How to know if whoever tries to verify his or her identity is a person physically present and not a photo, video or false representation?
That's one of the questions that companies have to solve that incorporates customers, formalizes operations or allows access to services using digital channels.
Technology known as liveness detection or biometric liveness detection helps to evaluate whether face capture corresponds to a genuine presentation, rather than some suplanting attempts.
Nevertheless, not all liveness detections work the same way.
Existen dos enfoques ampliamente utilizados: vital and passiveAlthough they have a related goal, they have differences in the user's experience, capture mechanisms and their implementation.
What does your company require? The answer depends on the risks you seek to mitigate, the experience you want to offer and the technical evidence available about each solution.
What's liveness or biometric liveness detection?
The term liveness It's used to describe technologies that analyse biometric capture characteristics with the aim of determining whether a genuine person's presentation exists.
In face biometrics, these technologies can help to detect some suplanting attempts by using photographs, videos that have been shown on screens or masks.
Liveness detection forms part of the mechanisms for detecting presentative attacks, known as PAD (Presentation Attack Detection).
It aims to add a protective layer to the facial capture process.
Why isn't it enough to have a selfie?
A selfie is an image of a face. It itself does not provide sufficient guarantees about how it was obtained or about the person's genuine presence during capture.
For example, a system that only looks for similarities between two photographs could be vulnerable to some suplanting attempts if it does not have other controls.
The liveness detection helps to evaluate capture while facial comparison determines the degree of correspondence between faces.
They're different functions.
Liveness detection: Do the capture have characteristics that are compatible with a person truly present?
Facial Comparison 1:1: Do the face caught corresponds to the reference image?
Documentary validation: What evidence does the data and the ID back up?
For more complete digital monitoring, these checks can be used in a complementary manner. If you are interested, please consult Facial recognition, biometrics and liveness detection: key differences.
What's an activity test?
Active liveness is a modality in which the system requires the person to conduct some actions during capture.
For example:
- Turn his head into a direction.
- Blink as instructed.
- Following a visual instruction.
- Realizar determinados movimientos faciales.
The aim is to analyse the capture response and to check whether it corresponds to the conditions expected by the system.
What benefits can she have?
An active solution can incorporate challenges that serve as additional signs to evaluate an interaction.
According to its design, it can be useful in processes where an explicit response mechanism will be required by the organization during capture.
The existence of challenges, however, does not by itself guarantee more security. It is necessary to evaluate their real resistance to different attacks.
What matters should be considered?
The user should understand and complete the instructions.
If challenges are not clearly explained, attempts at capture can be increased, especially with difficulties with light, connectivity, accessibility or device positioning.
Thus, experience should be evaluated with real users and different operational scenarios.
What's a passive liveness detection?
Passive liveness is a modality that analyzes biometric capture information without requiring the user to have the challenges of movement characteristic of an active test.
For example, in a passive facial implementation, the person may only need to place his face correctly with his or her camera and complete his or her required capture.
The system analyzes available signals to evaluate potential presentation attacks.
What benefits can she have?
By reducing explicit actions, passive modality can simplify capture experience.
That's especially interesting for companies that integrate customers from mobile devices and seek to avoid unnecessary instructions.
It can also facilitate processes where user experience is an important factor.
The ease of capture however depends on design, device and implementation.
Is the passive liveness detection less secure?
No necesariamente.
Security cannot be determined only by the presence or absence of movements.
A passive solution with good results in independent evaluations can provide adequate protection from threats covered by these tests.
Similarly, an active solution may have limitations to some attacks.
The correct comparison should consider laboratory results, types of attacks evaluated, classification errors and actual conditions of use.
Liveness activo vs. pasivo: principales diferencias
| Characteristic | Activo | Pasivo |
|---|---|---|
| Interaction | Requests specific actions | No explicit challenges of movement required |
| Capture | Following instructions or challenges | A guided capture complete |
| Experiencia | Depends on how easy challenges are to be met | May require less actions |
| Tiempo | Depends on challenges and challenges | Depends on capture and processing |
| Security | Depends on system and attacks evaluated | Depends on system and attacks evaluated |
| Integration | Depending on the supplier | Depending on the supplier |
| Accesibilidad | Requires evaluating if challenges are accessible | Requires evaluating capture and user conditions |
No modality is universally higher.
The choice should be based on risk, usability and evidence about the conduct of the solution.
What kind of fraud are you trying to detect?
The presentation attacks attempt to mislead the biometric system by presenting an artifact to the capture device.
Examples include:
Printed photographs
A person tries to put forward a photo of the legitimate incumbent in front of the camera.
On-screen photographs
It uses another device to show a person's face and put him through a genuine capture.
Videos reproducidos
The attacker has a face recording with movements or expressions.
Masks and three-dimensional representations
objects that reproduce some facial characteristics are used.
The efficiency of the detection depends on the technologies and the conditions evaluated.
The liveness detection also detects deefakes?
Deepfakes introduce an additional challenge.
A digitally generated or manipulated image or video can be used in fraud attempts. Also, there are injection attacks that seek to introduce digital content directly into the capture flow.
The distinction is important: presenting a video to a camera isn't the same attack as injecting a manipulated sign into an application.
The traditional testing for presentation attacks does not necessarily show resistance to all forms of digital injection.
A safety architecture should therefore consider additional controls to protect the source of capture and the integrity of the process.
What does it mean for a liveness solution to be evaluated by iBeta?
iBeta is an independent laboratory that conduct monitoring of production attacks according to standards related methodologies ISO/ IEC 30107-3.
That rule lays down methods and criteria for testing and reporting performance of mechanisms PAD.
The tests may examine the response of a solution to particular artifacts and conditions of attack.
What's that? iBeta Level 1?
Level 1 iBeta includes presentation attacks built with relatively accessible resources and without requiring specialist knowledge from the attacker.
The evaluation uses a defined range of artifacts, conditions and metrics.
Overcoming a Level 1 assessment does not mean that all existing attacks are detected and that a solution has been as secure as possible.
What metrics should be revised?
Two metrics used in evaluations PAD are:
APCER: ratio of attack presentations that the system misclassifies as genuine, as evaluated by stage.
BPCER: ratio of genuine presentations that the system misclassifies as attacks, depending on the conditions of proof.
These metrics allow us to evaluate different aspects: resistance to attacks and potential rejection by legitimate users.
For an enterprise, it's important to review both and understand what version, device and conditions were evaluated.
What sectors can benefit from a liveness detection?
The usefulness of survival depends on the process in which it is applied.
Bancos e instituciones financieras
In remote incorporation processes, the liveness detection can be used as an additional monitoring to evaluate a person's genuine presence.
The implementation of these policies should be consistent with the applicable regulations, financial product and risk policies of each institution.
An entity can be combined with documentary checks, face comparison and transactional controls.
Fingers and digital credit platforms
Fintechis can use liveness while creating accounts, applying for services or some access recovery procedures.
It's important to balance fraud prevention and ease of use in these processes.
Biometric checks do not replace credit valuation and authorisation of financial products.
SOFOMES
A SOFOM can incorporate the liveness detection to support the identification of applicants and complement their digital file.
The information obtained can be used as part of the identification checks defined by the institution.
Inmobiliarias
In operations that require to identify buyers, vendors, leasers or leases, the liveness can complement document review.
Using them can help to evaluate whether a person is present during remote capture.
It does not replace other legal identification requirements and obligations applicable to vulnerable activities.
Loan and legal services
Biometric checks can provide additional technological checks in some procedures.
Nevertheless, it does not automatically replace public faith, appearance or other formalities required by law.
Digital platforms and services
Companies offering remote services can use liveness detections in specific situations, such as enrollment or some more at risk processes.
The frequency should be determined proportionally and should avoid applying for biometric data as necessary.
How to choose a living solution?
Before hiring, we should answer seven questions.
1. What attacks does your company have to mitigate?
Not all operations face the same risks.
It's important to identify if the main concern are photographs, videos, masks, digital injections or other suplanting mechanisms.
2. What independent evidence does the solution have?
Check if you have laboratory evaluations, achieved levels, evaluated version and test conditions.
3. How does it work for legitimate users?
The completion rate, reattempts and rejections of genuine users directly influence the operation.
4. How accessible is it?
The process should consider people with different capabilities, devices, light conditions and connectivity.
5. How does it integrate?
Check available web platform options, API or SDKand compatibility and technical conditions.
6. How do you manage unfinished results?
A failed capture should not be automatically classified as an attempt at fraud.
Policies are required for retrying and monitoring incidents.
7. How do biometric data protect?
The processing of personal data, security measures and storage periods have to be evaluated before implementation.
A well-implemented liveness detection should work as part of an identity and security strategy, not as an isolated technological decision.
Passive Liveness detection with JAAK
In JAAK We have developed an identity monitoring technology that incorporates passive face liveness detectioning.
Our approach aims to integrate biometric controls into digital processes without requiring the challenges of movement characteristic of active liveness.
The solution includes life detection as part of an identification procedure and can be complemented with other capabilities, depending on the service contracted:
- Facial biometric comparison 1:1.
- Collection and collection.
- Information ratings.
- Record of results and events available.
- Integration with business processes.
The documentation of Liveness of JAAK includes evaluation results and scores, selection of capture images and event records.
JAAK Communicates an assessment iBeta Level 1 for your passive liveness detection. The scope, the evaluated version and the evidence of that assessment should be confirmed with official technical documentation.
Know more about Identification with JAAK.
What kind of companies can use this solution?
Organizations that require biometric checks to be incorporated into digital processes of client identification, recruitment or incorporation.
The terms and conditions of implementation and recruitment will depend on the product and modality required.
FAQ about liveness
¿Liveness That's the same as facial recognition?
No. Liveness evaluate signs related to genuine presence during capture while facial recognition compares face characteristics with a reference or set of references.
What's best, active or passive liveness?
No universal response. The decision depends on challenges, user experience and solution assessment results.
Do passive liveness require users to move their heads?
It does not require the challenges of movement proper to the active modality but does require an appropriate capture and following system instructions.
A liveness detection prevents all biometric frauds?
No. It helps to mitigate some attacks but should be complemented with other controls depending on the risks of the process.
Is life proof obligatory for all companies in Mexico?
There is no general obligation to integrate liability into all business activities and concrete requirements have to be analysed by industry and applicable provisions.
Can you use liveness without a INE?
Yes. It can be used as an independent biometric monitoring within some processes, but does not as itself amount to complete documentary identity verification.
Is that the same liveness as Face ID?
No. Face ID is a specific facial authentication technology. Liveness is a broader concept related to detecting genuine presentations and biometric attacks.
What happens when a liveness detection fails?
Depending on the result. It may be due to problems with capture, quality, environmental conditions or signs related to attacks. The company should define the treatment of each situation.
The best solution isn't to demand more movements
A secure biometric experience doesn't depend only on asking the user to flash, turn his head or complete a sequence of instructions.
It depends on understanding threats, using mechanisms evaluated and designing an appropriate process for each operation.
Active and passive livelihoods are approaches that have to be analysed with criteria of safety, accessibility and experience.
The question isn't how many moves the user does but what controls the company needs to verify a genuine presence.
In JAAK We help organisations to integrate passive life and identity testing into their digital processes.
Do your company need to evaluate a biometric liveness solution?
Know about passive life-testing technologies from JAAK and request a demonstration to identify what configuration suits your needs. Request a demonstration.