck.io solution is a reliable and intuitive solution for individuals who want to register for an online service. The accuracy of BioID’s liveness detection was evaluated with hundreds of spoofing attacks carried out using a variety of materials, including photo prints on different media, 3D avatars and video projection.

“The collaboration with BioID enables us to provide an even higher level of assurance through comprehensive face anti-spoofing methods in IDCheck.io.”, says Marc Norlain, General Director at ARIADNEXT. “A sophisticated certification procedure like that of FIDO gives our customers another objective reason for trusting our solutions.”

LIVENESS DETECTION FOR ANTI-SPOOFING IN IDENTITY VERIFICATION

BioID Liveness Detection requires only two selfies taken during a remote onboarding process like ARIADNEXT’s. The FIDO tested technology ensures they were captured from a live person. Fakes like photos, videos or masks are reliably detected to ensure the integrity of the registration process. BioID’s Liveness Detection works with any standard camera, hence is perfect for end-user applications.

“It is great to support ARIADNEXT’s FIDO biometric component certification with our liveness detection.”, says BioID CEO Ho Chang. “Both companies share a common vision that a trusted identity is the basis for a secure cyber community. This FIDO certified solution is a major step in this direction.”

ABOUT ARIADNEXT

ARIADNEXT is the leading European provider of digital identification services. By providing fully automated solutions based on Artificial Intelligence, ARIADNEXT offers companies and governments the opportunity to instantly build trusting relationships with their consumers and citizens. These solutions enable them to meet regulatory challenges and anti-fraud requirements while focusing on customer experience and digital transformation. To date, ARIADNEXT’s solutions have already attracted more than 300 customers in Europe.

Learn more about FIDO criteria for PAD testing and certification in our blog article on Liveness Detection Certification.

QUALITYCHECK API FOR EMPLOYEE BADGES

Photobooths have long exceeded only being a fun tool for weddings or company events. Numerous companies are now leveraging the possibility to automate employee pictures for their internal profile and badges as well as visa applications. These processes become more efficient through the self-service photobooth as it is available at all times and doesn’t require trained personnel. The high-end hardware is dedicated to creating high quality pictures for ICAO compliance, a standard needed for photos on identity documents.

Before printing the headshot images these are checked thoroughly by the BioID QualityCheck API. This API evaluates characteristics like lighting, head rotation, eye distance, as well as the age of the picture. This way it determines, whether or not the image is compliant with the official ICAO standards required for such a passport photo. The API can be tested at the BioID Playground, using the demo “Pic4Pass”. 

SERVICE AND SECURITY IN LOCAL CITIZEN OFFICES

Internationally, this photobooth functionality is used in registration offices when citizens apply for driver’s licenses and identity documents. For instance, local city offices in Slovenia use the photobooth for issuing freshly taken passport images on-site. Not only does this cater to a higher level of service for the citizens but it also strengthens security, as it prevents submission of manipulated images.

In Germany, only recently there where experiments of morphed images including two different faces, which were submitted at registration offices and used to issue passports. As a result, facial recognition systems, but also humans, recognize both people in the morphed image on the ID or passport. This may result in a loophole for criminals. One way to prevent this situation, is to ask citizens to take their biometric pictures on-site, or have the passport photo taken and transmitted to the authorized service provider (e.g. passport office) directly.

The financial concept of Photobooth-Deluxe is easy and based on profit-sharing: Starting from 50 ID photos per month, the hardware is provided for free. 

ABOUT PHOTOBOOTH-DELUXE

For more than ten years, the company Photobooth-Deluxe has grown its experience with various photobooth systems and mobile setups. Since the triumph of digital photography began, multiple new use cases for photobooths have evolved. We are proud to be at the forefront of innovation by developing modern photobooth systems since 2005. By now, more than 500 Photobooth-Deluxe systems are installed in the European market and beyond.

The company is managed by Jürgen Mayr, who focuses on the development and distribution of photobooths and the related software. For private and business use, Photobooth-Deluxe offers a both, a sales and a rental concept.
Our slogan is: The service makes the difference.

Since 2018, the financial technology startup LCX provides cryptoasset financial products and services. As a blockchain innovator, LCX is focused on helping both traditional and blockchain market participants with the LCX Terminal. The advanced crypto trading desk enables trade on all major crypto exchanges within a single interface, managing the complete crypto asset trading lifecycle across multiple platforms.

REGULATORY COMPLIANCE FOR PROFESSIONAL CRYPTO FINANCE

With the currently effective fourth AML directive, Anti-Money-Laundering and Know-Your-Customer regulations do not only apply for traditional banking but also the virtual asset and crypto finance market. For regulatory compliance, LCX has invested to build AML and KYC technology solutions, including on-chain analytics and surveillance for all crypto deposits and withdrawals. The LCX due diligence process combines the best-in-breed deep learning-based technologies for ID authenticity check, biometric verification, liveness detection, blockchain analytics, and AML automation.

Monty Metzger, CEO, and Founder of LCX: “We were looking for the most sophisticated biometric technology to develop an unrivaled identity verification process for KYC/AML regulatory compliance. By directly integrating BioID’s APIs in our service offerings, we gain all the accuracy and flexibility we require to serve the regulated crypto finance market.”

BIOMETRICS ENABLE AML/KYC COMPLIANT IDENTITY PROOFING

As the LCX biometrics provider, BioID facilitates regulatory compliance by validating the authenticity of the LCX customers. In particular, BioID verifies the ownership of IDs, comparing the person submitting the ID with the person on the ID photo with facial recognition. Using BioID’s patented liveness detection, this provides for the highest levels of assurance. As BioID enables face anti-spoofing with standard cameras, the Liechtenstein company can offer secure and convenient self-serve identity proofing for their customers using their own devices, in real-time and frictionless. Liveness detection is a crucial fraud prevention method to avert stolen or fake biometrics from being used for onboarding or authentication.

“With more than 20 years on the identity verification market, we see great synergies with our partner LCX, who demonstrates remarkable innovative strength to cater the need for regulatory compliance in the professional crypto market.”, says Ho Chang, BioID’s CEO. 

ABOUT LCX

LCX, the Liechtenstein Cryptoassets Exchange, is a global fintech company that aims to provide a range of products and services for the token economy in a regulated and compliant manner. LCX launched STO Launchpad as a one-stop tokenization platform for issuers and investors in security tokens and other crypto assets. The LCX Terminal brings together real-time and full historical data on all cryptocurrency markets, news, social analytics, and trading signals, powerful analytics, smart order routing, and trading execution capabilities — all on one solution. LCX is headquartered in Vaduz with offices in Zug and New Delhi. To learn more, visit www.lcx.com and follow us on twitter at @LCX.

Comcorp is a proud South African software company. Their focus is on digital onboarding, system integration and digital identity. Comcorp’s latest innovation is Curata – a Biometric Authentication solution. Curata is designed to allow (a) users to authenticate themselves using facial recognition against (the) South Africa’s population register. BioID PhotoVerify enriches Curata to be a completely automated onboarding solution by performing highly trusted face match and biometric anti-spoofing in real time.

“Comcorp has chosen BioID as their Trusted Technology Partner. After 26 years in the financial services business, the need to protect our customers and their data remains at the forefront of our business model. As technology advances, we need to ensure a smooth but secure user experience.”, says Marcel Zeier, Head of Sales at Comcorp. “It is our view that BioID offers Curata the strongest levels of authentication with the frictionless user experience necessary for the financial services industry.”

Strong customer authentication (SCA) involving facial recognition and liveness detection supports regulatory compliance in line with South Africa’s Protection of Personal Information (POPI), PSD2, Open Banking and Open Data.

About Curata
Presently our product stack includes a Secure Data Exchange that offers banks and other credit providers secure, encrypted access to proof of income, eKYC & FICA data. In a world of multiple digital identities, a person’s consent becomes allencompassing when conducting face to face and non-face to face transactions. Curata’s facial recognition allows trusted authentication of their digital identity.

Curata offers the following benefits:
• Other iterations of Curata include facial extraction and matching from a national identity document
• A full API is available for integration into existing systems, websites or an App
• Prevents Identity theft and eliminates fraud
• Allows for fast credit application processes
• Enhances non face-to-face transactions
• Fully GDPR and POPI compliant
• Open Data/Open Banking/PSD2 Ready and supports Zero Trust initiatives

Curata is being used in the following case studies:
1. Combatting fraud in the vehicle and asset finance industry.
2. Secure bank card deliveries.

Comcorp is a proud South African software company. Their focus is on digital onboarding, system integration and digital identity. Comcorp’s latest innovation is Curata – a Biometric Authentication solution. Curata is designed to allow (a) users to authenticate themselves using facial recognition against (the) South Africa’s population register. BioID PhotoVerify enriches Curata to be a completely automated onboarding solution by performing highly trusted face match and biometric anti-spoofing in real time.

“Comcorp has chosen BioID as their Trusted Technology Partner. After 26 years in the financial services business, the need to protect our customers and their data remains at the forefront of our business model. As technology advances, we need to ensure a smooth but secure user experience.”, says Marcel Zeier, Head of Sales at Comcorp. “It is our view that BioID offers Curata the strongest levels of authentication with the frictionless user experience necessary for the financial services industry.” 

Strong customer authentication (SCA) involving facial recognition and liveness detection supports regulatory compliance in line with South Africa’s Protection of Personal Information (POPI), PSD2, Open Banking and Open Data.

ABOUT CURATA

Presently our product stack includes a Secure Data Exchange that offers banks and other credit providers secure, encrypted access to proof of income, eKYC & FICA data. In a world of multiple digital identities, a person’s consent becomes all-encompassing when conducting face to face and non-face to face transactions. Curata’s facial recognition allows trusted authentication of their digital identity.

Curata offers the following benefits:

• Other iterations of Curata include facial extraction and matching from a national identity document
• A full API is available for integration into existing systems, websites or an App
• Prevents Identity theft and eliminates fraud
• Allows for fast credit application processes
• Enhances non face-to-face transactions
• Fully GDPR and POPI compliant
• Open Data/Open Banking/PSD2 Ready and supports Zero Trust initiatives

Curata is being used in the following case studies:

• Combatting fraud in the vehicle and asset finance industry
• Secure bank card deliveries

ABOUT PHOTOVERIFY

BioID’s proprietary technology PhotoVerify combines anti-spoofing technology and face recognition to check the legitimate user’s presence. This process works with any device and any off-the-shelf camera, requiring two selfies and an ID photo only. Presentation attack detection is the strength of the BioID Web Service to prevent frauds using photos, videos or masks. With BioID PhotoVerify, service providers can be sure that the person submitting an ID is actually the owner of the ID. Therefore, BioID’s technology is an important factor in any automated identity verification solution, enabling eKYC with biometrics.

As a certified identity proofing service provider, Digidentity verifies over 20 million identities and their technology processes more than 300 million authentications a year. Offering remote identity verification for GOV.UK Verify, Digidentity enables the British public to access a wide range of governmental services online. Among other security features, facial recognition and biometric liveness detection by BioID are used for verifying the ID ownership and deterring fraud by presentation attacks. When validating identity online, a crucial and mandatory element to preventing identity fraud is to make sure the physical and digital person are genuinely connected. Digidentity’s trusted solutions streamline the process in real-time making human intervention unnecessary in most cases.

SCALING GOV.UK VERIFY IDENTITY PROOFING DURING COVID-19

COVID-19 has boosted the growing need of an autonomous solution to replace physical face-to-face governmental services. To maintain public administration, remote identity verification with high levels of assurance is required for a huge number of users. Within a few weeks only, Digidentity was able to scale up its service and now can onboard more than 400 UK identities per minute. BioID’s technology powered by its patented liveness detection allows for a fast and accurate service that can be accessed easily from any device within seconds. It only requires two selfies and an ID photo either retrieved via NFC technology, or captured using the mobile camera, to check the user’s presence in real-time and prevent identity fraud.

NEXT LEVEL EIDAS, KYC & AML REGULATORY COMPLIANCE

Trust and security do not stop at on-boarding. As a certified Trust Service Provider (TSP), Digidentity offers a full range of digital identity services that are compliant with a variety of regulations such as KYC, 5AMLD and eIDAS. BioID’s integration brings the service to the next level by means of a frictionless, automated user journey throughout the entire identity lifecycle.

Marcel Wendt, CTO of Digidentity: “We are proud to partner with BioID in supporting GOV.UK Verify during this unprecedented situation in completing critical remote identity verification. We offer organisations an easy and secure way to verify their users. Part of the verification is the ‘selfie check’ where we check if the selfie sent to us is the same as the photo on the chip of the ID document. By working together with BioID, we can further automate this process, providing a face-to-face level of assurance with liveness detection and making sure the person on the other side is really who they say they are with facial recognition.”

ABOUT DIGIDENTITY

Digidentity is a global online identity verification company, combining smooth usability with government-grade security. Digidentity is part of Solera Holdings, Inc., a global leader in risk and asset management data and software solutions for the insurance and automotive industries. Last year alone, Digidentity’s technology processed over 300 million authentications and protected the digital identity of more than 20 million people globally. It makes online identification easier, quicker, and more secure. We enable safe digital communication between individuals and government – both in the United Kingdom and The Netherlands – and are continuously developing new and improved services. Our rigorous approach to privacy and security means that not even Digidentity employees will be able to access your data.

Until only 3 years ago, liveness detection certification was a non-existent topic in the commercial facial recognition industry. Not only was no term defined publicly if it came to biometric anti-spoofing. Back then, in the absence of comprehensive solutions securing facial recognition against attacks, there was no public discussion on biometric anti-spoofing at all. Consequently, no objective and comparable liveness detection certification or evaluation was available. This has changed only recently.

Choosing an Anti-Spoofing Solution

When choosing an anti-spoofing solution, the standard process is to asses a vendor’s technology, background, reputation, as well as credibility (e.g. in terms of GDPR). This can be determined through the vendor’s experience in the market and achievements in the research area (i.e. patents). Carrying out performance testing is an option as well. As more and more new players are entering the field, an evaluation like a liveness detection certification becomes an additional eligibility criterion. This can be especially useful for assessing new vendors without a reputable position on the market.

The ISO standard ISO/IEC 30107-3 for presentation attack detection was introduced in September 2017. This norm has been incorporated in the official FIDO certification process. Also, it has led to independent laboratories offering PAD evaluations based on this ISO norm. If a certified liveness detection is based on this ISO standard ISO/IEC 30107-3, there is a certain element of comparability between the different evaluations. Still, it is important to take a closer look at the testing protocols and results as various laboratories or test centers differ in how they carry out the performance assessment. This can result in disparity of the informative value of liveness detection certifications. Due to limited test scenarios, results might not be transferable to real-life scenarios. Hence, it may always be recommended to perform individual performance assessment before deciding for an anti-spoofing solution.

The following sections are geared at enabling corporates in need for a PAD solution to estimate the informative value of a liveness detection certification.

After reading this article you will know:

• The context and history of liveness detection certifications
• The process for receiving a certified liveness detection
• Different levels of presentation attacks
• How biometric anti-spoofing performance is measured
• The limitations of liveness detection certification

How Liveness Detection Certification Works

A biometric vendor trying to offer a certified liveness detection needs to engage with one of the accredited laboratories and provide a software/hardware solution for evaluation. The small number of accredited laboratories to perform a liveness detection certification include e.g. the German TÜV IT, the Swiss Center for Biometrics Research and Testing (Idiap Research Institute) and the French ELITT/Leti CEA. A full list of accredited test centres can be found in the resources list below.

For offering a certified liveness detection, biometric vendors can either choose to perform a FIDO certification or do a mere PAD evaluation. In addition to the PAD performance, a FIDO certification also includes the biometric verification (facial recognition) performance. During both performance tests, biometric anti-spoofing systems are challenged with different presentation attacks such as printed photos, paper masks or videos. If successfully tested according to ISO/IEC 30107-3, the biometric vendor receives a testing report (in the case of a PAD evaluation) or a FIDO certificate (if a full FIDO certification is performed). 

Which Presentation Attacks are Tested

According to FIDO Biometrics Requirements published in 06/2019, there are three levels of presentation attack scenarios which can be tested against. These differ mainly in the time, expertise and equipment needed to create the attack (see table 1). Level A includes simple photo printouts, or a photo presented on a smartphone display, whereas level B additionally includes paper masks or videos of a person. Level C represents silicon masks, as well as high-quality videos of a person presented on a high-resolution display, for instance. Each of these attack examples is called a presentation attack instrument (PAI). The testing is made with classes of attacks, the so called PAI species. Such a PAI species can be an iPhone 8 display presenting photos of various people. Another example of a PAI species are photos of different people printed on the same paper with the same printer. PAD evaluations can be made for each of the levels A-C separately. For a FIDO certification, an algorithm needs to detect spoofing attempts on levels A and B by default.

How Presentation Attack Detection Performance is Measured

For a certified liveness detection, certain values are calculated to assess the performance: APCER (Attack Presentation Classification Error Rate) and BPCER (Bona-fide Presentation Classification Error Rate). APCER calculates the proportion of attacks mistakenly being classified as live persons. BPCER represents the proportion of live persons (also called Bona-fide) being classified as fakes. For mere PAD evaluation, no verification performance takes place. It is only tested whether a presented face came from a live person or not. For a full FIDO certification, the value calculated also includes the verification (facial recognition) result, resulting in IAPMR (Impostor Attack Presentation Match Rate). This number describes the proportion of attacks by impostors incorrectly accepted as the real person.

For receiving a certified liveness detection included in a FIDO certification, 10 presentation attack species (6 from level A and 4 from level B, see table 1) as well as 10 people (subjects) are needed. This results in 100 PAI. Each has a maximum of 5 attempts to spoof the liveness detection. In other words, 50 attempts per species, or 500 spoofing attempts are used altogether. In order to successfully complete this part of the performance testing, the IAPMR needs to be less than 20 % per PAI species, meaning less than 10 of the 50 attempts per species may wrongly be classified as a live person. For more details please see FIDO’s PAD criteria. In order to provide the desired objective performance measurement, liveness detection certifications that are not part of a FIDO certification process should be designed similarly.

Limitations of Liveness Detection Certifications

As implied above, there are certain limitations of liveness detection certifications, which should be kept in mind when using them as decision criterion. For instance, for a PAD evaluation that is independent from FIDO, the vendor himself can choose and decide the level of PAI, the number of attacks and the number of subjects. Also, the test devices can be chosen by the vendor, even for FIDO certifications. Even for a strongly regulated FIDO certification, the number of devices and spoofing scenarios tested is limited. This should be kept in mind as the biometric anti-spoofing can perform differently on unseen presentation attacks. Also, when reviewing the test reports of evaluated/certified solutions, there are details which should be looked at closely, for instance, the false rejection of live people (BPCER). This calculation is often kept unmentioned as there is a direct link between APCER and BPCER: if the solution is designed to perform extremely well on APCER (correctly rejecting fakes), this can result in a higher BPCER (falsely rejecting live people). In a real-world scenario, of course, this has to be balanced in order to create security and usability at the same time. If you’re interested in such a solution, you can go to the BioID Playground for testing and find more information about BioID liveness detection here.

Certified Liveness Detection in Context

As a German biometrics company with more than 20 years of experience in the market, BioID sees with great interest how the biometrics industry is changing. With its multiple patents, BioID is a leading player worldwide to offer software-based biometric anti-spoofing. As the demand for facial recognition is growing, the market has seen many new entrants and a broad diversification of offerings. As such, standards like the ISO/IEC 30107-3 offer guidelines for an objective measurement for presentation attack detection performance. For a buying decision, while a liveness detection certification does facilitate the assessment process, one must pay attention to their intended application by considering factors such as ease of integration, user experience, as well as vendor credibility (e.g. in terms of GDPR). Every application scenario is different and the best way to find a suitable anti-spoofing solution is to find a trusted & experienced vendor.

To facilitate our customer’s decision making, BioID is currently performing a PAD evaluation as well as a FIDO certification (as part of a client’s solution). In addition, BioID Liveness Detection can be tested and evaluated at the BioID Playground. For integration of our Web-APIs into your services, please request a free trial instance.
Contact us for more information. 

RESOURCES ON LIVENESS DETECTION CERTIFICATION

• For more information on FIDO Biometric Component Testing please see: https://fidoalliance.org/certification/biometric-component-certification/
• FIDO Biometrics Requirements; Final Document, June 06, 2019: https://fidoalliance.org/specs/biometric/requirements/
• ISO/IEC 30107-3:2017 Information technology — Biometric presentation attack detection — Part 3: Testing and reporting: https://www.iso.org/standard/67381.html
• Link to accredited test laboratories: https://fidoalliance.org/certification/biometric-component-certification/fido-accredited-biometric-laboratories/