Advanced Authentication provides advanced biometric authentication with the Facial Recognition method. This method allows users to get automatically authenticated by presenting their face. The image of the face is captured by an integrated or external camera and recorded by the configured API server, when the user enrolls the method. When the user tries to authenticate on an application, the API engine identifies and validates the recorded image with the actual image. If the images match, the user is authenticated.
IMPORTANT:It is recommended to configure the blink detection or combine the Facial recognition method with another method in a chain to enhance security.
WARNING:You must have the Advanced Authentication Device Service installed to use the Facial recognition method for logging in to the following:
Operating System: Windows, Linux, and Mac workstations.
Integration: OAuth 2.0 and SAML 2.0.
Advanced Authentication supports the following Face Recognition API services:
NOTE:You can configure one of the API service to apply Facial Recognition method for authentication.
The Azure Cognitive service provides algorithms that detect, identify, and validate human faces for identity verification. This service also captures high quality images. Also, extracts a set of face-related attributes, such as head pose, emotion, facial hair, and liveliness.
Before you configure the Facial Recognition method, you must generate the Access Key and Endpoint URL from the Microsoft Cognitive Services.
To configure the Facial Recognition method, perform the following steps:
Click Methods > Facial Recognition on the Advanced Authentication Administration Portal.
Check Azure Cognitive Service is set as API Provider.
Specify Endpoint URL. This URL is location based.
NOTE:The Endpoint URL must contain face/v1.0 at the end.
For example: https://westcentralus.api.cognitive.microsoft.com/face/v1.0.
Specify Access Key that you have generated in the Microsoft Cognitive Services. This key is used while authenticating the user.
NOTE:Verify the following points before implementing Facial Recognition method with Azure Cognitive service:
For a better quality of recognition, you must use cameras with a high definition of 720p and above.
During enrollment, the captured images are placed on Microsoft servers and Microsoft Cognitive Services return only the Face ID to Advanced Authentication. The Advanced Authentication stores this Face ID as enrolled authenticator. Therefore, when you change the Access Key, the related enrollments are lost.
This method does not support caching on Windows Client, Mac OS X Client, and Linux PAM Client.
Contactable provides a highly effective identity orchestration platform that includes advanced Intelligent Facial Biometric Anti-spoofing algorithms. These algorithms are made available in a frictionless user verification journey using simply 2 dimensional facial images captured directly from a mobile or web-based camera.
The anti-spoofing algorithms are NIST rated and i-Beta level 1 and level 2 ISO 30107-3 compliant qualifying them as quite reliable. The anti-spoofing algorithms can test for presentation attacks related to printed photos, cut-out masks, digital and video replay attacks and 3-dimensional masking. While testing, the service also checks for liveness and prevent fraud being committed through the use of false facial identity by comparing a living person's facial image to a reference image often obtained independently from an independent data source. A successful biometric comparison of a user's facial image to a reference image then binds the two data sets to each other for use in assessing truth.
To configure the Contactable KYC service for Facial Recognition, perform the following steps:
Click Methods > Facial Recognition on the Advanced Authentication Administration Portal.
Select Contactable KYC Service as API Provider.
Specify the following details:
|
Parameter |
Description |
|---|---|
|
Base URL |
The Contactable KYC service URL for validating the captured face. |
|
User name |
The username to access the Contactable KYC service. |
|
Password |
The password to access the Contactable KYC service. |
|
Organization code |
An unique code thats helps Contactable KYC service to group the requests. |
|
Encryption Key |
The key to secure the communication between the Contactable KYC service and Advanced Authentication. |
|
Encryption initialization vector |
A value that is used along with a secret key to encrypt data so that the encrypted values are not identical. |
|
Client timeout (seconds) |
The duration till when the Advanced Authentication server waits for a response from the Contactable KYC service. |
|
Allow lower resolution image scan |
It enables the Advanced Authentication server to receive the lower resolution facial images that do not comply with standards. The option is set to OFF by default. The facial image that does not comply with the standard is not sent to the server for validation. However, if the face recognition device complies with image standards then the authentication is successful without any issue. When set to ON, the Advanced Authentication server receives the lower resolution facial images that do not comply with standards. However, authentication might not be successful. |
Click Save.