Secure document verification

Transcription

1 Secure document verification Reliable document verification for efficient control procedures Author: Andreas Rach Product Manager, Verification Solutions Bundesdruckerei GmbH Oranienstrasse Berlin, Germany Identity checks at the border must be as fast and as convenient as possible and should not cause long delays for travellers. But it is even more important that this process is as reliable as possible. Today's document verification systems support border control officers in their work. They help them to detect forged ID documents and to quickly decide whether the person presenting the ID document is in fact the holder. As an internationally recognised ID document the passport plays a key role in identity assurance all over the world. Reliably checking this document, especially at borders, is considered to be one of the most important ways of verifying or confirming a person's identity. The authenticity and validity of documents are checked, the document holder is identified on the basis of the personal data and, if necessary, subjected to further examination. This task calls for an enormous amount of specialist knowledge even with classic, i.e. non-electronic, ID documents. This is largely due to the vast number of international documents and the diversity of personalisation methods and security features in use. Most known document security concepts are based on printed security elements, however, documents issued today by many countries increasingly contain additional electronic security features to ensure reliable identity protection. These security features are usually based on computer chips directly integrated into the document. The personal data, a facial image that can be used in biometric procedures and two (optional) fingerprint images are digitally signed and stored in these chips.

2 New documents call for new verification systems Currently 89 countries issue chip-based travel documents. The technical specifications of almost all of these documents comply with the recommendations of the International Civil Aviation Organization (ICAO 1 ). For most documents, Basic Access Control (BAC) is used to control access to the stored data. In addition to the biographical data and the facial image of the passport holder, two fingerprint images can also be stored in epassports. In order to protect these additional identity features, all the EU member states are required to integrate the Extended Access Control (EAC) protocol. This type of access protection, which is based on authorisation certificates, allows government-authorised reading of fingerprint data which require special protection. In line with an ICAO recommendation so-called Passive Authentication (PA) is used to check the digital signatures of the personalised chip data for authenticity and possible manipulation. PA is also based on digital certificates. These certificates which must be signed by the document issuer and his authorising government body must be available to the verification system for instance via the link to a public key infrastructure (PKI) that provides the certificate. Over the past few years, many public authorities and document issuers have focused on the development of electronic documents. The focus today is on setting up the infrastructures needed for electronic document verification. Electronic ID documents are the key to new reliable methods of verification When checking the authenticity of documents, the signature verification of the chip data yields much more than a simple plausibility check of the document's machine readable zone. In addition to verifying data consistency, another precondition for establishing the authenticity of the personal chip data is the validation of the chip signature with the entire "trust chain" right down to its so-called "national trust anchor". In other words, it must be verified whether the chip signature was produced by a document manufacturer whose signature was also signed by a public authority. Meanwhile, an international infrastructure is in place to provide trustworthy certificates for verifying the signatures of electronic MRTDs the ICAO Public Key Directory (PKD) 2. Currently (November 2010), 21 countries participate in the PKD. The number is increasing continuously. 1 International Civil Aviation Organization. In its Doc 9303 specification, ICAO lays down the requirements for travel documents issued by participating countries. 2 ICAO website for the PKD:

3 For the issuing countries the introduction of electronic ID documents is the first step on the road to greater document security. They also have to invest in a document verification infrastructure that is tailored to their respective needs. Optical and electronic verification: the combination matters Optical security features always play a key role and remain important even when chips are used in documents. An optical check can be carried out even if the document does not have a chip, if the chip cannot be read or if the certificate chain cannot be accessed. The certificate chain can only be verified when the public key infrastructure (PKI) is accessible and contains the relevant certificates. Under most jurisdictions, a document is valid proof of identity even when access to the chip is not possible during the ID check. Although the number of countries issuing electronic documents is growing rapidly, the majority of ICAO member states still issue passports secured with optical features only. Considering the fact that ID documents have a validity period of up to ten years, the large stock of documents without a chip will continue to circulate for a long time to come and these documents must be checked on the basis of their visible optical security features. If, however, a chip is integrated into the document, this boosts document security significantly as the chip data can be additionally compared to the printed biographical data. The key to the best and most reliable information regarding the authenticity of a document is a comprehensive, combined examination of both the optical and electronic security features. Mastering document diversity In addition to electronic passports, there are countless other travel documents in circulation world-wide. More than 170 countries currently issue ID cards, visa documents or classic passports with a machine readable zone (MRZ) which are based on the ICAO guidelines. In the past, there have been many reports on the challenges of reading an MRZ 3 reliably. The integration of a uniform MRZ means considerable advantages for processing speed and document recognition. But, looking at the details, some documents deviate from the ICAO specification. State-of-the-art verification systems, however, are able to deal with deviations. This enables reliable document verification with automated support. 3 Keesing Journal, Issue 24, 2007 "OCR-B Machine Readability Factors of Influence" by Mike Ellis

4 Fig. 1: Example of a document in circulation having a composite check digit not compliant with the ICAO Doc 9303 recommendation Fig. 2: Example of a document in circulation where the number of characters per MRZ line does not comply with ICAO Doc 9303 recommendation Other security features are much less standardized and call for specialist knowledge in order to detect forgeries and manipulations. ICAO Doc 9303 provides a guide for ensuring the authenticity of documents with different features. The specifications concerning feature positions and sizes leave sufficient creative leeway for document producers to design their documents, thus allowing a colourful range of distinguishable documents to be created. The final attributes of optical security features are defined by the respective governments and

5 depend on the technologies and know-how available to the document manufacturers. This means that this leads to strong manufacturing-related variations in positions, levels of absorption, design details, contrast, etc. within document types and series. Specialist knowledge unveils forgeries This is where present-day verification systems come into play. Even when the authorities in charge have access to very detailed information on document verification, there is often not enough time to make full use of this information in an actual control situation. At the same time, forgers are increasingly becoming experts and deploy general technological developments for identity fraud. Hence, document verification today requires a change in attitude. In order to give an officer more time for comprehensive plausibility checks and so-called profiling, powerful support systems should enable much more efficient processes for checking documents and individuals. Regularly updated, knowledge-based systems, for instance, could continuously improve the performance of international ID document verification. They quickly supply the officer with valuable information about security features and help him to assess whether a document presented is genuine or not. At the same time, national and international wanted lists are searched and the results are presented to the officer. The time gained through more efficient processes can be used to check the document holder more closely in the case of irregularities. Strengths and weaknesses of current document verification systems In order to perform an efficient, machine-supported document check, detailed basic data of the document to be checked is required. Based on this data, the document can be compared with the attributes stored in the verification system. Swipe readers quickly capture the MRZ and are easy to handle with stable datapages made of various plastic materials; however, they do not provide any information about the optically visible security features. An ISO reader is additionally required here in order to read and verify the chip data. This is why full-page readers are increasingly used at many borders. These readers capture a white-light, infrared and UV-A image of the document datapage and read out the electronic data at the same time. In addition to the MRZ check, the images are displayed to the officer and a document paper test is carried out. Countries with knowledge-based document verification systems are one step ahead; these systems know and automatically verify the specific features of identity documents. They

6 identify the document presented on the basis of the images taken and evaluate security feature patterns under different illumination conditions. Fig. 3: UV features of a sample passport taken in October 2007 Fig. 4: Despite extended exposure time, degradation of the UV features can be clearly seen in the image of the same passport taken in November 2010

7 The systems currently available on the market differ in terms of the number of trained documents, the number and logical linking of verifiable features, the consideration of manufacturing tolerances as well as the effects of wear and tear on the ID document. Dozens of individual checks are automatically combined to obtain an overall result and the integrated document knowledge supplies images of sample documents for quick visual comparison and inspection. What's essential here is the quality of the check along with the quality of the information stored. A system with a sufficiently low false acceptance rate (FAR) 4 supports the officer and a system with a sufficiently low false rejection rate (FRR) 5 leads to the necessary acceptance among officers and document holders. To achieve this, the underlying document knowledge and the verification algorithms must always be up to date and well aligned. That's why many state-of-the-art verification systems offer often on a monthly or more frequent basis - the inclusion of the latest findings on new documents, production changes and recently uncovered forgeries. These document verification systems provide specialist knowledge and help officers considerably. They offer a high degree of support for decisions during document checks. By taking over routine tasks, they allow officers more time for checks that cannot be performed by a machine. Standardisation and standards There are hardly any standards for knowledge and rule-based document verification systems. The individual checks are derived from the document specifications and the guidelines drawn up for this purpose. The MRZ check with its integrated check digits, for instance, is the most precisely defined check and hence the best-comparable check. This is due to the fact that the MRZ was not designed as a security feature but as an area designated for machine-based reading of document data. Nevertheless, easily detectable deviations in the MRZ are often an indication of forgery or manipulation. More advanced standards would make absolute sense and are under discussion among the respective committees. Good standards promote comparability between devices, software and complete systems. Up to now, when selecting a new system, it is necessary to 4 False acceptance: A false or forged document is not rejected. 5 False rejection: A genuine document is rejected.

8 repeatedly perform comparisons and tests in order to better define the requirements and suitability of document verification systems. Known and standardized verification methods have known weaknesses which are covered by intelligent verification systems and hence offer no potential for attack. A forger would attempt to forge in compliance with standards in order to avoid drawing attention to himself. Good verification systems, however, always go beyond the "state of the art". Creativity and variations in system design are therefore still demanded and necessary.