BT/ Apple patents multi-function digital ID with liveness, other security features

Paradigm
Paradigm
Published in
24 min readJun 5, 2023

Biometrics biweekly vol. 65, 22nd May — 5th June

TL;DR

  • A U.S. patent has been awarded to Apple for binding biometric authentication to a person’s digital ID. It likely will be combined with a patent-pending way to record biometrics from under a display.
  • Microsoft outlines an approach to regulating the risks of its biometric tech
  • Samsung OLED tech integrates biometric fingerprint and health sensors into a display panel
  • Android biometric safeguards fail to withstand a brute-force attack
  • Amazon is immune to BIPA this time, a biometric privacy suit filed against PimEyes
  • Trust Stamp gains approval for a new patent around ‘lossy’ biometric representation
  • First European certificate program for presentation attack detection
  • NADRA launches Nishan Pakistan platform, lets startups leverage digital identity stack
  • Sei Network integrates Humanode BotBasher
  • RecFaces facial recognition is now available on Linux
  • Finger scanner from Axxeto promises a new approach to biometric authentication
  • OCR Labs to identify as IDVerse, reflecting changes in digital ID verification
  • Idex Biometrics and AuthenTrend partner on biometric access cards
  • IDSA finds ‘almost a fifth’ of businesses see managing digital identity as a top security priority
  • Onfido buys Airside Mobile, plans digital ID service expansion
  • Enacomm unveils AI-based virtual assistant for financial applications
  • Oosto branching out with cloud-to-edge pivot
  • Finger scanner from Axxeto promises a new approach to biometric authentication
  • Zwipe and Idex ink a plethora of supply deals for biometric cards
  • Aratek’s rugged ten-print mobile biometric scanner built for use in the field
  • Socure advances in StateRAMP, posts digital ID playbook
  • Alcatraz updates pricing for facial authentication cloud service
  • US gov’t opens next track for evaluating ID authentication apps
  • G7 ambivalent about generative AI
  • UK online content bill could quietly enable facial recognition
  • Biometric liveness, ID verification integrated with UK digital right-to-rent service
  • Universal global digital identity still 7 years away, OIX presenter says
  • McDonald’s, Telpo customize self-serve, biometric payment kiosks for India, China
  • Palm ID verifies in the US for alcohol buys and in Beijing for subway rides
  • Alice Biometrics earns high-security certification in Spain
  • Vendor claims deepfake fraud ‘doubles’ in North America
  • Namibia no longer requires biometrics as part of SIM card registration
  • Nigeria reaches 100M digital IDs issuance milestone, eyes World Bank target
  • Papua New Guinea could be heading for a country-wide digital identity system ‘by 2025’
  • Data clean-up underway after biometric voter registration exercise in Liberia
  • Evrotrust’s eID scheme made Bulgaria’s official digital identity program, expands to Romania
  • VisionLabs makes a retail deal in Oman, deploys AI checkpoint system with Sberbank
  • YouVerify expands to Kenya, KYC platform updates from Shufti, Veridas, Keesing
  • Facephi enters Saudi Arabia and UAE markets with Qashio, gets AWS approval
  • Missouri launches mDL app, the first state to allow remote ID card renewal
  • India’s Aadhaar-based UPI payment platform allures Japan
  • IrisGuard to verify IDs for aid recipients in Iraq
  • Moscow Metro biometric payment system hits 320,000 users amid surveillance fears
  • São Paulo to proceed with citywide facial recognition program
  • Turkish minister sued after showcasing gov’t facial recognition app
  • Idex raises $11M for commercialization, partners to speed biometric card deployments
  • €46M earmarked for four EU digital identity wallet pilots
  • Worldcoin biometric crypto initiative raises $115M. The project may have a biometric data black market problem
  • Gen Z thinks banks are sus, but biometrics could help, says a new report
  • Biometric industry events. And more!

Biometrics Market

The Biometric system market size is projected to grow from USD 36.6 billion in 2020 to USD 68.6 billion by 2025; it is estimated to grow at a CAGR of 13.4% during the forecast period. Increasing use of biometrics in consumer electronic devices for authentication and identification purposes, the growing need for surveillance and security with the heightened threat of terrorist attacks, and the surging adoption of biometric technology in automotive applications are the major factors propelling the growth of the biometric system market.

Biometric Research & Development

Apple patents multi-function digital ID with liveness, other security features

A U.S. patent has been awarded to Apple for binding biometric authentication to a person’s digital ID. It likely will be combined with a patent-pending way to record biometrics from under a display.

Apple was given that patent last week. It covers Face and Touch ID authentication and automates many processes that involve a digital ID in the company’s digital wallet app. Earlier this year, Apple applied for a patent to capture face, finger and iris biometrics through a device’s display.

The granted patent’s diagrams show how the owner of a phone, having enrolled in a state or federal ID program using their government ID and a selfie biometric check, would choose from a pick list of government ID agencies. That is where the person would link the identification data on the phone or other device to their state profile.

That data could be called up automatically when approaching content or activity that is gated by age. An external reader would ping the phone for a yes or no response to a question about adulthood, for example.

Encountering an unfamiliar reader would prompt the ID app to ask for directions. The device owner would have to tell the software that they want to transact with the reader regardless.

People would set up profiles for organizations and situations that they can anticipate transacting with, including the Transportation Security Administration, banks, favored grocery or department stores, fuel stations, Uber, and the like. Each would only get the personal data needed for its transaction.

Stored in Apple’s Wallet, payment and ID information would be viewable on the same screen as travel documents.

Diagrams indicate that Apple anticipates tying in its map application to the interface.

Biometric liveness tests, according to patent documentation, would be performed solely on the device for data security.

Microsoft outlines an approach to regulating the risks of its biometric tech

Microsoft has highlighted some of the risks of unpoliced biometric adoption, discussing some of the strategies it uses to manage the risks within its own facial and voice recognition software.

Its latest governing AI report outlines what the company calls “sensitive uses” of AI, instances, where executives feel, require closer vetting. The authors also spell out additional oversight that the company claims to be giving such technologies.

Microsoft says a review program provides additional oversight for teams working on higher-risk use cases of its AI systems, which include hands-on, responsible AI project review and consulting processes through its Office of Responsible AI’s Sensitive Uses.

The company claims to have declined to build and deploy specific AI applications, after concluding “that the projects were not sufficiently aligned with our Responsible AI Standard and principles.”

This included vetoing a local California police department’s request for real-time facial recognition via body-worn cameras and dash cams in patrol scenarios, calling this use “premature.”

The Sensitive Uses review process helped form the internal view that there “needed to be a societal conversation around the use of facial recognition and that law needed to be established.”

The report also outlined its limited access policy, under which Microsoft sometimes requires potential customers to apply to use and “disclose their intended use” to make sure “it meets one of our predefined acceptable use cases.”

Microsoft also described how it polices its Azure AI’s custom neural voice application, which is used by AT&T.

The company says in this case it “limited customer access to the service, ensured acceptable use cases were defined and communicated through an application form, implemented speaker consent mechanisms, created specific terms of use, published transparency documentation detailing risks and limitations, and established technical guardrails to help ensure the speaker’s active participation when creating a synthetic voice.”

The White House last week revealed its own plans to protect people from the dangers of AI.

The plans mention Microsoft, as well as Anthropic, Google, Hugging Face, Nvidia, OpenAI and Stability AI opening AI systems to government scrutiny.

Trust Stamp gains approval for a new patent around ‘lossy’ biometric representation

Trust Stamp has gained approval for a new patent from the United States Patent and Trademark Office, pertaining to ‘lossy’ biometric representation.

The newly allowed patent, dubbed “Systems and processes for lossy biometric representation,” concerns the company’s biometric hashing technology, which it uses for subject identity verification.

As per the announcement, this process uses “neural network processing and pseudorandom matrix multiplication to create anonymized vector representations of biometric data that can be compared to confirm a subject’s identity.”

These anonymized vector representations are ‘lossy’ meaning, according to the company’s claims, not all information from the original biometric is included in the anonymized vector representation.

These ‘lossy’ representations will purportedly allow for enhanced security when dealing with a subject’s sensitive biometric data, while still allowing for the anonymized vector representations to be compared to one another for the purposes of identity verification.

The process from the patent has already been integrated into the company’s “Irreversibly Transformed Identity Token (IT2)” technology, a solution that looks to replace the storage and use of biometric templates with an “irreversibly transformed identity token, or IT²” which it says is generated by AI.

The news comes as the Atlanta, Georgia -based firm has been active in terms of pushing through new patents during 2023. The firm received a Notice of Allowance for three different patents last month, relating to securing biometric data and as well as the use of biometric tokens in the metaverse.

According to Dr. Norman Poh, Trust Stamp’s Chief Science Officer, his company has “30 patents now issued, allowed, or pending, over the last seven years.”

Aratek’s rugged ten-print mobile biometric scanner built for use in the field

Aratek is anticipating the widespread adoption of digital ID, and the need for mobile verification hardware, with its new ten-print biometric tablet designed for easy mobile ID management in the field.

According to the global biometrics company’s website, the Marshall 8 Plus biometric enrolment tablet is “targeted squarely at helping governments and institutions build ecosystems for socio-economic development programs.”

The Marshall 8 Plus boasts quality specs and multi-modal biometrics. It contains an FBI Appendix F, Mobile ID FAP 60 certified 4–4–2-fingerprint sensor for ten-print imaging and authentication, and also comes with integrated facial and iris recognition technology. Adding to its toolkit is a native NFC reader for document verification, barcode scanning for ID or payment processing, and a built-in MRZ reader.

The Marshall 8 biometric tablet has an IP65 rating, meaning it can withstand dust and water. Intended for transit and heavy use, it features ergonomic design, a hand strap, and an intuitive, user-friendly interface. Suggested applications include national ID, voter registration, law enforcement, border control, healthcare, transit, and more.

“We expect the Marshall 8 Plus to be the biometric tablet of choice in the massive efforts to develop biometric digital ID ecosystems around the world as part of the grand goal of bridging socio-economic gaps globally, especially in Africa and other developing regions,” said Samuel Wu, vice president for Aratek’s international business division, in a blog post profiling the product.

First European certificate program for presentation attack detection

Working together, a pair of European digital technology metrics firms say they have created a conformity assessment scheme a step that allows them to evaluate and certify biometric software.

The companies are CLR Labs and LSTI, and they launched their ISO/IEC 30107 conformity assessment scheme this week. CLR evaluates biometric and security technologies while LSTI is a conformity assessment body for cybersecurity and data-protection codes.

The certificate’s technical name is LSTI ISO/IEC 30107, but it incorporates CLR’s evaluation. CLR and LSTI collaborated on remote ID verification assessment in 2021.

The conformity assessment scheme is not unlike a quality certification itself. The companies are judged by the cyber industry to offer a guaranteed level of performance assessment of software that detects presentation attacks.

The firms claim theirs is the first such biometric certification scheme in Europe and will be marketed with a “made in Europe” designation. The only other similar certification was awarded by United States evaluators.

Identity proofer IDnow has been issued the first 30107 certificates in Europe for its VideoIdent software, which is a video identity verifier that is assisted by human agents to help with real-time customer onboarding.

NADRA launches Nishan Pakistan platform, lets startups leverage digital identity stack

The National Database and Registration Authority (NADRA) has launched the Beta version of Nishan Pakistan, a platform to enable small and medium-sized businesses in the country to make the most of its digital ID stack.

NADRA Chairman Tariq Malik said in a tweet that Nishan Pakistan is a game-changer platform designed to empower commercial startups and young entrepreneurs with secure and contactless biometric verification through secure data sharing with NADRA.

He said the platform, which offers a world of endless possibilities and a plethora of use cases for businesses including customer identification through biometrics, is the first of its kind online, secure and open digital identity authentication platform in the country.

Malik added that the platform offers an API gateway and a cutting-edge sandbox that enables smooth integration with other systems and will provide a set of services that will help businesses with “a seamless, consistent and connected experience,” and also contribute to ongoing efforts of making Pakistan a truly digital nation.

The official said in another message that the novelty will set the stage for the kind of market-creating innovation that ignites “the economic engine of a country, creates jobs and augments profits that fund public services and promote change culture in the society.”

Nishan Pakistan has been rolled out for user acceptance testing and NADRA is looking out for feedback to improve the functionality of the platform and also help in its plans of creating a strong digital ID system.

Subscriptions to the platform are opened and interested businesses can submit applications and wait for the approval process to be completed in 10–15 days, according to a promotional video.

Sei Network integrates Humanode BotBasher

Humanode announced that Sei Network has fully integrated Humanode BotBasher into its Discord server, and will be utilizing it across its entire ecosystem.

Sei is an open-source Layer 1 blockchain specialized for exchanges, optimizing every layer of the stack to offer infrastructure for trading apps of all types; from gaming to NFTs to DeFi. Leveraging a novel consensus and technical breakthroughs, Sei claims to be the fastest blockchain in existence with a lower bound of 300ms and an upper bound of 20,000 OPS that are being processed. The Sei ecosystem includes over 100 projects which include well-known projects like SushiSwap, Axelar, and Space ID.

BotBasher for Discord is an application that has been created utilizing the Humanode private biometric verification technology, allowing Discord users to privately and securely verify that their account is owned by a unique living human being. Those who have been verified as humans will be able to tie one Discount user account to the verification, giving them a Discord role as a “verified human” (or in the case of the Sei network, a “Verified Seilor”). The whole process takes under 1 minute to complete, and as the verification is semi-permanent (not able to change unless there is a total server wipe and restart of the verification servers), users will only be able to access the Sybil-resistant content with that single user account.

As the BotBasher for Discord works alongside other popular Discord applications, the servers will be able to provide their users with Sybil-resistant voting (1 user, 1 vote), Sybil-resistant whitelisting, one person — one NFT mint, and more.

In the first month of its public beta release, BotBasher has already been installed in 100 Discord servers, and the user base consists of 102,000+ unique human beings. With the Sei ecosystem joining the league of Sybil-resistant servers using BotBasher, Humanode expects its user base to expand rapidly.

RecFaces facial recognition is now available on Linux

Facial recognition technology maker RecFaces is making its flagship products available on Linux operating systems and plans to allow end users to choose operating systems while upgrading.

The company’s two main products are access control solution IdGate, and IdGuard, which allows facial recognition through video streams. Using IdGate on Debian-based OS will provide customers more flexibility, while IdGuard users will be able to deploy facial recognition technology in a broader range of environments to enhance security, the company said in a release.

“This is just the beginning of a new RecFaces’ strategy of updating all our product lines, says Eugenia Marina, business development director for MENA at RecFaces. “We believe it will lead to a more efficient way of providing our solutions to end-customers all over the world”.

The company is also planning a showcase at the Gitex Africa exhibition in Morocco taking place from May 31 to June 2, 2023.

RecFaces says that one of the main advantages of Linux is cost-cutting, including lower costs for host servers and licensing and lower specifications for hardware. Users will be able to maximize the efficiency of RecFaces’ software with its microservices architecture which, combined with containerization, simplifies deployment, updates, and system maintenance.

The software maker’s most recent deals include Dubai’s serviced office operator iSpace and a manufacturing plant in Guatemala. During 2022, the company secured several large projects, including the biometric identification of passengers at Bangkok Metro Chong Nonsi Skywalk and staff at a Telecom Egypt data center.

The formerly Russia-based firm announced in November last year that it will be serving international customers from its Dubai office, a route that many other Russian companies have followed in the wake of the war in Ukraine. The company is present in the MENA, APAC, and LATAM regions.

Finger scanner from Axxeto promises new approach to biometric authentication

In a release announcing its ultrasonic finger scanner, Axxeto makes a point of distinguishing its technology from typical fingerprint scanners.

“The finger scanner uses ultrasonic waves that change shape when they come into contact with a finger,” explains Helmut Strahl, a spokesman for Axxeto, an international consortium of ultrasonic tech professionals. “These waves penetrate the skin and underlying tissue and provide information about the fingerprint, the structure of the skin layers near the surface, and the internal structure of the finger, resulting in highly reliable identification.”

The complex biometrics that Axxeto’s system scans include pulse, blood flow, and other internal data. Using ultrasonic waves that respond to the finger’s shape and features, the scanner produces an impulse response that is then processed into a full fingerprint, with each individual data point in the image containing data from the whole. The system is designed to have potential application for a wide range of touch-based interfaces, such as panes of glass, door handles, or steering wheels. With that in mind, the company says it is resistant to dirt, grease, and water.

Axxeto says its technology, which promises near-instant authentication via “recognition in milliseconds,” is the first of its kind on the market.

The finger scanner can be used with Axxeto Ultrasonic Remote Authentication, or AURA. The platform offers secure remote verification via an analog scanner that works with signal waves, in conjunction with finger data, to create a wave with a unique shape created by the interrelation between the two. A reply, quickly calculated by the system, is used for authentication.

Citing easy workarounds, such as fake fingerprints, and other potential security flaws in conventional biometric fingerprint scanning technology, Axxeto says its tool is uniquely positioned to protect against simulations and copies being leveraged to commit fraud.

US gov’t opens next track for evaluating ID authentication apps

The second track of the U.S. Homeland Security Department’s remote ID validation demo is on.

Homeland Security’s Science and Technology Directorate is hosting the identity authentication challenge.

Track 2 will examine how good software is spotting imposters among selfies and images of identification documents. The first track, now closed, evaluated how well software is at authenticating identity documents.

The formal name of the challenge is the Remote Identity Validation Technology Demonstration, and the directorate is working with other agencies on it, including the Transportation Security Administration, Homeland Security Investigations Forensic Lab and the National Institute of Standards and Technology.

The directorate has created an instruction page would would-be applicants here.

G7 ambivalent about generative AI

AI governance did not make the top 10 or 25 concerns mentioned in the G7’s communiqué that closed the group’s 2023 meeting. It was not even in the top half of the document.

But it took up more space than other topics, like education. It is very encouraging that AI, biometrics and all the rest are viewed as economic by the Group of 7 (which was born as a gathering of the world’s most important finance ministers).

The closing statement made it clear that everyone wants the algorithms to be sources of new economic vitality. And while they want to coddle it, they are worried about how easy AI can cause problems or be used to harm.

The president of the European Commission, President Ursula von der Leyen, gave perhaps the most anodyne statement on the matter to Reuters: We want AI systems to be accurate, reliable, safe and non-discriminatory.” It probably should also call its mother on Sundays.

Under the Digital heading (point 38, to be exact), the communique, states that, “while rapid and technological change has been strengthening societies and economies, the international governance of new digital technologies has not necessarily kept pace.”

They sound like someone very carefully cuddling up with a tiger on a cold night wondering how close they can burrow into the lush fur without seeing teeth.

Still, they know the fundamentals to be addressed — “fairness, accountability, transparency, safety, protection from online harassment, hate …” Well, at that point it seemed like maybe their minds wandered, thinking AI could be just a really uptight search engine.

Generative AI got a shout out. Varieties of it are erupting in universities and government math labs everywhere, notably in China. If Microsoft’s chatbot is a would-be homewrecker, what would a North Korea generative AI try to do?

UK online content bill could quietly enable facial recognition

Research reportedly shows that the inclusion of software as part of the UK’s proposed Online Safety Bill could be used for facial recognition, a function not covered in the legislation.

The bill‘s stated purpose is to enable governments to get around end-to-end encryption so that they can spot and punish sending and possession illegal content, one shade of which would be child pornography.

An Imperial College London research paper concerns the use of client-side scanning (CSS), which reportedly would make it possible for the government to scan images sent by people via private messaging apps.

If the software (called deep perceptual hashing) identified a match against a database of illegal content — the stated purpose of being debated in the bill — the offending image would be sent to the authorities.

However, the study claims, the same code could be used by the government to search private messages, without users’ knowledge, for facial images that match those of known criminals’.

Researchers recreated CSS algorithms that they taught to match subject faces for wanted criminals. Theirs reportedly is not a general face detector or facial recognition model, which would allow a government to hide its presence.

The researchers write that their tool is “very accurate” at matching faces of wanted criminals. In fact, it was 67 percent reliable in identifying a targeted subject without impacting how it performed in searching for illegal content.

The researchers claim, this secondary purpose could be enabled by adding “a single illegal looking image to the database.” That is to say, someone could add the image of a criminal to a database of illegal content, and the software would search and flag private messages for images matching that person the same as it would look for, as an example, an image of pornography.

“We call on policymakers to thoroughly evaluate the pros and cons of client-side scanning, including the risk of it being abused, before passing laws mandating its installation on millions of phones,” said Yves-Alexandre de Montjoye, a researcher on the study. “Client-side scanning is not the innocuous ‘single purpose’ technology it has been described to Parliament as.”

Potentially monitoring private messages is not the only controversy that backers of the Online Safety Bill has found themselves in. Some privacy advocates have objected to proposed requirements that verify user age.

Lucy Crompton-Reid, CEO of Wikimedia UK, told the BBC her organization would not attempt to verify the ages its contributors.

The Open Safety Bill, which has so far undergone numerous revisions, has passed the UK’s lower house and is in the House of Lords.

€46M earmarked for four EU digital identity wallet pilots

The European Commission is set to invest €46 million (roughly $49 million) into the European digital identity (EUDI) wallet, in the form of four pan-European pilot programs.

The EUDI wallet is an upcoming mobile phone app that promises citizens of the EU’s 27 constitutional countries a way to store and share digital identity data.

Potential use cases of the technology include helping to provide digital travel credentials, expediting the process of opening a bank account, registering for a SIM card, proving educational and professional qualifications, or claiming social benefits such as healthcare.

The 4 pilot projects are set to involve more than 250 private and public organizations “across almost every Member State”, as well as Norway, Iceland, and Ukraine, and they will run for at least 2 years.

The projects will work on 11 priority use cases, which will look to improve citizens’ access to trusted and secure digital identity according to the release.

The projects represent a combined investment of over €90 million in the EU digital identity ecosystem, 50% co-financed by the Commission.

The four projects will help Member States and other stakeholders prepare for the European Digital Identity Regulation legislation coming into force, which is currently under negotiation in the European parliament, according to the documents.

In addition, the projects are targeted at helping the EU’s goal, set out in the Digital Decade Policy Programme target for everybody living in the EU to have access to a secure and user-friendly eID by 2030.

As per the announcement, all the projects collaborate closely with the Commission and each other. Their results are then set to feed into “the ongoing development of technical specifications for the EUDI wallet by the eIDAS expert group.”

Some security concerns have impacted the project so far, with many experts positing that having so much highly valuable personal data in one system could provide a ‘honeypot — a tantalizing target — for prospective cybercriminals.

In a Brussels seminar on the security of eID wallet scheme, hosted by GlobalPlatform, some of the participants voiced their concerns.

Universal global digital identity still 7 years away, OIX presenter says

Europe is currently rushing to launch its digital ID project, the European Digital Identity Wallet (EUDI) governed by the eIDAS regulation. Around 18 to 24 months after the regulation comes into force, all 27 EU member states will make a digital identity available to every citizen who wants one. But the timeline for actual adoption may be years away, according to experts.

Meanwhile, new products such as Earth ID are trying to make digital identity available to everyone, including those who do not have access to high-end phones.

Civil / National ID:

Biometrics Industry Events

Border Security Week: Jun 6, 2023 — Jun 7, 2023

Biometrics Institute: US Discussion Day 2023: Jun 21, 2023

Seamless Asia 2023: Jun 27, 2023 — Jun 28, 2023

ICT Spring: Jun 29, 2023 — Jun 30, 2023

Cyber DSA 2023: Aug 15, 2023 — Aug 17, 2023

BIOSIG 2023–22nd international conference of the biometrics special interest group: Sep 20, 2023 — Sep 22, 2023

AI and Big Data Expo Europe: Sep 26, 2023 — Sep 27, 2023

TRUSTECH: Nov 28, 2023 — Nov 30, 2023

AI and Big Data Expo Global: Nov 30, 2023 — Dec 1, 2023

Egypt Defence Expo — EDEX: Dec 4, 2023 — Dec 7, 2023

Read ‘Biometrics biweekly’ on Paradigm Platform.

Subscribe to Paradigm!

Medium, Twitter, Telegram, Telegram Chat, LinkedIn, and Reddit.

--

--