There is no denying the recent boom in the use of video identification solutions as a method to enable the management of all kinds of procedures, thus eliminating the need to be present in person. Sectors such as banking, insurance or legal are gradually increasing the use of video identification software in their day-to-day business.
For this reason, the Spanish Ministry of Economic Affairs and Digital Transformation, in BOE núm. 115, of 14 May 2021, regulated remote video identification methods for the issuance of qualified electronic certificates. This forces the providers of this type of services to validate their solutions in the terms established in Anexo F11 de la Guía de Seguridad de las TIC CCN-STIC 140 of the National Cryptologic Centre, by means of product certification, with a deadline of 1 July 2022 for obtaining this certification, a period that was extended to 1st of January 2023.
What is exactly a video identificatin product?
According to anexo F.11 – M: Herramientas de Videoidentificación de la Guía de Seguridad de las TIC CCN-STIC 140: “they arise in response to the need to establish mechanisms for remote authentication and identification, in dorder to contribute to reducirng the number of times that citizens have to travel to carry out procedures, without affecting their rights".
Main characteristics of a video identification product.
There are common characteristics in this taxonomy of products, as reflected in this annex, among which we can find:
Evaluation requirements applied to video identification tools.
CCN establishes a series of fundamental security requirements for the evaluation of each product family.
The requirements shown below are those that apply to the family of video identification tools, highlighting the most specific ones for this type of products, contained in the security functionality "Video identification requirements". . In this case, we can find the specific requirements for this taxonomy in the Anexo F11 - M: Herramientas de Videoidentificación de la Guía de Seguridad de las TIC CCN-STIC 140.
Specific evaluation tests for the biometric module
The following Technical Instruction provided by the certification body (CB) of the CCN must be followed to perform the evaluation tests for the biometric module (MEB).
This covers up to hasta 8 tests to be performeds covering different types of biometric and cunctional attacks as detailed below:
P1.2M: Verify successful verification under different environments
The objective of this test is to to verify that the product works correctly in the usual use cases, assuming a cooperative use and showing the corresponding proof of life. . For this purpose, 6 reliable subjects are selected as defined by the CCN_MATCH tool which asks for a minimum % dissimilarity between them.
The expected outcome of these video identifications should be successful as the product should detect that the reliable user who is being identified is the one who claims to be.
P1.6: Check that the product verifies proof of life
The objective of this test is to check if the product verifies the proof of life (the product asks you to smile, raise your hand, etc.) For this purpose, the evaluator will go through the whole video identification process, but when he/she reaches the step of showing the proof of life, he/she will stand still without doing it.In this way, if the final result of the video identification is successful, the product will be failing in this test as it will lack proof of life where it cannot demonstrate whether the user being identified is alive or not.
P3.1: Impostor presentation attacks
The objective of this test is to check that the product is not vulnerable to impersonation of a reliable user by an attacker who has a certain % of resemblance between the reliable user using the CCN_MATCH tool as seen below.
The attacker will perform the whole identification process and will check if the final result of video identification of the product is successful or not, being unsuccessful the favourable result for this test.
P3.3.2: Presentation attacks using videos
The purpose of this test is to check that the product is not vulnerable to the impersonation of an reliable user by an attacker using a video of the reliable user that was previously being identified.The attacker must achieve a synchronism between the video of the user and the exact moment of the identification process in order to display the proof of life.
The expected result of this video identification should be unsuccessful as the product should detect that what it is seeing is a pre-recorded video of a video identification and not a real scenario.
P3.3.3: Presentation attacks using very low-cost masks
The purpose of this test is to check that the product is not vulnerable to the impersonation of a trustworthy user by an attacker using a low-cost mask, such as a cardboard or cloth mask, as shown in the following image.
The tester must perform the whole identification process showing the proof of life with the low-cost mask and will check if the final result of the video identification of the product is successful or not, being unsuccessful the positive result for this test.
P3.3.4: Presentation attacks using advanced masks
The purpose of this test is to to check that the product is not vulnerable to the impersonation of a trustworthy user by an attacker using an advanced mask csuch as professional and realistic masks like the ones shown in the following image.
The tester must perform the whole identification process showing the proof of life with the advanced mask and will check if the final result of the video identification of the product is successful or not, being unsuccessful the positive result for this test.
P3.3.5: Presentation attacks using make-up
The purpose of this test is to check that the product is not vulnerable to impersonation of a reliable user by an attacker using make-up to resemble the face of the reliable user as shown in the image below.
The made-up attacker must perform the whole identification process by showing the proof of life and will check if the final result of the video identification of the product is successful or not, being unsuccessful the positive result for this test.
P3.3.6: Attacks using Deepfake computing tools
The purpose of this test is to check that the product is not vulnerable to impersonation of a reliable user by an attacker using Deepfake software tools.As can be seen below, the tester has trained a model of the reliable face of the user to successfully impersonate the user.
The attacker with Deepfake enabled must perform the whole identification process by displaying the proof of life and will check if the final result of the video identification of the product is successful or not, being unsuccessful the positive result for this test.
Video Identification product evaluation, we can help you
As an expert laboratory in the evaluation of this taxonomy of products under the LINCE methodology, we have the necessary expertise should you wish to evaluate your product and include it in this category.
As a leading LINCE assessment laboratory, our experience and training will help you to make the certification process as smooth as possible, , reducing the time and resources required by our clients.
If you want to obtain a valid cybersecurity certification for your video identification solution, we will be happy to help you.
