ABIS & Deduplication

title: ABIS & Deduplication

slug: abis-dedup

summary: Automated Biometric Identification Systems perform large-scale 1:N searches to resolve identities and detect duplicates.

also_known_as:
ABIS
deduplication
1:N search

category: Technology

label: ANSI/NIST-ITL 1-2011 biometric data format

question: What does an ABIS do?

answer: It searches biometric databases to identify individuals and flag duplicate enrollments across large populations.

question: What’s the difference between identification and verification?

answer: Identification is 1:N (who is this?); verification is 1:1 (is this person who they claim?). ABIS primarily supports 1:N at scale.

question: How are false positives managed?

answer: Systems tune thresholds and use adjudication workflows; quality checks and multi‑modal fusion reduce spurious hits.

label: NIST biometric standards resources

label: ANSI/NIST-ITL 1 data format

label: ISO/IEC 19795-1 performance testing

description:
## Overview
ABIS platforms store and search biometric templates at national or global scale. Deduplication ensures each person has only one identity record.

## How it works
1. Capture biometric samples during enrollment.
2. Extract features and store templates.
3. Run 1:N searches to detect matches or duplicates.
4. Adjudicate hits and maintain watchlists.

## Common use cases
- National ID enrollment
- Border and visa vetting
- Civil or criminal watchlists

## Strengths and limitations
**Strengths:** Scales to millions; prevents multiple identities.
**Limitations:** Infrastructure cost; privacy and governance.

## Key terms
- **1:N search:** Matching a probe against all records.
- **Deduplication:** Removing duplicate identities in a database.


title: Age Assurance (Verification & Estimation)

slug: age-assurance

summary: Processes that verify age via trusted documents or estimate age from signals like face or behavior for online safety compliance.

also_known_as:
age verification
age estimation

see_also: facial-recognition digital-id

label: PAS 1296: Age verification

question: How does age estimation differ from verification?

answer: Estimation predicts age from signals, while verification checks authoritative documents or records.

question: What inputs are used for estimation?

answer: Commonly face images or short videos; some systems consider behavioral signals. Estimation should include bias and uncertainty reporting.

question: How is privacy handled?

answer: Prefer on-device processing, minimize retention, and use privacy-preserving proofs where possible; follow regulator guidance (e.g., data minimization).

label: UK Ofcom guidance on age assurance

label: ICO Age Appropriate Design Code

label: BSI PAS 1296: Age verification

description:
## Overview
Age assurance tools help platforms meet legal requirements by verifying or estimating user ages before granting access to restricted content or services.

## How it works
1. **Verification:** Validate a government ID or authoritative record.
2. **Estimation:** Use biometrics or behavior (e.g., face, voice, activity) to infer age.
3. **Decision:** Apply policy thresholds (e.g., over 18) and handle appeals or manual review.

## Common use cases
- Social media sign-up
- Online gaming and gambling
- Adult content gateways

## Strengths and limitations
**Strengths:** Supports regulatory compliance; multiple methods.
**Limitations:** Privacy concerns; estimation accuracy varies.

## Key terms
- **Age verification:** Checking an ID or database to confirm age.
- **Age estimation:** Predicting age from biometric or behavioral signals.


Behavioral Biometrics

slug: behavioral-biometrics

summary: Behavioral biometrics analyzes patterns in user interactions—such as typing rhythm, mouse movement, or touchscreen gestures—to continuously verify identity.

label: NIST: Behavioral biometrics program overview

label: NIST SP 800-63B (AAL, user verification context)

question: What is behavioral biometrics?

answer: Behavioral biometrics analyzes patterns in user interactions, such as typing rhythm, mouse movements, or touchscreen gestures, to verify identity continuously.

question: How does behavioral biometrics differ from physiological biometrics?

answer: Behavioral biometrics focuses on how users behave, whereas physiological biometrics rely on static physical traits like fingerprints or iris patterns.

question: Where is behavioral biometrics commonly used?

answer: It is used for continuous authentication, fraud detection, and adaptive security in banking, healthcare, and enterprise environments.

question: What about privacy and consent?

answer: Deployments should disclose passive monitoring and adhere to privacy laws; many systems process derived features rather than raw inputs to reduce risk.

title: Behavioral Biometrics

description: Behavioral biometrics leverages how a user interacts with devices or interfaces rather than physical traits. By monitoring characteristics like keystroke dynamics, touchscreen swipes, or navigation habits, systems can provide continuous and passive authentication. This modality enhances security by detecting anomalies in real-time and can complement physiological biometrics for multifactor authentication.


Biometric Border Control

slug: biometric-border-control

summary: Biometric border control uses face or fingerprint recognition at checkpoints to verify travelers and automate border processes.

label: ICAO Doc 9303 (series overview)

label: EU Smart Borders / Entry-Exit System overview

label: NIST Biometrics program overview

question: What is biometric border control?

answer: It uses biometrics like fingerprints or face images at border crossings to verify travelers.

question: Where is it used?

answer: Many countries deploy biometric e-gates at airports and land checkpoints for security.

question: How does it help travelers?

answer: Automated gates reduce wait times while enhancing identity assurance.

question: What’s the difference between entry and exit checks?

answer: Entry typically verifies a traveler against their travel document and watchlists (1:1 and 1:N). Exit can confirm departure and detect overstays, often with facial verification at gates.

question: How do systems handle spoofing?

answer: They combine document checks, live capture quality controls, and presentation attack detection (PAD) to detect photos, masks, or replays.

title: Biometric Border Control

description:
Biometric border control systems automate entry and exit checks with biometric capture and matching at e-gates or manual stations.

### Latest Updates
* **2025-06-30:** Somalia deployed the U.S.-backed PISCES border system at Mogadishu airport, capturing fingerprints and face images for real-time watch-list checks, with national roll-out planned.


Biometric ID Cards

slug: biometric-id-cards

summary: Biometric ID cards embed fingerprints or facial data on a chip for secure identity verification in travel and public services.

label: ICAO Doc 9303 (eMRTD fundamentals)

label: EU Regulation 2019/1157 (ID card security features)

label: ISO/IEC 7816 (smart cards)

question: What is a biometric ID card?

answer: A physical identity card containing a chip with biometric templates such as fingerprints.

question: Where are biometric ID cards used?

answer: They are used in national ID programs and for travel documents.

question: Are biometrics stored securely?

answer: Yes, data is typically encrypted and access-protected on the card chip.

question: How are cards verified?

answer: Inspectors read the chip and validate signatures using PKI (e.g., CSCA/DSC for eMRTD) and check data consistency with the printed document.

title: Biometric ID Cards

description:
Biometric ID cards store biometric templates on a secure chip to verify the holder and prevent fraud during identity checks.

### Latest Updates
* **2025-07-01:** Switzerland confirmed biometric ID cards will launch by end-2026, storing face and fingerprints on a secure chip in line with EU Regulation 2019/1157.


Contactless Fingerprinting

title: Contactless Fingerprinting

slug: contactless-fingerprints

summary: Touch-free fingerprint capture using cameras or scanners, enabling mobile or hygienic enrollment.

also_known_as:
touchless fingerprints
mobile fingerprint capture

label: NIST SP 500-334: Contactless fingerprint guidelines

question: Why use contactless capture?

answer: It improves hygiene and allows capture with commodity cameras on phones or kiosks.

question: Will contactless images match legacy databases?

answer: Systems reconstruct contact-equivalent images and templates; adherence to emerging profiles improves interoperability with contact-based AFIS.

question: What about spoofing and PAD?

answer: Optics and software can detect prints-on-displays or photos; PAD should be evaluated separately from matching accuracy.

label: FBI contactless fingerprint pilot specs

label: NIST SP 500-334: Contactless devices

description:
## Overview
Contactless fingerprinting collects ridge detail without touching a platen, using optical setups or smartphone cameras to reconstruct flat equivalents.

## How it works
1. Capture multiple finger images in 3D or at angles.
2. Normalize and flatten ridges into a standard fingerprint image.
3. Generate templates compatible with contact-based databases.

## Common use cases
- Mobile enrollment for civil ID
- Border kiosks with hygiene requirements
- Workforce or time-and-attendance apps

## Strengths and limitations
**Strengths:** Hygienic; uses commodity hardware.
**Limitations:** Image distortion; interoperability with contact-based standards still evolving.

## Key terms
- **Contactless capture:** Imaging without touching a sensor.
- **Platen:** Surface used in traditional fingerprint scanners.


Deepfake Detection

title: Deepfake Detection

slug: deepfake-detection

summary: Methods that detect synthetic or manipulated media (audio, images, video) used to impersonate people in identity verification and biometric systems.

see_also: pad face-recognition voice-recognition document-verification-nfc

label: NIST: Face Recognition Technology Evaluation (FRTE)

label: ISO/IEC 30107-3 (PAD testing and metrics)

description:
## Overview
Deepfake detection aims to identify AI-generated or heavily manipulated media intended to defeat identity verification (e.g., selfie checks) or to enable fraud via impersonation.

## How it’s used in identity systems
- As a **signal** alongside PAD/liveness, device checks, and document verification.
- To **flag suspicious submissions** for step-up or manual review.
- To **harden enrollment and re-verification**, where synthetic media can create or take over accounts.

## Common challenges
- Rapidly evolving generation methods and attack techniques.
- Domain shifts (lighting, cameras, compression) that can affect detector performance.


Digital ID

slug: digital-id

summary: Digital ID represents electronic identity credentials that can be used to authenticate individuals and access services online.

label: EU eIDAS Regulation overview

label: W3C Decentralized Identifiers (DID) v1.0

label: NIST SP 800-63 Digital Identity Guidelines

question: What is a Digital ID?

answer: A Digital ID is an electronic representation of a person’s identity credentials, used to authenticate and authorize access to online services.

question: How are Digital IDs issued and managed?

answer: Digital IDs are issued by trusted entities (e.g., governments or certification authorities) and managed through secure identity providers, often leveraging public key infrastructure (PKI).

question: Why are standards like eIDAS important for Digital IDs?

answer: Standards such as eIDAS ensure interoperability, security, and legal trust across jurisdictions for cross-border digital identity services.

title: Digital ID

description: Digital identity (Digital ID) systems bind personal attributes—such as name, date of birth, and biometric data—to a secure digital credential. These credentials can be issued by governments or trusted entities and used for online authentication, e-government services, and financial inclusion. Standards like eIDAS in Europe and W3C Decentralized Identifiers (DIDs) shape interoperability and privacy.


title: Document Verification & NFC e-Chip Reading (eMRTD / ICAO 9303)

slug: document-verification-nfc

summary: How modern ID documents are verified using optical checks, NFC chip reading, and PKI validation per ICAO Doc 9303.

also_known_as:
eMRTD inspection
ePassport NFC
ICAO 9303 verification
LDS/PKD validation
BAC/PACE/AA/PA/CA/EAC

see_also: digital-id mobile-id national-e-id facial-recognition

label: ICAO Public Key Directory (PKD)

question: What’s in the chip?

answer: The LDS stores data groups (e.g., DG1 MRZ, DG2 face image, DG3 fingerprints, DG4 iris) plus the SOD file containing signed hashes.

question: How do inspectors validate authenticity?

answer: They verify the SOD’s signature against trusted CSCA/DSC certificates (often via the ICAO PKD) and ensure DG digests match the chip contents.

question: Which access protocols are used?

answer: BAC or PACE establish secure messaging; AA/CA/EAC provide stronger document authenticity and biometric access controls where applicable.

label: ICAO PKD overview

label: NFC passport reading – developer guide (example)

description:
## Overview
Modern passports and many IDs are **electronic Machine-Readable Travel Documents (eMRTDs)** with an NFC chip. Verifying them combines visual checks with **chip reading** and **PKI cryptographic validation** to confirm authenticity and detect tampering.

## How it works
1. **Optical checks:** MRZ, VIZ, security features.
2. **Secure messaging:** Use MRZ or CAN to start BAC/PACE.
3. **Chip read:** Extract LDS data groups (e.g., DG2 face, DG1 MRZ) and SOD.
4. **PKI validation:** Verify SOD signature using issuer’s DSC/CSCA; trust roots often fetched via the **ICAO PKD**.
5. **Consistency checks:** Compare chip data vs printed data; run face match to selfie if needed.

## Common use cases
- Border control; eGate flows
- Remote KYC / onboarding (NFC on smartphones)
- Airport or workplace issuance/verification

## Strengths and limitations
**Strengths:** Cryptographic authenticity, global standards, offline verification with cached trust lists.
**Limitations:** Access to trust anchors; device NFC variability; privacy rules on biometric access.

## Key terms
- **LDS (Logical Data Structure):** Standardized layout of chip data (DG1..DG16 + SOD).
- **PKD:** Global repository of signing keys and revocation material.


Ear Recognition

title: Ear Recognition

slug: ear-recognition

summary: Identifies people by the unique shape and texture of the outer ear, often for surveillance or forensic support.

question: Is ear recognition accurate?

answer: Modern CNN-based approaches show promise, but occlusions and hairstyles can reduce reliability.

question: How is it used with face recognition?

answer: As a supplemental cue in surveillance or re-identification when the face is partially visible or at oblique angles.

label: Survey on ear biometrics

label: NIST biometrics program overview

description:
## Overview
Ear recognition uses images of the ear’s contours and texture as a supplemental biometric, particularly in surveillance footage.

## How it works
1. Detect the ear region in images or video.
2. Extract features (e.g., shape descriptors, deep embeddings).
3. Compare with stored ear templates or multi-modal records.

## Common use cases
- Surveillance in public spaces
- Forensic photo analysis
- Research on unobtrusive biometrics

## Strengths and limitations
**Strengths:** Can work at a distance; stable shape over time.
**Limitations:** Susceptible to occlusion by hair or accessories; smaller dataset availability.

## Key terms
- **Auricle:** External part of the ear captured for matching.
- **Occlusion:** Blocking or covering of the ear in images.


Facial Recognition

slug: facial-recognition

summary: Facial recognition matches a photo of a face to an identity.

label: NIST Face Recognition Vendor Test (FRVT)

label: ISO/IEC 19795-1: Biometric performance testing and reporting

label: ICAO Doc 9303: Machine Readable Travel Documents (Face images)

question: How does facial recognition work?

answer: Facial recognition uses algorithms to analyze facial features—such as the distance between eyes or the shape of cheekbones—to create a unique digital signature for identification.

question: How accurate is facial recognition technology?

answer: Modern facial recognition systems can achieve very low false match rates (below 0.1%) under controlled conditions, but accuracy may vary with lighting, pose, and image quality.

question: What are common concerns around facial recognition?

answer: Concerns include privacy violations, potential bias against certain demographic groups, and misuse by surveillance systems without consent.

question: What is Presentation Attack Detection (PAD)?

answer: PAD aims to detect spoofing attempts (e.g., photos, masks, deepfakes) and is evaluated separately from matching accuracy using standards-driven tests.

question: What are 1:1 vs 1:N operations?

answer: 1:1 verifies a claimed identity (authentication), while 1:N searches across a gallery (identification). They have different accuracy and scalability considerations.

title: Facial Recognition

description:
Facial recognition is a biometric modality that analyses the geometry and texture of a person’s face to establish identity. Modern systems rely on CNN embeddings and achieve <0.1% FNMR on NIST FRVT benchmarks.

### Latest Updates
* **2025-07-01:** Tinder, Deliveroo, Uber Eats and Just Eat expanded selfie or facial-verification checks to fight bots, deepfakes and illegal-account rentals in CA and UK gig-economy platforms.


Finger Vein Recognition

title: Finger Vein Recognition

slug: finger-vein

summary: Near-infrared imaging of vascular patterns inside fingers provides high liveness assurance for authentication.

question: Where is finger vein used?

answer: It appears in banking ATMs, physical access systems, and some consumer devices.

question: How does it compare to fingerprints?

answer: Vein patterns are sub-dermal and difficult to copy, offering strong liveness properties; sensors are more specialized and costlier.

label: Survey on finger vein recognition

description:
## Overview
Finger vein systems illuminate the finger with near-infrared light and capture subdermal vein patterns that are difficult to replicate.

## How it works
1. Shine near-infrared light through the finger.
2. Image absorbed vs transmitted light to reveal veins.
3. Extract features and match against stored templates.

## Common use cases
- ATM and banking authentication
- High-security access points
- Research on wearable devices

## Strengths and limitations
**Strengths:** Built-in liveness; privacy-friendly since patterns are internal.
**Limitations:** Specialized sensors; smaller vendor ecosystem.

## Key terms
- **NIR (Near-Infrared):** Wavelength used to image veins.
- **Vein template:** Feature representation of vascular patterns.


Fingerprint Recognition

slug: fingerprint-recognition

summary: Fingerprint recognition identifies individuals by analyzing unique patterns of ridges and valleys on the fingertip.

label: ISO/IEC 19794-2: Finger minutiae data

label: NIST: Fingerprint recognition overview

label: NIST MINEX overview

question: How does fingerprint recognition work?

answer: Fingerprint recognition captures the unique ridge and valley patterns on a fingertip using sensors, then extracts key minutiae points to match against stored templates.

question: Can fingerprint recognition work with wet or damaged fingers?

answer: Most modern sensors use capacitive or multispectral imaging to handle moisture and minor skin abrasions, but extreme conditions may reduce accuracy.

question: What are common uses of fingerprint recognition?

answer: Fingerprint recognition is used for smartphone unlocking, access control, time and attendance tracking, and large-scale identity verification systems.

title: Fingerprint Recognition

description: Fingerprint recognition is one of the oldest and most widely used biometric modalities. It captures and compares the distinctive ridge patterns of a person's fingertip using optical or capacitive sensors. Modern algorithms extract minutiae points and match them against stored templates, achieving high accuracy and fast performance in applications ranging from smartphone unlocking to large-scale national ID systems.


Gait Recognition

slug: gait-recognition

summary: Gait recognition identifies individuals by analyzing their unique walking style and body movements from video or sensor data.

label: NIST: Gait recognition research overview

label: Survey of gait biometrics

question: What is gait recognition?

answer: Gait recognition analyzes an individual’s unique walking pattern and body movements, captured via video or wearable sensors, to identify them.

question: How accurate is gait recognition?

answer: Gait recognition can achieve moderate accuracy in controlled settings, but performance may degrade under varying speeds, shoe types, or carrying conditions.

question: What factors can affect gait recognition accuracy?

answer: Factors like clothing, walking surface, speed, and camera angle can impact accuracy, requiring robust normalization and feature extraction methods.

question: Is gait privacy sensitive?

answer: Yes. It can be captured at a distance; deployments should evaluate proportionality, transparency, and legal frameworks before use.

title: Gait Recognition

description: Gait recognition captures a person's walking pattern using video cameras or wearable sensors, extracting features like stride length, joint angles, and motion dynamics. Since gait can be captured at a distance without user cooperation, it is valuable for surveillance and forensic applications. Environmental factors and clothing can affect accuracy, so robust algorithms are essential.


Hand Biometrics

slug: hand-biometrics

summary: Hand biometrics identifies people using characteristics of the entire hand, such as geometry, vein patterns, or palm prints.

label: ISO/IEC 19794-10: Hand geometry data

label: NIST Hand geometry resources

question: What are hand biometrics?

answer: Hand biometrics analyze traits of the whole hand, including geometry, palm prints, or vein structure, to confirm identity.

question: How do hand biometrics differ from fingerprint recognition?

answer: While fingerprint systems focus on ridge patterns of fingertips, hand biometrics capture broader features like hand shape or subcutaneous veins.

question: Where are hand biometrics used?

answer: They are common in access control, time and attendance systems, and high-security checkpoints requiring contactless identification.

title: Hand Biometrics

description: Hand biometrics encompass techniques that measure unique attributes across the hand. Systems may scan three-dimensional hand geometry, image palm or finger veins using near-infrared light, or analyze palm prints. These methods provide an alternative when fingerprints are obscured or when contactless capture is preferred, offering reliable identification in environments such as secure facilities and workforce management.


Iris Recognition

slug: iris-recognition

summary: Iris recognition uses the unique patterns in the colored ring surrounding the pupil to verify identity.

label: ISO/IEC 19794-6: Iris image data

label: NIST: Iris recognition overview

label: NIST IREX program

question: What makes iris recognition unique compared to other biometrics?

answer: The iris has highly distinctive and stable texture patterns, offering very low false match rates and resistance to aging.

question: How accurate is iris recognition?

answer: Iris recognition typically achieves false match rates well below 0.1%, making it one of the most accurate biometric modalities.

question: What are common applications of iris recognition?

answer: Iris recognition is used in border control, national identity programs, secure building access, and even smartphone authentication in some devices.

title: Iris Recognition

description: Iris recognition captures high-resolution images of the eye, isolating the iris region and encoding its intricate texture patterns. Since the iris texture is highly unique and stable over time, this modality offers one of the highest levels of accuracy with low false match rates. It is widely used in border control, national ID programs, and secure access credentials.


Keystroke Dynamics

title: Keystroke Dynamics

slug: keystroke-dynamics

summary: Authenticates users by timing patterns in how they type on a keyboard or touchscreen.

also_known_as:
typing biometrics
keystroke biometrics

question: What features are analyzed?

answer: Hold times, key-to-key latencies, and higher-level timing rhythms across sessions.

question: How do models handle context changes?

answer: Adaptive or per-device profiles, domain adaptation, and periodic re-enrollment help account for keyboard and posture shifts.

question: Can bots spoof keystroke patterns?

answer: Scripted automation can mimic simple averages; richer timing distributions and anomaly detection increase resilience.

label: Antispoofing wiki on keystroke dynamics

label: NIST: Behavioral biometrics overview

description:
## Overview
Keystroke dynamics track how users type to provide a behavioral biometric signal for login or continuous authentication.

## How it works
1. Record timing of key presses and releases.
2. Build a profile using statistical or machine-learning models.
3. Compare new typing samples to the stored profile.

## Common use cases
- Continuous authentication on desktops
- Fraud detection in online banking
- Step-up identity verification

## Strengths and limitations
**Strengths:** Passive and continuous; works with existing hardware.
**Limitations:** Sensitive to context changes like device or posture.

## Key terms
- **Dwell time:** Duration a key is pressed.
- **Flight time:** Time between consecutive key presses.


Mobile ID

slug: mobile-id

summary: Mobile ID leverages smartphones to store and present digital identity credentials securely, often using SIM-based security and biometric unlock.

label: GSMA Mobile Identity overview

label: ISO/IEC 18013-5: Mobile driver’s license (mDL)

label: NIST SP 800-63A (Enrollment & Identity Proofing)

question: What is Mobile ID?

answer: Mobile ID refers to digital identity credentials stored on smartphones, enabling secure user authentication for online and offline services.

question: How are Mobile IDs secured on the device?

answer: Credentials are stored in secure elements like SIM cards or hardware-backed keystores, protected by device-level authentication such as PIN, fingerprint, or face unlock.

question: What are common applications for Mobile ID?

answer: Mobile ID is used for e-government services, mobile banking, and secure enterprise access, offering convenient two-factor or multi-factor authentication.

question: How do mDLs relate to Mobile ID?

answer: mDLs are a standardized form of Mobile ID for driver’s licenses (ISO/IEC 18013-5), enabling local verification and selective disclosure via mobile devices.

title: Mobile ID

description: Mobile ID solutions enable users to enroll and authenticate using their mobile devices. Credentials may be provisioned to secure elements such as SIM cards or device hardware, and biometric sensors ensure that only the legitimate holder can use them. Common use cases include e-government portals, banking, and secure access to enterprise resources.


Multimodal Biometrics (Fusion)

title: Multimodal Biometrics (Fusion)

slug: multimodal-biometrics

summary: Combining two or more biometric signals (e.g., face + fingerprint) to boost accuracy, resilience, and spoof resistance.

also_known_as:
multi-biometric
biometric fusion

see_also: facial-recognition fingerprint-recognition voice-recognition pad

label: ISO/IEC 19795-1: Biometric performance testing (metrics, reporting)

question: Which fusion levels are typical?

answer: Sensor, feature, score, and decision-level fusion. Score-level is common in practice due to availability and interoperability.

question: What benefits should I expect?

answer: Lower false rejects at fixed false accept rates; robustness to sensor/environment variability; better PAD via ‘liveness stacking’.

question: How do you tune thresholds across modalities?

answer: Normalize scores per modality (e.g., z-norm) and set an operating point using development data to meet target FAR/FRR under fusion.

label: NIST on performance testing (19795-1)

label: NIST studies on score-level fusion

label: Recent fusion survey

description:
## Overview
**Multimodal biometrics** fuse signals (e.g., face + finger, iris + vein) to improve accuracy and resilience. Fusion can also harden systems against presentation attacks when combined with modality-specific PAD.

## How it works
- **Feature-level fusion:** combine feature vectors before matching.
- **Score-level fusion:** normalize and combine matcher scores (e.g., sum, weighted, learned).
- **Decision-level fusion:** combine accept/deny votes (e.g., AND/OR rules).

## Common use cases
- Border & national ID deduplication (1:N)
- High-assurance workforce access
- Financial KYC with PAD stacking

## Strengths and limitations
**Strengths:** Higher accuracy; graceful degradation; spoof resistance.
**Limitations:** Cost/complexity; correlation between signals can cap gains; tuning/maintenance.

## Key terms
- **Score fusion:** Combining matcher scores, often after normalization.
- **Decision fusion:** Using voting or logic rules on match outcomes.


National e-ID

slug: national-eid

summary: National e-ID programs issue electronic identity credentials tied to biometrics for secure access to government and private services.

label: World Bank ID4D initiative

label: EU eIDAS Regulation overview

label: MOSIP (Modular Open Source Identity Platform)

question: What is a national e-ID?

answer: It is a government-issued digital identity card or credential with embedded biometrics.

question: Why implement national e-IDs?

answer: They enable secure access to services and help prevent identity fraud.

question: What data do e-IDs store?

answer: They typically store personal data and biometric templates on a secure chip.

question: How do national e-IDs relate to passports and ICAO 9303?

answer: Many e-IDs reuse eMRTD technology (chips, PKI). Some also support online authentication and qualified signatures per regional frameworks like eIDAS.

question: How are duplicates prevented at enrollment?

answer: Systems use ABIS deduplication (1:N) on face/fingerprint/iris to catch multiple enrollments under different identities.

title: National e-ID

description:
National electronic ID systems provide citizens with a secure credential, often backed by biometric verification, to authenticate for public and private services.

### Latest Updates
* **2025-07-01:** Vietnam began issuing Level-2 e-ID accounts (VNeID) to foreign residents; processing in 3-7 days after biometric capture at immigration offices.


Online Signature Verification (Dynamic)

title: Online Signature Verification (Dynamic)

slug: online-signature

summary: Analyzes pen dynamics such as pressure, speed, and trajectory to authenticate handwritten signatures.

label: ISO/IEC 19794-7: Signature/sign behavioral data

question: What data is captured?

answer: Time-stamped x/y coordinates, pressure, and sometimes pen-tilt or velocity.

question: How is it different from image-based signature matching?

answer: Online methods use temporal dynamics captured during signing, which are harder to forge than a static image of a signature.

question: What sensors are used?

answer: Signature tablets, stylus-enabled devices, or capacitive touchscreens with pen support capture the necessary dynamics.

label: Overview of online signature verification

label: NIST Biometric testing overview

description:
## Overview
Online signature verification captures the dynamic process of signing to provide stronger assurance than static image comparison.

## How it works
1. Capture pen movement and pressure over time.
2. Extract features like speed, direction, and acceleration.
3. Compare against stored signature templates using temporal alignment.

## Common use cases
- Financial document signing
- Point-of-sale terminals
- Digital contracts requiring biometric evidence

## Strengths and limitations
**Strengths:** Difficult to forge precisely; continuous temporal data.
**Limitations:** Requires specialized tablets or stylus input.

## Key terms
- **Dynamic features:** Time-based measurements of the signing process.
- **DTW (Dynamic Time Warping):** Technique for aligning signature trajectories.


title: Presentation Attack Detection (Liveness / PAD)

slug: pad

summary: Techniques and tests that detect spoofed biometric samples (e.g., masks, replays, synthetics) to ensure the sample is from a live, consenting subject.

also_known_as:
liveness detection
anti-spoofing
PAD

see_also: facial-recognition voice-recognition fingerprint-recognition iris-recognition multimodal-biometrics

label: ISO/IEC 30107-1: Terms & framework for PAD

label: ISO/IEC 30107-3: PAD testing & metrics (APCER/BPCER)

label: iBeta guidance on ISO 30107-3 conformance

question: What metrics does ISO/IEC 30107-3 define?

answer: APCER (attack presentations misclassified as bona fide) and BPCER (bona fide misclassified as attacks). Vendors often report operating points across attack species and attack potential.

question: Is PAD the same as liveness?

answer: ‘Liveness’ is commonly used, but PAD is broader: it covers detecting presentation attacks of many kinds (physical and digital), not only vitality cues.

question: How is PAD evaluated in practice?

answer: Independent labs test across PAI types and attack potentials, reporting APCER/BPCER at defined thresholds; results are separate from core matcher accuracy.

label: ISO/IEC 30107-1 overview

label: ISO/IEC 30107-3 testing primer (NIST slide deck)

label: iBeta PAD tiers and test descriptions

description:
## Overview
Presentation Attack Detection (PAD) protects biometric systems from spoofs such as printed photos, silicone fingerprints, recorded voices, or AI-generated samples. It’s a cross-cutting layer used with face, voice, fingerprint, iris and other modalities.

## How it works
1. **Capture:** Sensor or camera acquires the sample.
2. **Signal analysis:** Algorithms look for cues inconsistent with live traits (e.g., texture, reflectance, micro-motions, audio artifacts).
3. **Decision & score:** The PAD subsystem outputs a score or decision (bona fide vs attack).
4. **Policy:** Systems combine PAD with biometric matching and business rules to accept/deny or request step-up verification.

## Common use cases
- Remote onboarding / selfie match
- Contactless border checks
- KYC and high-risk transactions
- Access control and workforce auth

## Strengths and limitations
**Strengths:** Mitigates common spoofs; complements matching; standard metrics for evaluation.
**Limitations:** Attack diversity; new synthetic media; environment variability; false rejections at strict thresholds.

## Key terms
- **APCER/BPCER:** Core PAD error metrics from ISO/IEC 30107-3.
- **PAI (Presentation Attack Instrument):** The artifact used to attack.
- **Attack potential:** Effort/resources required to mount an attack.


Palm Vein Recognition

slug: palm-vein-recognition

summary: Palm vein recognition uses near-infrared light to capture the unique vascular patterns beneath the skin of the palm.

label: Fujitsu PalmSecure overview

label: NIST Biometrics program overview

question: What is palm vein recognition?

answer: Palm vein recognition uses near-infrared light to image the unique vascular patterns beneath the skin of the palm for identity verification.

question: How does palm vein recognition prevent spoofing?

answer: Since veins are located beneath the skin, palm vein recognition inherently offers liveness detection and resists fake artifacts like lifecasts.

question: Where is palm vein recognition commonly deployed?

answer: It is used in high-security access control, financial authentication, and healthcare applications requiring strong liveness assurance.

title: Palm Vein Recognition

description: Palm vein recognition illuminates the palm with near-infrared light, revealing the vein structure that lies beneath the skin. These vein patterns are unique to each individual and difficult to replicate, providing a high level of liveness assurance. This modality is used in secure access control, banking authentication, and identity verification in sensitive environments.


Palmprint Recognition

title: Palmprint Recognition

slug: palmprint-recognition

summary: Uses dermal ridge patterns across the palm for identification, distinct from vein-based methods.

see_also: hand-biometrics fingerprint-recognition

label: ISO/IEC 19794 series (palmprint, hand)

question: Where are palmprints used?

answer: In forensics and access control systems where more surface area improves matching.

question: How is palmprint different from palm vein?

answer: Palmprint uses surface ridge patterns; palm vein uses sub-dermal vascular patterns captured with NIR illumination.

label: Overview of palmprint recognition

description:
## Overview
Palmprint recognition analyzes ridge detail across the palm, offering a larger surface area than fingerprints for feature extraction.

## How it works
1. Capture the palm using optical or contactless sensors.
2. Extract ridge minutiae and orientation fields.
3. Match against enrolled templates.

## Common use cases
- Law-enforcement forensic databases
- Secure facility access
- Research on hand-based biometrics

## Strengths and limitations
**Strengths:** Large feature area; resistant to minor cuts.
**Limitations:** Bulkier sensors; less standardized than fingerprints.

## Key terms
- **Palmprint:** Ridge patterns of the palm surface.
- **Minutiae:** Ridge endings and bifurcations used for matching.


Passkeys / FIDO2 / WebAuthn

title: Passkeys / FIDO2 / WebAuthn

slug: passkeys-webauthn

summary: Passwordless authentication based on public-key cryptography, delivered through WebAuthn (W3C) and CTAP (FIDO).

label: W3C WebAuthn Level 3

label: FIDO CTAP 2.x

label: FIDO Alliance: Passkeys overview

question: What is a passkey?

answer: A FIDO credential (public/private key pair) bound to a user and relying party. The private key stays on the device; the public key is registered with the service.

question: How is this phishing-resistant?

answer: Credentials are origin-bound and never revealed; a signed challenge is produced locally after user verification (biometric or PIN).

question: CTAP vs WebAuthn?

answer: WebAuthn is the browser API; CTAP connects clients to authenticators (platform or roaming security keys).

question: What’s the difference between multi-device and single-device passkeys?

answer: Single-device credentials live only on one device; multi-device credentials can sync across an ecosystem under vendor security policies.

question: How do recoveries and device loss work?

answer: RPs should provide recovery paths (additional authenticators, admin-recovery, or re-enrollment) while balancing phishing resistance and account takeover risks.

label: WebAuthn L3 spec

label: CTAP 2.x spec

label: FIDO Alliance passkeys explainer

description:
## Overview
**Passkeys** implement passwordless login using **public-key cryptography**. Users authenticate with a device-bound credential and local user verification (biometric or PIN), via the **WebAuthn API** and **CTAP** protocols.

## How it works
1. **Registration:** Site asks for a new credential via WebAuthn; an authenticator creates a key pair and returns a public key + attestation.
2. **Authentication:** Site sends a challenge. Authenticator signs it with the private key after local user verification.
3. **Device portability:** Platform sync or roaming authenticators (security keys) enable use across devices in line with vendor policies.

## Common use cases
- Consumer sign-in replacing passwords
- Workforce phishing-resistant MFA
- Step-up auth for high-risk transactions

## Strengths and limitations
**Strengths:** Phishing resistance; no shared secrets; fast UX.
**Limitations:** Cross-ecosystem portability; attestation policy; account recovery patterns.

## Key terms
- **WebAuthn:** W3C API for creating/using credentials.
- **CTAP:** FIDO protocol between client and authenticator.
- **Attestation:** Evidence about the authenticator model/security.


Physiological Biometrics

slug: physiological-biometrics

summary: Physiological biometrics refers to verifying identity based on unique physical characteristics such as fingerprints, face, iris, and vein patterns.

label: ISO/IEC 19794 series overview

question: What are physiological biometrics?

answer: Physiological biometrics verify identity based on unique physical characteristics like fingerprints, iris patterns, or vein structures.

question: How do physiological biometrics differ from behavioral biometrics?

answer: Physiological biometrics rely on stable physical traits, whereas behavioral biometrics analyze dynamic user behaviors like typing or gait.

question: What are common examples of physiological biometrics?

answer: Common examples include fingerprint, facial, iris, and palm vein recognition, all based on inherent physical features.

title: Physiological Biometrics

description: Physiological biometrics encompasses modalities that rely on inherent physical attributes of an individual. Common examples include fingerprint, facial, iris, and palm vein recognition. These traits are generally stable over a person’s lifetime and provide strong authentication guarantees when sensors and matching algorithms are implemented securely.


Biometric Template Protection

title: Biometric Template Protection

slug: template-protection

summary: Techniques like cancellable biometrics and encryption safeguard stored biometric templates from misuse or breach.

also_known_as:
cancellable biometrics
template security

label: ISO/IEC 24745: Biometric information protection

question: What is cancellable biometrics?

answer: A method that transforms templates so they can be revoked and reissued if compromised.

question: How is matching done on protected data?

answer: Approaches include secure enclaves for plaintext-in-TEE matching, helper-data schemes, or privacy-preserving computation (e.g., homomorphic encryption).

question: Can template protection stop inversion attacks?

answer: Properly designed schemes reduce the risk and utility of reconstructions, but security depends on threat models and implementation.

label: NIST biometrics program overview

description:
## Overview
Template protection techniques reduce the risk that stolen biometric data can be reused or inverted, supporting privacy regulations.

## How it works
1. Transform or encrypt templates at enrollment.
2. Perform matching in protected form (e.g., homomorphic encryption or secure enclaves).
3. Allow template revocation and reissue when needed.

## Common use cases
- Privacy-sensitive biometric databases
- Mobile devices with secure enclaves
- Research on secure multi-party matching

## Strengths and limitations
**Strengths:** Limits impact of data breaches; supports revocation.
**Limitations:** Performance overhead; interoperability challenges.

## Key terms
- **Cancellable biometrics:** Reversible transform of templates.
- **Biometric cryptosystem:** Uses cryptographic schemes to protect matching.


title: Verifiable Credentials & Identity Wallets (W3C VC 2.0)

slug: verifiable-credentials

summary: Cryptographically verifiable claims issued by trusted parties and presented via identity wallets, enabling selective disclosure and offline verification.

also_known_as:
W3C VC
identity wallets
decentralized identity

label: W3C Verifiable Credentials Data Model 2.0

label: W3C VC Overview (roadmap)

question: What is a Verifiable Credential (VC)?

answer: A tamper-evident set of claims with metadata proving who issued it; holders store VCs in wallets and present verifiable proofs to verifiers.

question: How does selective disclosure work?

answer: Cryptographic proofs reveal only needed attributes (e.g., ‘over 18’) rather than the full credential.

question: How do VCs relate to government IDs?

answer: They can complement physical documents; issuers (e.g., agencies, universities) issue VCs that can be verified online or offline.

question: What about revocation/status?

answer: Verifiers check credential status lists or cryptographic status proofs to ensure a VC hasn’t been revoked without contacting the issuer.

label: VC Data Model 2.0

label: VC overview

label: Decentralized Identifiers (DID) v1.0

description:
## Overview
**Verifiable Credentials (VCs)** allow entities to issue cryptographically signed credentials that holders store and present through **identity wallets**. Verifiers check proofs without calling the issuer, enabling privacy-preserving flows and offline checks.

## How it works
1. **Issuance:** Issuer signs a credential to the holder’s wallet.
2. **Presentation:** Holder creates a verifiable presentation with selective attributes.
3. **Verification:** Verifier validates signature, status/revocation, and schema against trusted keys/registries.

## Common use cases
- Digital diplomas & licenses
- Age or attribute checks
- Travel & cross-border credentials

## Strengths and limitations
**Strengths:** Privacy via selective disclosure; offline verification; open standards.
**Limitations:** Interop profiles; governance/trust frameworks; revocation/status infrastructure.

## Key terms
- **Verifiable presentation:** A bundle proving certain claims to a verifier.
- **Issuer/Holder/Verifier:** Roles in VC ecosystems.


Video Injection Detection

title: Video Injection Detection

slug: video-injection-detection

summary: Controls that detect injected, replayed, or pre-recorded video streams used to bypass selfie and liveness checks during remote identity verification.

see_also: pad face-recognition deepfake-detection

label: ISO/IEC 30107-3 (PAD testing and metrics)

description:
## Overview
Video injection detection focuses on identifying attempts to feed a verification system a manipulated or pre-recorded stream (for example, via virtual cameras, screen replays, or intermediaries) instead of a live capture from the user’s device camera.

## Typical signals and controls
- Capture pipeline integrity checks (e.g., detecting virtual camera sources).
- Consistency checks across frames and metadata (timing, encoding artifacts).
- Challenge-response or motion prompts combined with PAD/liveness.

## Where it shows up
- Remote onboarding / selfie identity verification
- Account recovery re-verification
- High-risk transaction step-up checks


Voice Recognition

slug: voice-recognition

summary: Voice recognition authenticates individuals based on their unique vocal characteristics like pitch, cadence, and spectral features.

label: ISO/IEC 19794-13: Voice data

label: NIST: Voice recognition / ASV resources

label: ASVspoof initiative (attack corpora)

question: What is voice recognition?

answer: Voice recognition authenticates individuals by analyzing unique vocal characteristics such as pitch, cadence, and spectral features.

question: How does voice recognition handle background noise?

answer: Modern systems use noise reduction and robust feature extraction techniques to maintain accuracy in noisy environments.

question: What prevents voice spoofing in recognition systems?

answer: Anti-spoofing measures include liveness detection, voice challenge-response prompts, and model training against replay attacks.

question: How do systems handle deepfake speech?

answer: Modern anti-spoofing (CM) models are trained on synthetic speech corpora and combined with challenge-response or secondary factors for riskier flows.

title: Voice Recognition

description: Voice recognition systems analyze the physiological and behavioral traits of a person's speech to verify identity. They extract features such as Mel-frequency cepstral coefficients (MFCCs) and match them using statistical or deep-learning models. While highly convenient for remote authentication, voice recognition can be affected by background noise and requires robust anti-spoofing measures.