BT/ AWS brings Amazon One palm-scanning authentication to the enterprise

December 6th 2023

Biometrics biweekly vol. 78, 20th November — 4th December

TL;DR

Amazon’s cloud computing subsidiary AWS (Amazon Web Services) has lifted the lid on a new palm-scanning identity service that allows companies to authenticate people when entering physical premises
INTERPOL to roll out biometric matching tool
Microsoft misses its own protocol, laptop fingerprint biometrics defeated in test
Apple rumored to be retiring fingerprint biometrics on iPhones
Paravision and Persona launch facial age estimation tech with a focus on ethics
Clearview AI tops 40 billion reference images in facial recognition database
ZeroBiometrics wins patent for biometric cryptography method
FaceTec brings on standards executive from the Kantara Initiative
Axon Wireless to integrate Tech5’s contactless fingerprint biometrics
ROCai upgrades PAD capabilities of face biometrics SDK
Liveness detection challenge to prevent AI voice fraud launched by US regulator
Credivera’s workforce digital identity platform put to the test by govt agency
Precise Biometrics gets kudos from cold wallet exec along with integration
Idex receives initial order for biometric metal payment cards
Shufti Pro, Sumsub upgrade platforms for faster selfie biometrics processing
Biometric proof of humanity on blockchain launched by LTO, OpenChat
New pairings in the global financial sector for Prove, ConnectID, Aware, Authlete
MOSIP in the final stages of biometric device certification framework development
Keyless goes independent, raises $6M, plans behavioral biometrics development
Contactless fingerprint biometrics move towards police deployment with UK trials
US patent granted to Smart Engines to improve ID document scan speed, accuracy
EU embraces shared ground with Canada in digital partnership
Switzerland presents national digital ID, adoption expected in 2026
Italian telco introduces eSIM activation with digital ID
New Zealand plans public consultations on draft biometrics code in early 2024
Indonesia amends legislation to introduce digital ID for access to govt services
Vietnam makes iris biometrics a requirement in revised digital ID draft law
Colombia launches Digital Identity 2.0
Philippines and Malaysia add new biometric banking options
Study finds people believe AI-generated faces are real, especially white ones
Biometric industry events. And more!

Biometrics Market

The Biometric system market size is projected to grow from USD 36.6 billion in 2020 to USD 68.6 billion by 2025; it is estimated to grow at a CAGR of 13.4% during the forecast period. Increasing use of biometrics in consumer electronic devices for authentication and identification purposes, the growing need for surveillance and security with the heightened threat of terrorist attacks, and the surging adoption of biometric technology in automotive applications are the major factors propelling the growth of the biometric system market.

Biometric Research & Development

Latest Research:

Study finds people believe AI-generated faces are real, especially white ones

AI-generated faces are becoming so realistic that people often can’t detect whether or not they are human.

A new study has revealed that AI-made faces of white people may appear especially realistic, with humans choosing them more often as real faces than actual human faces. And while humans seem unable to tell apart real faces from fake ones, a machine learning system developed by the researchers proved it can complete the task with 94 percent accuracy.

Schematic illustration of face-space theory: A potential explanation for AI hyperrealism. Orange dots show sample distribution of human faces; purple dots show hypothesized distribution of AI faces. We focus on relevant abstract principles of face-space theory (e.g., relating to single images of faces in human perception).

During the experiment, 124 participants tried to determine which of the faces they were shown were machine-made. Participants judged 66 percent of AI-generated faces of white people as human. In comparison, only 51 percent of real human faces were judged as such. The scientists termed the phenomenon “AI hyperrealism.”

Paradoxically, respondents who made the most errors in this task were the most confident of their choice, a result scientists attribute to a psychological tendency to overestimate competence at a task known as the Dunning-Kruger effect.

The study results may have implications for detecting fraud.

“If people mistake AI faces as human but have low confidence in their judgment, they may respond more cautiously (e.g., investigating an online profile),” the scientists write. “However, if they are convinced their judgment is correct, their errors may be more consequential (e.g., falling for a fraudulent profile).”

The research was conducted by a team of psychologists from the Australian National University, the University of Toronto, the University College London, the University of Amsterdam and the University of Aberdeen. The findings were published in the journal Psychological Science.

Faces judged most often as (a) human and (b) AI. The stimulus type (AI or human; male or female), the stimulus ID (Nightingale & Farid, 2022), and the percentage of participants who judged the face as (a) human or (b) AI are listed below each face.

The study also found that the results did not hold for images of people of color, possibly because the algorithm used to generate AI faces was largely trained on images of white people. This means that AI could produce more realistic situations for white faces than faces of other racial denominations. The disparity could lead to real-world outcomes such as misleading scientific conclusions and social biases.

“If AI faces do appear more realistic for white faces than other groups, their use will confound perceptions of race with perceptions of being ‘human’,” the researchers wrote.

Researchers also conducted a second experiment in which they tried to determine which visual differences between AI and human faces people are most likely to misinterpret.

The team asked 610 participants to rate the faces according to 14 attributes, including eye contact, attractiveness, age and symmetry. The main factors that led people to erroneously believe AI faces were human included greater proportionality in the face, greater familiarity and less memorability.

Main News:

Amazon’s One palm biometrics readers for businesses get a lukewarm introduction

Amazon’s cloud computing subsidiary AWS (Amazon Web Services) has lifted the lid on a new palm-scanning identity service that allows companies to authenticate people when entering physical premises.

The announcement comes as part of AWS’s annual re:Invent conference, which is running in Las Vegas for the duration of this week.

Amazon One Enterprise, as the new service is called, builds on the company’s existing Amazon One offering, which it debuted back in 2020 to enable biometric payments in Amazon’s own surveillance-powered cashierless stores. Visitors to Amazon Go stores can associate their payment card with their palm-print, allowing them to enter the store and complete their transaction by hovering their hand over a scanner.

While the technology has raised concerns over how Amazon manages and processes biometric data, in the intervening years the company has doubled down on the technology, offering cash incentives to entice customers to enroll their palm-prints, expanding the service to all of its Whole Foods stores in the U.S., and forging partnerships with third-party retailers.

Amazon One Enterprise seems a natural extension for this technology, given Amazon’s role in the enterprise software stack and dominance in the cloud infrastructure market. Despite the remote work revolution, companies still want their workers in the office, at least some of the time. And with Amazon One Enterprise, they can deploy contactless authentication devices wherever people flow, be that office foyers, universities or airports — and everywhere in between.

Moreover, Amazon says the technology can also be used to control access to certain restricted software, perhaps where financial or HR data resides. This effectively positions Amazon One Enterprise as a potential replacement for multiple forms of identification, such as badges and fobs that are typically used to access buildings, and passwords and PINs used to access software.

Companies wanting to install Amazon One Enterprise have the choice of two scanning devices — a standalone contraption that they can embed wherever they need it such as a doorway or barrier, and one that comes mounted on a pedestal that can be placed anywhere. From there, workers will have to enroll in Amazon One Enterprise using their physical badge before associating their palm-print with their profile. Or, if the normal authentication method is a password or PIN, as is more likely to be the case with software, they can also associate their palm-print with such credentials during the enrolment phase.

Amazon One Enterprise. Image Credits: Amazon

While Amazon’s new enterprise palm-scanning service is clearly based on the same technology and infrastructure as its consumer offering, the company is keen to stress that it’s distinct from the system that people use to authenticate themselves at retail stores. Enterprise-grade data privacy, and all that.

“You will not be able to use your palm to pay at a Whole Foods Market or other Amazon One-enabled locations even if you enroll at an enterprise,” the company notes in a FAQ. “This is because, with Amazon One Enterprise, we offer a private collection of palm signatures for each enterprise resulting in strong data isolation and security.”

The company says that it stores users’ palm-print and badge ID on AWS Cloud, though they can delete their biometric data through an Amazon One enrollment device similar to the one they originally used to sign up. Amazon also says that it will automatically delete users’ data if they don’t interact with an Amazon One Enterprise device for two years.

Amazon One Enterprise is available in preview for U.S. customers now.

INTERPOL to roll out biometric matching tool

INTERPOL has begun to deploy the Biometric Hub, or BioHub, a biometric system that lets police instantly check individuals’ faces and fingerprints against the international policing agency’s biometric database. Developed by IDEMIA, the system was tested across six countries in the Adriatic region, where it was used to detect wanted individuals attempting to move across irregular border crossings. INTERPOL says the tool will be rolled out to its member police and border control agencies over the next two years, and that it expects about a million searches per day using the tool once it is fully deployed.

Microsoft misses own protocol, laptop fingerprint biometrics defeated in test

Microsoft’s Hello biometric authentication software has proven surprisingly fallible in a security test, requested by the software company, of three vendors’ laptops.

The challenge involved Microsoft’s Surface Pro Type Cover with an Elan fingerprint sensor, Lenovo’s ThinkPad T14s with a Synaptics sensor and Dell’s Inspiron 15 loaded with a Goodix. Each chip performs the biometric match in-sensor.

Blackwing Intelligence performed three months of testing that “resulted in three 100% reliable bypasses” of Hello authentication. Its researchers confessed surprise that of the three setups the Surface Pro fell easiest.

They have documented what they found in detail and say they will go even deeper with a follow-up report.

At the risk of oversimplification, it seems that the common element tied to each biometric hack is Microsoft’s Secure Device Connection Protocol. The protocol is standards and secure-communication rules.

In all three cases, the protocol was insufficiently enabled, or the system was architected in a way that it was sidelined. It was, in fact, not implemented in the Surface Pro — Microsoft’s Surface Pro.

Closing this hole is easy for vendors. Blackwing says they just have to enable the protocol. And for good measure, the researchers say, get an independent audit of the software implementation before a white hat firm starts digging around.

Apple rumored to be retiring fingerprint biometrics on iPhones

The next generation of iPhones may not come with Apple’s biometric fingerprint sensor TouchID, according to whispers from the Chinese social media network Weibo.

Most of the equipment used to manufacture the chips required for the iPhone’s version of Touch ID has reportedly been shut down, pointing towards the conclusion that Apple will no longer be unlocking phones with fingerprint identification, MacRumors reported citing an anonymous Weibo account.

The news comes despite earlier rumors pointing towards Apple’s plans to debut under-display fingerprint technology around 2026.

“Recently, there have been reports that Apple will use fingerprint recognition on its new iPhone. The fingerprint recognition chip is a special 8-inch technology, and most of these devices that were originally used for Apple’s fingerprint recognition have been turned off and sealed. Basically, Apple will not use fingerprint recognition as the direction for unlocking phones,” Weibo user Mobile Chip Expert writes.

The source has some credence, according to MacRumors. They were the first to report that the iPhone 14 would retain the A15 Bionic chip, with the A16 being exclusive to the ‌‌iPhone 14‌‌ Pro models.

No news has been announced about changes in TouchID technology in the iPad, MacBook or iMac keyboard. Back in June, Apple was reportedly granted a U.S. patent for fingerprint biometrics on Macs.

Iris biometric patents

Meanwhile, the Cupertino, California-based company has filed two new patent applications to the U.S. Patent and Trademark Office related to its biometric authenticator Optic ID under the codes 20230379564 and 20230377302.

The former describes a “Biometric Authentication System” relying on the “iris, eye, periorbital region, and/or other regions of the person’s face” to authenticate the individual and detect spoofing attempts. The latter addresses “Flexible Illumination for Imaging Systems,” with the flexibility referring to using a different lighting configuration to perform biometric authentication.

Iris biometric technology Optic ID will be used in Apple’s mixed reality headset Vision Pro which was revealed in June. The headset is expected to ship early next year for US$3,499. The new patents are a part of the Vision Pro’s enrollment process, according to Patently Apple.

Paravision and Persona launch facial age estimation tech with a focus on ethics

A new age estimation and verification tool is on the market, care of Persona and Paravision. The partners have teamed up to leverage AI in the quest to humanize digital identity and set ethical standards for developers. A company release says that the face biometrics product is designed with ethics in mind, trained on a diverse data set and audited to detect and mitigate bias — calling it an industry first for age estimation.

“The need for reliable, responsible age estimation technology has never been more pressing, particularly in light of the growing concerns around children’s online presence as well as leveraging ethical approaches to AI,” says Joey Pritikin, chief product officer for Paravision. “We are thrilled to be working with Persona to launch a solution that will help ensure the safety and well-being of children and teenagers online, while meeting rigorous ethical standards.”

The emphasis on ethics is in part a response to recent legislative moves to control what kids can and can’t see online. The release points to the bipartisan Kids Online Safety Act in the U.S. and quotes the UK’s Online Safety Act’s specific mention of “age verification or age estimation (or both) to prevent children of any age from encountering primary priority content that is harmful to children which the provider identifies on the service.”

In addition to established concerns about pornography, social media and luring, there is now also the impact of AI to consider. Here, too, the law is prompting new exigencies for facial age verification technology, with President Joe Biden’s recent Executive Order on AI being among the most visible examples.

‘It is encouraging to see lawmakers pushing platforms, and therefore their identity solution providers, towards greater innovation and responsibility, says Persona Head of Identity Products Daniel Lee. “The mandate is clear: we must balance the delivery of high-assurance, unbiased solutions with safeguarding end user privacy.”

Persona and Paravision’s new offering aims to achieve that balance, providing efficiency and agility in a fast-changing market. Age estimation of selfie biometrics can eliminate the need for government-issued ID checks, depending on how old one is estimated to be. (Presumably, greybeards will no longer need to prove the legitimacy of their decline.) The granular data retention and redaction policies applied to Persona’s real-time dynamic verification flow mean seamless experiences need not come at the expense of data privacy. Furthermore, demonstrated compliance and ethical data stewardship make firms less likely to come under scrutiny from regulators, as the world races to keep up with technology that is evolving by the day.

ZeroBiometrics wins patent for biometric cryptography method

ZeroBiometrics has patented a method of generating reproducible cryptographic keys from biometric entropy and performing biometric authentication, both using zero-knowledge proofs.

The company emphasizes the security and privacy advantages of not storing either biometric templates or end-user’s cryptographic keys in the announcement.

The patent from the United States Patent and Trademark Organization (USPTO) protects a method that provides these benefits while meeting or exceeding the accuracy and usability level of traditional biometrics, the company says.

CEO Alfred Chan say ZeroBiometrics has solved multiple puzzles that have stumped researchers in academia and the biometrics industry for decades.

“Our patent addresses our methods for producing a consistent, stable, and non-reversible hash value drawn directly from biometric data,” Chan says. “This permits us to perform deterministic matching in the hash space, which offers distinct security and privacy improvements over the use of probabilistic matching between highly sensitive and often reversible biometric templates. Importantly, we also enable long-sought-after biometric revocability and re-issuance without requiring a new biometric capture session.”
The technology is appropriate for use cases like proof-of-humanity, Chan says, “with unique benefits in the many identity use cases that rely upon proof-of-possession of cryptographic keys. In particular, our customers in the decentralized identity, Web3, and digital wallet markets find our ephemeral cryptography technology to be a major differentiator.”

ZeroBiometrics was launched by Infinity Optics as the brand for its mobile authentication platform just over a year ago, and the platform was subsequently chosen for integration into EclipseIR’s biometric security software.

Clearview AI tops 40 billion reference images in facial recognition database

Clearview AI’s reference database for facial recognition searches has surpassed 40 billion images, double its volume of just 20 months ago.

The milestone was revealed in a Time article detailing the use of Clearview’s technology by the government and defense forces of Ukraine in its war with Russia. The article describes the use of Clearview’s facial recognition by 18 Ukrainian government agencies, and identification of more than 230,000 Russian soldiers. Deputy Minister of Internal Affairs Leonid Tymchenko calls it Ukraine’s “secret weapon.”

When Clearview first made its facial recognition available to Ukraine’s Ministry of Defense in March, 2022, the company’s database held 2 billion images culled from Russian social media. Weeks later, the company revealed it had crossed the 20 billion image mark.

Clearview engineer Terence discussed how the company keeps search times down with such a massive database in an interview with Biometric Update in June.

The images added to the biometric database have been collected mainly from the same sources, CEO Hoan Ton-That says, but with an increased focus on websites from Eastern Europe, including OK.ru.

Ton-That suggested in a presentation to investors that Clearview will eventually reach 100 billion images. He says the company will get there by continuing to collect images while it decreases its costs.

“Our cost to search and store 40B images is 36 percent less than our cost for 30B images,” he tells Biometric Update in an email. This was done with cutting edge technical improvements to our proprietary database technology that we have created ourselves, and other infrastructure improvements.”

The main advantage of the increase is the increased ability to return a true positive match, which is the company’s top priority.

“This hit rate continues to improve as we add more photos to the database,” Ton-That says. “Every photo in the dataset is a potential clue that could save a life, provide justice to an innocent victim, prevent a wrongful identification, or exonerate an innocent person.”

The increased database size also contributes to training the algorithm for higher accuracy, he notes.

MOSIP in final stages of biometric device certification framework development

Sanjith Sundaram, ecosystem head at the Modular Open-Source Identity Platform (MOSIP) says a lot of ground has been covered regarding collaborative efforts aimed at developing a certification framework for biometric devices.

Sundaram was speaking earlier this month as he moderated a community meeting organized by the open-source software provider to give updates on the work that is being done to draft the certification framework.

MOSIP is working with partners including BixeLab on this new biometric device certification program.

During the partner community Zoom meeting, Sundaram said they are in the final stages of drafting the framework and are looking forward to the concluding cycle of public comments before the final document is published.

Issues discussed during the meeting included an overview of the framework, the progress made so far in terms of the documents produced, efforts at opening up new avenues for comments review, a review of additional documents and collaboration opportunities, the role of compliance test kits, status of lab onboarding, the dry certification run project and how it will unfold, as well as plans for follow-up meetings.

In the course of the meeting, Sundaram explained the technicalities and objectives of the Secure Biometric Interface (SBI) Standard 1.0 for biometric registration devices which MOSIP developed. He said this standard has four objectives which include biometric replay/injection, cryptographic traceability, standardized interfaces and purpose-driven capture.

Further explaining the importance of the standard, Sundaram said users always lookout for assurance on biometric products before they go for their adoption. For devices to meet requirements of that certification standard model, he added, they must have certain specifications grouped under four categories, namely: interfaces, image quality, hardware and other requirements such as liveness/presentation attack detection.

Sundaram mentioned that the organization is working on different initiatives including API test kits, the MACP (MOSIP Advance Compliance Program) Framework and its experience centers as part of the push to put in place a framework that provides standardized assessment criteria and standard operating procedures to test devices or solutions against set out criteria.

This, he says, will “enable the establishment of standardized MOSIP biometric device certification programs which are capable of providing independent certifications to MOSIP users through empanelled labs.”

Suraj Sivaraman, another MOSIP official, took some time to explain technicalities about the compliance tool kit (CTK), which is an online platform which can be used by MOSIP partners to test compliance for their products developed with MOSIP guidelines and specifications.

Speaking on the dry certification run, Sundaram said the process is part of building the certification network in some sense. The objective, he mentioned, is to strengthen the certification framework and produce first reference of certified products.

Three slots across device profiles will be included in the dry run, he said, and nominations are now open with shortlists expected to be announced either in December or January. “We don’t want many devices to be going through the dry run because it is a highly expensive exercise and then its just a learning exercise,” said Sundaram.

As MOSIP advances with its plan to establish a certification framework for biometric devices, it has been projected that the number of users of the software could hit one billion in the next 18 months, Deccan Herald reports.

Contactless fingerprint biometrics move towards police deployment with UK trials

The performance of software and smartphone cameras for contactless fingerprint capture is promising enough to look towards a possible launch of the technology for police in the field by 2026, attendees heard during the latest EAB (European Association for Biometrics) member lunch talk.

“Findings from pseudo law enforcement operational trials using smartphone contactless fingerprint capture technologies for search use-cases” was presented by Emily Cartledge and Guy Harris of Dstl (the UK government’s Defence Science and Technology Laboratory) and Tony Alexander of the UK Home Office.

The presentation presents findings from search trials that commenced after the Home Office’s biometrics self-enrollment trials, the findings of which were presented in an EAB lunch talk last year.

Today, the Home Office runs the “Rapid Search” capability, in which two fingerprints are collected with a contact-based scanner for biometric comparison. The move to contactless is being considered for their potential to provide the service to more officers, a decrease in costs in the absence of a requirement for a separate scanner, more choice of provider or solution for forces, and the usual advantages of contactless processes.

Harris noted that contactless fingerprint biometrics research traces back to a 2004 U.S. government initiative aimed at speeding up the collection of ten rolled prints to 15 seconds or less.

Dstl ran a proof of concept trial for contactless fingerprint capture in 2019, using the USB-connected Grabba biometric scanner as a baseline. The group found that contactless was viable, but the technology still maturing. Image quality varied significantly depending on the environment and conditions.

One observation that came out of conversations with the Home Office Biometrics User Group is that no searches have been submitted from “a large percentage of the” USB fingerprint scanners issued in the UK, suggesting that they are not being used, Harris says. Coverage is also not universal, he notes, and officers without a fingerprint scanner are generally not able to wait at a crime or investigation scene for another one with one to arrive.

The trials were carried out with Samsung Galaxy S20 devices, and app usability was their main focus, Cartledge says. Apps from five different contactless biometrics vendors were tested in scenarios involving a wide range of lighting conditions. Additional testing considered inappropriate for the trial environment, such as testing on fingers soiled with blood and dirt, was carried out in a lab environment.

The current state of contactless fingerprint capture

Notably, the presence of blood improved image quality scores, apparently improving contrast in a similar way to ink.

The overall test results, however, were mixed.

No false positive matches were recorded, and no scenarios were found to completely prevent contactless fingerprint capture from working. The fastest fingerprints were captured in a 4–4–2 method with the best-performing app taking about 20 to 30 seconds, according to Cartledge.

Challenges observed include hot conditions, shaky subjects, and in some cases capture times. The interface during the capture process could also be improved, at least for some of the apps.

The most accurate app delivered a 2.2 percent false non-match rate (FNMR), similar to the Grabba device tested in 2019. The least-accurate app had a 10.6 percent FNMR. LED lighting was observed to increase the FNMR.

Dstl and Home Office Biometrics are now working on a document to specify “Technical Operational Requirements” for contactless fingerprint capturing.

Harris quoted Michael Ransom of Michigan State Police, who said “Contactless capture is easy to do, but difficult to do well.”

The next steps for the UK’s efforts include an event next year to assess the need for training on contactless fingerprint capturing, and TOR development, and further standards development. In the meantime the Biometric Self-Enrolment Feasibility Trials, which are running in parallel, can help improve stakeholders’ understanding of the issues that come with contactless capture. “Contactless Evaluation for Law Enforcement” events are also planned for 2024 and 2025, to gain insight into training needs and improvements in performance. New vendors to the market will have an opportunity to get involved at that point.

Harris also shared a “pathway to pilot,” which posits 2026 as a target for live operational deployment of contactless fingerprint biometric capture systems.

US patent granted to Smart Engines to improve ID document scan speed, accuracy

Smart Engines has patented a method for determining when an analysis by an artificial intelligence algorithm should be discontinued.

This task is important for applications performing text recognition in a video stream, according to the announcement. These kinds of processes will become faster and more accurate thanks to the now-patented technique, Smart Engines says.

One of the images submitted as part of the patent for “Approximate Modeling of Next Combined Result for Stopping Text-Field Recognition in a Video Stream” depicts a person presenting an ID card to a smartphone, and a screenshot of the data from the ID document as captured by optical character recognition (OCR).

The approach is based on predicting the result of analyzing the next frame, and whether the predicted contribution would improve the result of the process. If the predicted next frame would not improve the result, the process ends.

“Since the company’s inception, we have been committed to the principle of Science First and working at the forefront of science while solving business problems. We have received five patents in the USA this year alone, but we have no intention of stopping. We have a lot of other interesting technologies. As soon as we receive the patents, we will tell you about them,” says Smart Engines CEO Vladimir Arlazarov, who holds a PhD in Computer Science.

Smart Engines now holds six U.S. patents in total, including protection for a weighted integration approach that is already included in its document scanning SDK, which was revealed in June.