FIDO Alliance launches comprehensive selfie biometric IDV certification program

The FIDO Alliance is launching a biometrics testing program to provide Face Verification Certification to enable vendors to demonstrate accuracy and lack of bias in their remote biometric identity verification technologies.

Independent evaluation is important for the entire identity lifecycle, but “if you have weak onboarding methodologies, it creates a big back door for attackers,” FIDO Alliance Executive Director and CEO Andrew Shikiar tells Biometric Update in an interview. “So, we’ve always had a vision to strengthen the identity verification process.”

Certification is based on at least 10,000 test verifications, with requirements based on established ISO standards, FIDO says. Identity verification software is assessed for accuracy across skin tones, ages and genders. Spoof resistance is measured with Imposter Attack Presentation Accept Rate (IAPAR), and usability and security are measured with False Reject and Accept Rates (FRR and FAR). The match rate for selfie biometrics and government-issued ID documents is also tested.

Combined, these tests of accuracy in matching, presentation attack detection (PAD) and for different demographics marks a new kind of comprehensive assessment of identity verification effectiveness. It is, Shikiar says, “the complete package; built by industry for industry.”

The FIDO Alliance notes the importance of addressing bias in biometric systems and their robustness to new security threats in the announcement.

Survey results just released by the Alliance shows that half of U.S. and UK consumers say a discovery of bias in an organization’s biometric system would reduce their trust in that organization. More than a third say deepfakes have made them more concerned about performing online identity verification.

The new certification was previewed at Authenticate 2023, and it comes just as concern about deepfakes reaches fever pitch. Social engineering and phishing remain the most scalable types of attack, Shikiar says. AI is making the problem worse, while also fueling deepfakes, “and they’re starting to scale as well.”

Pioneering FIDO identity verification certification

iProov’s Dynamic Liveness, which the company says protects against AI-generated attacks like deepfakes as well as providing presentation attack detection with the company’s Flashmark technology for remote user onboarding and authentication, is the first product to pass the test and earn FIDO certification.

“Biometrics are a powerful tool that organizations can utilize to facilitate secure, inclusive, and user-friendly interactions online,” says iProov Founder and CEO Andrew Bud. “Each of these three fundamental components must be given equal consideration as organizations evaluate their options. With the FIDO Face Verification Certification program, organizations now have a trusted compass for navigating these decisions. We applaud The FIDO Alliance for addressing the importance of biometric identity verification to strengthen the full user identity lifecycle. Independent certification creates a much-needed quality benchmark for this evolving technology and further demonstrates our ability to provide trusted identity assurance in an age of AI threats and identity fraud.”

Ingenium Biometrics and TÜV Informationstechnik (TÜV Nord Group) have been accredited to perform certification testing, and more independent labs are expected to join them during the year ahead. There are several other labs that have already been through FIDO’s accreditation process for security and biometrics testing programs, and Shikiar says the Alliance is “engaged with several right now” as it broadens choice for vendors.

The Face Verification Certification extends FIDO’s portfolio of testing programs, which already includes Biometric Component Certification and Document Authenticity (DocAuth) Certification. There are already over a thousand products certified through one of these FIDO programs, Shikiar says. “Just as we see FIDO certification becoming a staple part of RFPs for user authentication, that’s 100 percent our goal for identity verification as well.”

The program will evolve with “ongoing industry-wide input into our certification program” to respond to changes in standards and the threat landscape, Shikiar says. “Part of the value of a certification program is its longevity,” he observes, and requirements for re-certification will eventually be introduced to FIDO’s Face Verification Certification program.

“At the end of the day,” Shikiar says, “we want to help create a safer internet and help protect our connected economy, and we think the certification stands to do that.”

Article Topics

biometric testing  |  certification  |  facial verification  |  FIDO Alliance  |  identity assurance  |  identity verification  |  Ingenium Biometrics  |  iProov  |  remote verification  |  selfie biometrics  |  TÜV Informationstechnik