The Use of ID Reader-Authenticators in Secure Access Control and Credentialing

The Use of ID Reader-Authenticators in Secure Access Control and Credentialing Theodore Kuklinski, Bruce Monk AssureTec Systems, Inc., Manchester NH ted.kuklinski@assuretec.com, bruce.monk@assuretec.com Abstract Knowing who is entering, and whether they should be granted access, is key information for many types of military, government and commercial facilities. In many situations, access is granted based on an Identification Document (ID) such as a dri ver s license, passport, visa, or other specialized ID card. Although screeners are trained to detect false IDs, they have the daunting task of trying to do this within a few seconds for large numbers of people and types of documents on a daily basis. Newe r cost effective ID Reader-Authenticators can add a high degree of automation and accuracy to the secure access control process. Available in a variety of physical configurations, they can automatically read IDs in full color at high resolution with multiple light sources, extracting image fields such as photos, as well as data fields, whether from text, barcodes, magnetic stripes, or embedded chips. The data extracted can be vetted against external watchlists without compromising priv acy. They can process most currently issued IDs whether or not they contain machine readable enhancements. IDs can be authenticated via a wide variety of tests based on detecting embedded security features. Reader-Authenticators are particularly useful in the enrollment process (as part of new government ID initiatives) to avoid issuing IDs based on false breeder documents. Secure access control, whether at a national border, secure installation, lobby of a building, or airport screening area, can be enhanc ed with the use of today s advanced Reader-Authenticator technology. 1. SECURE ACCESS CONTROL In the much more security conscious post 9/11 era, it has become of utmost importance to know who is entering military, government and commercial facilities and whether they should be granted access. The traditional security paradigm holds that there are three ways to authenticate a person: (1) what the person is - a biometric such as a photo, signature, or fingerprint, (2) what the person knows e.g., a special password, or (3) what the person has - a token of some kind that is carried with the person. In many situations, that token is an Identification Document (ID) such as a driver s license or passport. More effective security is often achieved with some combination of these elements. Data derived from an ID card can be vetted against external watchlists or databases. For instance, the ID number (from what they have) can be the key to accessing stored biometric information, such as a facial image, to compare with the presenter (to test what they are), and even provide questions to ask the presenter (to test what they know). A photo derived from the card could be compared with a live photo of the presenter and sent to a remote server for facial matching to a previously stored image. As an access control example, airport screeners on the frontlines visually inspect a passenger s ID, verify the photo to the presenter s face, and then compare the name to that printed on the boarding pass. Although screeners are trained to detect fake IDs, they have the daunting task of trying to do this within a few seconds for hundreds of passengers and types of documents on a daily basis. In others cases, such as military checkpoints, it may be desirable to fully automate the credential validation process at a distance from the inspector. What kind of places need secure access control? Among these are governmental facilities (buildings, monuments, etc.), border control stations, military areas and facilities, cargo handling areas, hazardous material areas, nuclear facilities, transportation facilities (air, rail, subway, bus, buildings (lobby check-in), and ), entertainment venues (large sporting events, age restricted sites). 2. CREDENTIALING FOR SECURE IDs In recent years, there have been many new government programs introduced, having the goal of improving the 978-1-4244-1978-4/08/$25.00 2008 IEEE 246

security of such IDs. Newer e-passports have or are being introduced in many countries including both traditional and credit card sized form factors. Other examples include the GSA s HSPD-12 program for reissuing more secure US Government IDs, and the Transportation Workers Identity Credential (TWIC). The enrollment credentialing process for such newer ID initiatives often includes the collection of biometrics such as fingerprints. The implementation of some new ID initiatives have taken years to implement. There will be an existing base of existing format documents that will be with us into the foreseeable future. For example, new e-passports have only been issued in volume over the last year, and it will take a period for existing passports to expire and be replaced. Thus there will be a need to be able to read and process such older IDs. These newer secure documents often include RFID chips which can be queried via special readers. Such chips can fail either through wear, moisture, or by intentional disablement, thus necessitating processing the document manually anyway. There have also been concerns that such chips could be read at a distance which has been addressed in some cases by altering the information that is accessible via RFID and requiring a read of some other printed data in order to unlock the RFID information. There is a particular need in the credentialing enrollment process to avoid issuing new real and very secure IDs based on false breeder documents such as fake driver s licenses. Existing old school IDs are one of the primary evidence sources for granting new secure IDs. An automatic system which is capable of both reading and authenticating such breeder documents is highly desirable. Reading the data from such documents allows automatic querying of remote databases. Validating the genuineness of the physical document protects against someone using valid data on a false document which might contain a substituted photo, birthdate, or other information. Document Variability Early ID readers were only capable of processing IDs that were specifically designed for machine processing. Passport readers really only had to perform Optical Character Recogniton (OCR) on the two line Machine Readable Zone (MRZ) of a passport, which was specifically formatted according to International Civil Aviation Organization (ICAO) specifications. License readers could just deal with the magnetic stripe information or the PDF- 417 2D barcode information. However, some of today s Reader-Authenticators are capable of processing most of the currently issued drivers licenses, passports, and visas whether or not they contain machine readable enhancements such as barcodes, magnetic-stripes, RFID chips, or specially formatted MRZs. There are a tremendous number of ID types being used in the world today and new varieties are being introduced on a regular basis, sometimes for simple aesthetics and in other cases by a desire or mandate for more document security features. A given issuing agency (state or country) typically has a number of different unexpired generations in circulation at any given time. There are three sizes of standard ICAO formatted ID Documents, ID-1, ID-2, and ID-3. Driver s licenses are ID-1 size while full size passports are considered of ID-3 size. ICAO documents have MRZs with two or three lines of OCR-B font text containing relevant information. However, there are many passports that do not follow the ICAO standards as to MRZ or layout of other information. There are some passports where the photo is not even on the same page as the text data (e.g. Brazil). There are cases where the country follows the ICAO standards but still the passport information may even be handprinted if produced under certain circumstances. Among the types of photo IDs often presented are types other than driver s licenses, such a military IDs, foreign voter ID cards, visas, border crossing cards, and consular issued cards such as the Mexican Matricula Card. Indeed there are ID books or even online references which will show some of the common variants of licenses or passports. Even within a given state, there are many classes of licenses for different purposes - under 21 years of age, Commercial Drivers License (CDL), non-driver ID, motorcycle, etc. These variants may have different wording, have the photo in different locations and, usually in the case of US Under 21 licenses, be in portrait instead of landscape orientation. Although screeners are trained to detect fake ID s, they have the daunting task of trying to do this within a few seconds for hundreds of passengers and types of documents on a daily basis. Inspectors may be familiar with IDs from larger countries or states but would have difficulty recognizing some IDs from less familiar locales as legitimate or not without consultation with some auxiliary reference material. Furthermore, it would be almost impossible for them to know the security features that might be present in such documents. Even armed with magnifiers and UV flashlights, they may not be able to discriminate false documents from real. Screeners have varying amounts of training and experience. As with any repetitive task, they are subject to distraction, get tired or bored sometimes, and may even be subject to compromise. By focusing on the analysis of the ID, they spend less time on the analysis of the ID presenter, which may also hold clues to nefarious intent. This is where the true value in the use of Reader- Authenticators comes into play. They are not subject to the attention span problems of humans and can analyze an ID with the same degree of thoroughness each time. Such systems are trained to recognize most IDs in circulation, even the uncommon ones, and to know where to quickly find the name, ID number, photo, and to evaluate the 247

security features in play for that particular document. They can deal not only with pristine ID documents but can be trained to deal with those that are severely worn, dirty, cracked, or even documents that are taped together. 3. READER-AUTHENTICATORS A new generation of cost effective ID Reader- Authenticators can add a high degree of automation and accuracy to both the secure access control and secure document credentialing processes. What is a reader authenticator? Reader-Authenticators both read the data on IDs and perform some steps to authenticate whether the document is real or not. Reader-Authenticators have both a hardware device component, responsible for the actual image capture of an ID document, and a software component, most often running on a PC which analyzes the images, extracts data, and determines document authenticity. Reader Authenticator Hardware Factors Today s devices are capable of one step automatic reading of IDs in full color at high resolution with multiple light sources (e.g. IR, UV, coaxial). Color capability is a very important component in automatic document classification and validation, just as it is for human inspectors in judging ID characteristics. While much information can be gleaned from the color visible image of an ID, there is a lot of security value in analyzing the ID under alternate light sources such as near-infrared (IR) and Ultra-Violet (UV) lighting sources. IR images tend to show up any carbon based ink. Often this can be used to advantage to perform OCR in the absence of background color interference. In addition, some issuers imprint IDs with patterns or seals only visible in IR. Most IDs are printed such that their appearance under UV light is dull; this allows special colored patterns to become visible against a dark background when excited with UV light while many false documents will glow bright under a UV light source. A special glass bead laminate is used in some passports and licenses in which a special pattern becomes visible if illuminated with a coaxial light source. Images captured under such additional lighting scenarios basically add extra dimensionality to an ID, dimensions which raise the bar for would be forgers. Spatial resolution of scanning and camera devices is another important consideration. Typical resolutions run from approximately 200-600 dpi in today s Reader- Authenticators. Higher resolution imaging allows the discernment and detection of microprint and texture based security features and may permit the decoding of special watermarks embedded in photo images produced by some ID card producers. Depending on the specific usage scenario, they are available in a variety of physical configurations for desktop, self service kiosk, or even mobile use. Desktop Devices - Desktop units have traditionally been used at customs inspection stations. On sometimes cramped workspace, the size footprint of the device is often an important consideration. Devised for reading passports and smaller documents, such Reader-Authenticators might be considered something like small copy machines with a glass platen surface on which the ID document is placed. Camera based units essentially take a picture of the ID under different illumination conditions which are sequentially generated. This has the advantage of very short read time since no motion of the document is involved. A hood-like cover prevents stray light from interfering with the imaging, particularly in detecting sometimes faint UV patterns. Such devices are usually intended for use by a dedicated operator. There are a number of companies who manufacture such hardware devices, which vary in size, spatial resolution, and speed of capture. There are new generations of smaller desktop units for processing ID-1 sized cards. Some of these devices mechanically transport the card into the unit and utilize fixed image sensor heads that the card is pulled across. Some such devices have separate reading heads for the front and back of the card or for alternate light sources (e.g. IR), and may contain a magnetic stripe read head as well. Today there are a number of simple card scanners or even duplex page full page scanners that can also accommodate ID-1 size cards. Such devices can act as input devices in a Reader-Authenticator System; however, authentication capability is usually reduced in the absence of IR or UV imaging capability. Kiosk Devices - In the interest of saving labor costs, automated kiosk mounted readers are now becoming available. These allow unattended or semi-attended operation. Such devices have found some current application in airline check-in terminals. They are beginning to be deployed in many financial application scenarios in situations where a driver s license might be required to be presented. Kiosks may have camera or scanner type operation depending on the variety of IDs which are to be processed. In some military situations, e.g. where the presenter may potentially have bomb material, it may be desirable for the ID checking to be done at some safe distance from the inspector. Only after appropriate ID or possibly chemical detector checking, would the presenter be allowed closer access., Mobile Devices - There are some situations where the checking of IDs may be performed by someone who needs to be mobile and may be assigned to different locations where it is not convenient to have a desktop system due to power or other constraints. One such possible situation is 248

at airports where inspectors examine passenger IDs prior to allowing entry to the security inspection area. For such situations, there are battery powered devices that may be hand carried or even waist mounted. Such systems may be self contained with localized processing and communication via wireless to a central server. When an operator uses a device for a significant portion of the day, having the ID processing be automatic becomes quite important. Fully automatic readers allow the operator to place the ID in any orientation into the device and then automatically detect the presence of a document, locate the document position within the view area, discriminating the ID image from fingers which may be in view, deskew the image, rotate to a correct orientation, and crop the ID from the background. This correctly oriented cropped image can then be classified as to issuer and series type by further analysis. Such a one step operation has a significant operator speed advantage over a process which might require a separate step of manually selecting an ID type from a list or of even requiring a separate swipe of the magnetic-stripe or scan with a separate barcode scanner. Devices are usually equipped with some indicator light feedback indicating such status items as when it is okay to place or remove a document, a color indication of the result of any authentication (accept or reject), and power status. Auditory feedback to the user can also be important, providing an indication when it is okay to remove the ID from the device after all necessary images have been captured. Operator efficiency at processing IDs is important if there are lines queued up, for instance, waiting to clear customs. Average document processing time with Reader- Authenticators typically should only take a few seconds. In some inspection scenarios (such as border crossing), frontline inspectors have to process a great many ID holders quickly but can pass off any documents with which they have difficulty to secondary inspectors who have more training and experience. Devices are usually interfaced with a PC via a USB-2, Firewire (IEEE-1394), or in some cases by network connection. The higher speed interface is necessary since high resolution ID images can be large in lossless uncompressed form especially if multiple light sources are involved. ID Processing Software Engine The software based analysis engine component of Reader- Authenticators is important to a successful deployment. Different implementations of Reader-Authenticators vary quite a bit in analysis capability. The following are some steps taken in a typical automated document authentication process. detect document insertion perform an initial document capture classify the document by type and series capture additional images in other lighting conditions if relevant (e.g. UV) extract relevant image data fields from the card (e.g. photo, signature, UV, IR) extract alphanumeric information (OCR, Bar Code, MRZ, magnetic stripe, RFID) perform authentication tests provide images, text, and authentication result to user / server All these steps can typically be performed in only a few seconds total. The image fields extracted, for example photos, could be used for facial matching with the presenter or previously captured stored database photo. Alphanumeric data can be extracted and decoded via multiple methodologies including Optical Character Recognition (OCR) of printed text strings, or software decoding of images of 1D or 2D barcodes. Driver s licenses from many states utilize the PDF-417 2D barcode format to encode the same information printed on the license in plain text. In readers equipped with integrated magnetic stripe heads or an embedded chip decoder, the data can be extracted and even compared with the printed information. It is much easier to generate fake documents with today s computer technology. Even without access to such technology, fake IDs are readily available for a price on the internet or the local street corner in some localities. The quality of fake IDs varies tremendously in some cases, even stolen genuine blank ID laminate and other blank stock is used. In other cases, presenters can get often away with fake IDs that look nothing like any document from the issuing government body if the issuing state is remote from the inspection location and the inspector is not as familiar with the form of the issuer s IDs. IDs can be truly authenticated via a wide variety of tests based on extracting embedded security features, e.g., microprint, UV and IR patterns, seals, holograms, and data field crosschecking. The measures that may be used to determine authenticity are different for each document. In some cases, the presence of some characteristic may determine if it is real; in others it is the absence. Where text data is available from multiple locations on an ID, the data can be crosschecked. Detailed pattern matching can be employed to detect subtle differences between real and false documents (something as minuscule as a missing or extra serif on a given letter, a slightly different font, or an intentional misspelling). In almost all cases there is some detectable difference between a real and fake document. The overall outcome of the authentication process can be a risk factor evaluation. A low risk factor indicates a high 249

correlation between the presented document and known good documents. A high risk factor could indicate a false or altered document or possibly even a damaged or very dirty document. In any case, the document would be examined in more detail or perhaps passed on for a secondary inspection. There are typically alarm thresholds that can be set for risk factors. Likewise there can be other informational alerts where an ID might be flagged because it is expired (or in the case of age restricted sales applications that the presenters date of birth indicates they are too young). 4. APPLICATION AREAS Reader-Authenticators find broad application in government, travel, financial, and commercial areas but are especially attractive in credentialing enrollment and in secure access control whether at a national border, secure installation, lobby of a building, or airport screening area. Here are a few real world scenarios where Reader- Authenticator technology systems could be applied today to enhance both efficiency and security: Travel Document Checking at Airports Airport travel document checkers currently use manual techniques for document inspection. Given the volume of inspections a document officer handles daily, even a small percentage of errors could result in a big compromise of security; all it takes is for one terrorist to escape detection. Human factors such as inadequate training, staff turnover, boredom, fatigue, rush-hour backlogs, and distraction threaten their effectiveness and thus overall security. A solution might involve providing officers with an automated document checking solution: a portable, cost-effective, wireless mini-workstation that would comfortably fit in one corner of the document checker s pedestal (or could be waist mounted), with the capability to authenticate almost all government-issued ID cards from around the world. An integrated bar code scanner could be used to scan the passenger s boarding pass simultaneously. In less time than an officer can manually vet a travel document, it could be authenticated, cross-checked with the boarding pass, and the information could be wirelessly integrated with auxiliary systems for further checks. Visitor ID Verification for Government and Sensitive Facilities Visitors to Government buildings and sensitive facilities such as ports and nuclear power plants must be properly screened. Today, security desks typically use a visual scan or a bar code scanner, sometimes in combination with database lookups, to vet IDs, a solution that is totally inadequate due to the ease with which the system can be scammed to the detriment of security. Systems for Travel Document Checking at Land Borders It is likely that several years will pass before enhanced Driver s License and e-passport issuances reach a point where the requirement for these at our land borders will no longer hurt tourism and trade. How do we secure our land borders without turning away millions of legitimate tourists and business people who have legitimate IDs that would pass the REAL ID test? While transitioning to more secure ID documents, provide border inspectors with an efficient, fast, automated document checking solution capable of authenticating most Government-issued IDs. Cross-check the captured information against watch lists of known terrorists and criminals. A bonus feature is the availability of a fall-back mechanism for authenticating electronic IDs that have chip failures. 5. SUMMARY We have seen examined some of the technology behind the operation of today s Reader-Authenticator devices for IDs. They can automatically classify, read, and extract image and data from a wide variety of existing IDs. The use of such devices is especially attractive in credentialing enrollment and in secure access control. They can be a cost effective, accurate, and time saving means of improving security by better ID validation. REFERENCES [1] Senate Committee on Finance, Border Insecurity, Take Two: Fake IDs Foil the First Line of Defense", August 2, 2006. [2] American Association of Motor Vehicle Administrators (AAMVA), Personal Identification AAMVA International Specification DL/ID Card Design, September 25, 2003. [3] International Civil Aviation Organization (ICAO), Document 9303, Machine Readable Travel Documents, Part 1 Machine Readable Passports (2002), Part 2 Machine Readable Visas (1994), Part 3 Size 1 and Size 2 Machine Readable Official Travel Documents (2002), ICAO, Montreal, Quebec, Canada. [4] Drivers License Guide Company, ID Checking Guide, 2004 Edition, Redwood City, CA, 2004. [5] Kuklinski, Theodore, Automated Identification of Current Identity Documents, 2004 IEEE Conference on Technologies for Homeland Security, Cambridge, MA, April 21-22, 2004. 250

[6] Monk, Bruce, Designing Identity Documents for Automated Screening, 2004 IEEE Conference on Technologies for Homeland Security, Cambridge, MA, April 21-22, 2004. [7] Monk, Bruce., Whitepaper: Improving Security - Protecting Privacy, A Practical Path to Greater National Security, AssureTec Systems, Inc., May 3, 2002. 251