Biometrics and Identification

Voice biometrics analyzes the unique characteristics of the voice (timbre, frequency, rhythm, speech rate), and face recognition — the geometry of the face. Both technologies are used for identification, but voice biometrics works through telephone channels and does not require a camera, which makes it convenient for call centers and remote identification.

Source: term "Voice biometrics"

Voice biometrics is used in banks (for confirming operations by phone and logging in to mobile applications), in the Unified Biometric System (UBS) for state services, as well as in corporate systems for protecting access to confidential information.

Source: term "Voice biometrics"

Voice biometrics is considered safe, since the voiceprint is difficult to fake. Modern systems use liveness detection for protection from voice recordings and deepfakes. Data is stored in encrypted form using CIPF, which meets the requirements of 152-FZ.

Source: term "Voice biometrics"

Yes, the use of voice biometrics is voluntary. A citizen has the right to refuse the collection of biometric data in the Unified Biometric System by submitting an application through the MFC or the State Services portal.

Source: term "Voice biometrics"

Liveness detection in voice biometrics protects against attacks using voice recordings. The system can request the utterance of a random phrase, analyzes micro-pauses, natural articulation noises (breathing, swallowing) that cannot be reproduced with a recording, and also checks the acoustic characteristics of the room.

Source: term "Voice biometrics"

Modern voice biometrics systems take into account natural changes in the voice during colds, stress, age-related changes or fatigue. They use adaptive models that gradually update the user's template at each successful authentication session.

Source: term "Voice biometrics"

No special equipment is required for the use of voice biometrics — any device with a microphone is enough: a smartphone, computer, tablet or an ordinary telephone set. This makes the technology accessible and easy to scale for any organization.

Source: term "Voice biometrics"

2D recognition works with a flat image and is vulnerable to attacks using photographs and videos. 3D recognition uses a three-dimensional model of the face, analyzing depth and relief, which makes it resistant to forgeries and more accurate. 3D technology also works with changing lighting and angle, as well as with partial overlap of the face.

Source: term "3D face recognition"

The technology is used in smartphones (Face ID, Face Unlock), access control systems, checkpoints in airports, ATMs with biometrics, video surveillance systems and in the Unified Biometric System (UBS). It is also actively used at CII facilities and in government systems.

Source: term "3D face recognition"

Modern 3D systems use liveness detection — analysis of skin texture, micro-movements, thermal radiation and depth. This makes it possible to distinguish a living person from a silicone mask or a 3D-printed model. However, high-quality masks still represent a theoretical threat.

Source: term "3D face recognition"

Access control systems (ACS) integrate 3D terminals for identifying employees when passing through turnstiles or doors. This ensures a high level of security and excludes the possibility of transferring a pass to another person. Biometric data is stored locally or in a protected cloud using CIPF.

Source: term "3D face recognition"

Specialized equipment is used for 3D recognition: 3D scanners with built-in depth cameras (structured light, laser projection, stereo cameras or ToF sensors). In smartphones, compact modules (for example, TrueDepth) are used. For corporate systems — stationary terminals or embedded modules for turnstiles.

Source: term "3D face recognition"

3D recognition uses active infrared lighting (laser projectors or IR illumination), so it works in complete darkness as effectively as in good lighting. The infrared camera records the depth and relief of the face regardless of visible light, which makes the technology all-weather and 24/7.

Source: term "3D face recognition"

The use of 3D biometrics is regulated by 152-FZ "On Personal Data", 187-FZ "On CII Security" and orders of FSTEC of Russia. For government systems, certification of equipment and compliance with requirements for the protection of biometric personal data is required. Collection of biometrics is possible only with the written consent of the subject.

Source: term "3D face recognition"

Fingerprints are an external feature that can be copied, left on a surface or damaged. Vein pattern is an internal subcutaneous feature that cannot be copied or forged. The technology is also contactless and independent of the state of the skin, which makes it more reliable.

Source: term "Vein pattern recognition"

The technology is used in access control systems for especially protected facilities, in banking systems to confirm transactions, at checkpoints and in government systems, including CII facilities. It is also used in healthcare for patient identification and in the transport industry.

Source: term "Vein pattern recognition"

The vein pattern is an internal biometric feature that cannot be copied, photographed or reproduced without access to a living hand. Even if an attacker gets access to the template, he will not be able to use it for authentication, since the system requires live scanning. Modern systems also use liveness detection.

Source: term "Vein pattern recognition"

ACS with vein pattern recognition support are installed on turnstiles and doors for employee identification. This ensures the maximum level of security. Data is stored locally or in a protected database. Such solutions are often integrated with biometric terminals via Wiegand, TCP/IP or RS-485 protocols.

Source: term "Vein pattern recognition"

To operate the system, a vein scanner is required, which can be made in the form of a standalone terminal or an embedded module. The scanner uses an IR camera to obtain an image of the veins and a built-in processor to create a biometric template. A server is also needed to store templates and manage access.

Source: term "Vein pattern recognition"

A finger scanner reads the vein pattern of one finger, takes up less space and is often used in smartphones and compact terminals. A palm scanner analyzes a larger area with more veins, which provides higher accuracy and reliability. The choice depends on the required security level.

Source: term "Vein pattern recognition"

The use of biometric data, including the vein pattern, is regulated by Federal Law No. 152-FZ "On Personal Data". For use in government systems and at CII facilities, compliance with the requirements of 187-FZ and orders of FSTEC of Russia is also required.

Source: term "Vein pattern recognition"

Static biometrics (fingerprints, face, retina) checks the identity once at login and is vulnerable to forgery. Behavioral biometrics works continuously throughout the session, analyzing behavioral patterns: typing speed, mouse movements, manner of working with a device. It is practically impossible to forge, since the patterns are subconscious and unique.

Source: term "Behavioral biometrics"

The technology is used in banking applications to protect against fraud, in corporate systems for controlling employee access, in government information systems for data protection, in the gaming industry to fight bots. It also integrates with DLP systems to detect insider threats and with SIEM systems.

Source: term "Behavioral biometrics"

Yes, behavioral biometrics is actively used in mobile applications. The system analyzes sensor data: force of pressing on the screen, speed and length of swipes, the angle of the device (accelerometer), the manner of holding the phone. This allows continuous protection of banking applications.

Source: term "Behavioral biometrics"

During a social engineering attack, the user may act under pressure or in a state of stress. This changes behavioral patterns: the number of typing errors increases, the typing speed changes, movements become sharper. The system records these changes and can request additional authentication (for example, through MFA).

Source: term "Behavioral biometrics"

Fatigue, stress, hand injuries, changing devices or keyboards, as well as software that changes mouse behavior can affect behavioral patterns. Modern systems take these factors into account and adapt the profile using ML algorithms.

Source: term "Behavioral biometrics"

Modern behavioral biometrics systems provide accuracy up to 95-99%, but errors are possible. False positives — when the system blocks a legitimate user due to non-standard behavior. False negatives — when the system lets through an attacker whose patterns are close to normal.

Source: term "Behavioral biometrics"

The implementation of behavioral biometrics requires collecting and processing data in real time, as well as configuring ML algorithms. Integration with existing authentication systems and SIEM also takes time. Professional design and staff training will help.

Source: term "Behavioral biometrics"

Biometric data is raw samples: a photo of a face, a voice recording, a fingerprint. A biometric template is a mathematical model created on the basis of these data. It is impossible to restore the original data from a template, which makes it safer for storage.

Source: term "Biometric template"

In the Unified Biometric System (UBS), templates are stored in encrypted form using certified CIPF. Access to templates is strictly limited, all operations are logged. Hashing and salt are applied.

Source: term "Biometric template"

A biometric template is created on the basis of unique characteristics of a person that cannot be changed. If a template is compromised, it cannot be "replaced" like a password. However, the cancelable biometrics technology can be used.

Source: term "Biometric template"

ISO/IEC 19794 is an international standard that defines the formats of biometric templates for various types of data: fingerprints, face images, voice, vein patterns, iris and others. The standard ensures compatibility between different systems.

Source: term "Biometric template"

There are physiological templates (fingerprints, face, veins, iris, DNA), behavioral templates (voice, signature, gait, keyboard handwriting) and multimodal templates (a combination of several features). Multimodal systems provide higher accuracy.

Source: term "Biometric template"

Cancelable biometrics is a technology in which various derivative templates are created from the original biometric data (using special transformations). If one template is compromised, another can be used, created on the basis of the same original data.

Source: term "Biometric template"

In Russia, the requirements for storing biometric templates are established by 152-FZ "On Personal Data" and FSTEC orders. Templates must be stored in encrypted form using certified CIPF, on servers located on the territory of the Russian Federation.

Source: term "Biometric template"

On the cover of an electronic passport there is an icon of a microcircuit (a camera with a dot in the middle). It also contains 46 pages (instead of 36 in the old format), and the first page is made of plastic. The validity period of such a passport is 10 years instead of 5 years.

Source: term "Electronic passport (RFID foreign passport)"

The RFID chip stores the biographical data of the holder, a digital photograph, and in some countries — fingerprints. The data is protected by cryptographic keys (BAC and EAC protocols) and cannot be read without physical contact and authorization.

Source: term "Electronic passport (RFID foreign passport)"

At border crossing points, NFC readers are installed that activate the chip at a distance of up to 10 cm. The system authenticates the chip, reads the data and automatically verifies it with the information on the passport pages.

Source: term "Electronic passport (RFID foreign passport)"

Reading the chip requires physical contact at a distance of up to 10 cm and knowledge of access keys (BAC). Without these keys, the chip does not issue data. Covert reading is impossible, since the attacker needs to be in close proximity. The data on the chip is also encrypted.

Source: term "Electronic passport (RFID foreign passport)"

The validity period of an electronic foreign passport is 10 years from the date of issue (unlike 5 years of a passport of the old format). Electronic passports are also issued for children for a period of 5 years.

Source: term "Electronic passport (RFID foreign passport)"

An electronic passport allows passing automated border control (e-Gates) in many countries, which significantly speeds up the passage of passport control. It also contains more pages for visas (46 pages) and has increased protection from forgeries.

Source: term "Electronic passport (RFID foreign passport)"

Yes, an electronic passport is safe. The data on the chip is encrypted, and physical proximity (up to 10 cm) and knowledge of the access keys from the MRZ are required to read it. Modern EAC protocols protect even fingerprints. This complies with the requirements of 152-FZ.

Source: term "Electronic passport (RFID foreign passport)"

3D face recognition, fingerprint scanning, vein pattern recognition and iris recognition are used. Multimodal terminals combine several methods.

Source: term "Biometric terminal"

Biometric terminals are used at CII facilities, in government institutions, at border crossing points, in banks and at enterprises with increased security requirements.

Source: term "Biometric terminal"

Modern terminals use liveness detection — a technology that distinguishes a live object from a counterfeit. Conductivity of the skin, micro-movements and blood flow are checked.

Source: term "Biometric terminal"

Terminals integrate with access control systems via network interfaces or protocols (Wiegand, RS-485). Data is transferred to SIEM systems.

Source: term "Biometric terminal"

The cost varies from 10,000 to 300,000 rubles depending on the type of biometrics and functionality. Models with 3D face recognition can cost from 80,000 to 300,000 rubles.

Source: term "Biometric terminal"

Yes, most terminals support time tracking. The system records the passage time, allowing automatic report generation.

Source: term "Biometric terminal"