Part 2: Computer Vision Alternatives to Cryptographic Verification

The merits of a cryptography-based solution for identity verification were discussed in Part 1 of this blog series. Coincidentally, some very important changes have happened in the technology landscape since the first part was written that are directly related to this topic.

In early June, Apple made several announcements at WWDC related to iOS 13 – such as the new “Sign in with Apple” capability – that quickly got a lot of attention. Among those announcements, the one that received much less coverage was the expansion of NFC support, which effectively enables the verification of an e-Passport using an iPhone.

Despite this being a very important development, cryptographic identity verification is still constrained to e-Passports, which is a form of ID not commonly used in the United States. Also, at the time of writing, NFC integration is only practical in native apps, as Web support for it is almost non-existent.

A practical alternative to cryptographic verification is a Computer Vision (CV)-based approach, where a document image is captured using the device’s camera, and is used for data extraction and verification of authenticity. This approach is compatible with all driver’s licenses and state-issued ID cards in circulation today in the United States.

State-issued IDs are slightly different from each other, but they all follow design standards published by AAMVA (American Association of Motor Vehicle Administrators). These standards offer very detailed specifications for identification documents, and were instrumental for states to become compliant with the REAL ID Act, enacted in 2005. The REAL ID Act requires a minimum set of security properties for identification documents to be used for access to federal facilities or to board a commercial aircraft. One clear benefit of AAMVA standards is that they mandate the use of PDF417 machine readable technology.

PDF417 (no relation to PDF file types) is a two-dimensional bar code standard that makes it possible for optical devices – such as a camera – to reliably capture data that is printed or displayed on a surface. PDF417 gives us machine readability, which is one of the three properties of a good cryptographic identity verification solution. Unfortunately, the other two are not present in a CV-based approach, so reasonable alternatives are needed for cryptographic signature and replay prevention.

The alternative to cryptographic signatures is to verify the authenticity of the document and the integrity of its data by mimicking the techniques that would be used in a human visual inspection. Some of the steps that are typically taken in human inspections include:

• Verifying that the document layout corresponds to the layout used by the authority when the document was issued
• Checking for presence of security features, such as holograms
• Examining consistency of typeface
• Looking for any evidence of tampering

The pattern-matching tasks required for the activities above use sophisticated aspects of human intelligence, but can also be performed by an algorithm. Given their broad applicability, ML/CV techniques have evolved significantly in recent years to solve problems such as Object Identification/Classification, Feature Extraction, and Facial Recognition. All these techniques apply very well to ID verification, and with the current state of technology, it’s reasonable to expect CV/ML ID verification algorithms to outperform humans trained to verify IDs manually.

This leaves us with the problem of replay prevention. Secure protocols usually employ a challenge that is unique to every new session, in order to prevent replay attacks. The closest alternative when using ML and CV is to capture a video stream of the face of the person being verified. This video stream can be checked for liveness and comparison against the picture of the ID document – it’s one of the most effective approaches to ensure that the document is actually presented by its owner. One technique to detect liveness is to look for movement in facial expressions, such as blinking. More sophisticated approaches may require the user to enunciate a random sentence that gets verified via speech recognition, although the latter will impose a little more user friction.

In conclusion, there’s very little doubt that if there were a better rate of adoption of electronic documents, ID verification could be done with less friction and much more reliably; however, recent advancements in ML and CV techniques makes for a good alternative that can be used to verify the types of documents in circulation today.

Read other blogs in this series:

Part 1: Remote Identity Verification – Cryptography vs. Artificial Intelligence

Part 3: Privacy Implications and Enhancements in Identity Verification