Incode Omni Technology
Incode Omni Technology
Table of Contents
Executive Summary 3
Certified and robust technology components 4
Secure Passive Liveness Detection 4
First certified Passive Liveness 5
Liveness technology to minimize fraud 5
ROC Curves 6
Certified Liveness based on ISO/IEC Standard 7
World-class, proprietary Face Recognition 8
User feedback and automated photo capturing 10
General facial recognition model features 12
General performance features 14
ROC Curves 16
Robust ID Document Validation 16
Image & Data Capture 17
Face recognition 17
Document verification 17
ROC Curves 18
Flexible integration 20
Engines 20
Identity Servers 20
SDKs and APIs 20
Implementation and solution architecture 22
Security Framework 24
Application security and Web message transmission 24
Incode’s technology is recognized as one of the most secure Identity solutions that exist:
• Our facial recognition technology is one of the best in the world, as evaluated by the
National Institute of Standards and Technology (NIST) in its July 2019, 1:1 FRVT report,with
the best combination of facial recognition speed and accuracy.
• Incode is the first company to have received a certification for our passive liveness
technology following the ISO/IEC 30107-3 Presentation Attack Detection standard, as
certified by iBeta following the NIST guidance.
• Incode has also developed proprietary technology to perform tests on the ID
documents presented and detect potential fakes, tampered, or photoshopped
documents.
Incode’s Omnichannel Identity Solution gives Audi a full world-class solution; fulfilling high standards
and expectations. The following is a summarized diagram to overview the fullcomponents to be able
to achieve great experiences.
All the three models are based on Deep Learning. Deep learning (also known as deep
structured learning or hierarchical learning) is part of a broader family of machine learningmethods
based on artificial neural networks. Learning of these models varies can besupervised, semi-
supervised or unsupervised, depending on the model.
Incode is the first company in the world to have been certified following NIST and ISO/IEC-3017
standards for passive liveness detection, meaning no action is required from the user.
Incode delivers world-class proprietary technology. Incode’s technology is recognized as one of the
most secure Identity solutions on the market today.
● Our facial recognition technology is certified in passive liveness - endorsed by iBeta
ISO/IEC-30107-3 [certified L-1]
● Incode technology is the first certified technology in the world under the U.S.
Department of Commerce's NIST standards (2019, 1:1 FRVT report); with the best
combination of facial recognition speed and accuracy (faster than the competition)
● The Guidance in Digital ID issued by the Financial Action Task Force primarily refers to
NIST digital ID guidelines to present strategies for mitigating threats to identity proofing
and enrolment processes
Additionally, provide a secure Identity landscape. Incode is the only technology in the world to
meet US Government standards. Incode’s liveness technology passes NIST certification
requirements for liveness detection using a passive algorithm that requires no action from the user
(Level one certification from iBeta Quality Assurance accredited by NIST/NVLAP [NVLAP Lab Code:
200962] to test and provide results to this Presentation Attack Detection - PAD testing standard).
Incode’s liveness detection is what many providers in the industry refer to as “Level 5”, which is the
most sophisticated one. In essence, it models the light on the face, estimates depth and generates
a 3D model of the face. This way it’s very difficult to spoof it with photos, videos and other
elements, as it has a very high true positive vs false positive rate.
To make a system more secure (like in case of liveness) the threshold can be shifted even higher if
the higher false negative rate is not an issue. We highly don’t recommend moving thresholds
without approval from Incode’s side because TPR/FPR dependency isn’t linear (ROC curves show
that) and their values highly depend on the input data. Also, financial entities shouldn’t consider
the threshold as a probability so for example the threshold 0.3 for recognition model doesn’t mean
the probability of successful recognition equals 0.3. The threshold is just some number that helps
to classify input data.
This is the ROC curve graph that shows the TPR (accuracy) vs the FPR (mistakes):
Note: The most recent version of ROC will depend on the R&D of the technology
Threshold
Low severity level: TPR = 0.984234 : FPR = 0
Medium severity level: TPR = 0.966216 : FPR = 0
High severity level: TPR = 0.954955 : FPR = 0
For liveness, we collected our own dataset because none of the public datasets are representative
enough for real-life applications.
The following image shows how our liveness works at a high level
The test method was to apply one bona fide subject presentation that alternated with 3
presentations of each species resulting in 300 Presentation Attacks (PAs) and 100 bona fide
presentations per artefact. The application displayed messages with a green lock for successful
liveness confirmation oar red lock for an unsuccessful liveness conformation.
On the smartphones used in the test, iBeta was not able to gain unauthorized access (simulated
enrollment) with a presentation attack 300 times with each of 5 species of attacks. With
300attempts for each species, the total number of attacks were 1,500 and the Presentation
Attack (PA) success rate was 0%.
Other features
• Depth-based liveness detection modeling
o Utilizes presentation attack detection based on depth map classification using
trained neural network
o Does not need any type of feedback from user
• Liveness check performed in 200ms on server
• 256 x 256 minimum face size
• Outputs confidence level so that the Client can incorporate it to its risk algorithms
NIST’s results have positioned Incode at the top of the list among enterprise-grade facial
recognition providers in terms of accuracy as well as template creation speed as seen in the chart
below as of July 31st, 2019 evaluation:
Click here to review NIST’s face recognition rank report >> using our production-based model
Incode’s system gives the user feedback to ensure the optimal photo is taken.
Incode’s system compares the selfie with the photo from the accepted ID to verify the person’s
identity. The Client can modify these thresholds and set logic to pass, fail or require applying
individuals to visit a branch office for additional verification.
Capture features
• Photos are taken exclusively in real-time through digital platform (mobile web, desktop
web, native iOS and native Android)
• Faces in photos are framed to indicate adequate zoom and resolution
• Feedback given to user with needed feedback (e.g., “move closer”)
• Photos automatically captured when face is correctly in frame
• Photos can also be captured with manual press to capture button
• Creation and management of templates (mathematic representation)
Log-back-in features
• Users are automatically enrolled in a face recognition system
• Because Incode performs “true face recognition” (not just selfie comparison), enrolled users
can log back into their application at any time to resume an application process or check on
the status of an application
True Positive – matched faces for one person, False Positive – matched faces for different
person
True Positive – matched faces for one person, False Positive – matched faces for different
person Threshold = 0.6: TPR = 0.942718: FPR = 0
Face recognition
To verify that the holder of the ID Document is the legitimate user.
• Face matching. ID verification performs a face matching between document portrait
and selfie photo.
Document verification
• Document classification. Based on the document composition and patterns, it
recognizes the type of the document and the sections of data available.
• Document verification. Performs an extensive series of security checks, to assess
its authenticity.
• Data scanning. Once ID is verified extracts the personal and biometric information
to perform more tests.
• Data validation. More tests are executed to check data tampering and document
• validity like expiration date and crosschecks.
• Incode also offers the option of verifying the driver’s license information against the
official databases of 37 State DMVs.
During our tests, Incode’s Machine Learning team sampled the scale of scores (0-100) and
calculated the accuracy for each possible threshold to come up with the one (65) that gives
the best result.
ROC Curves
ID liveness detection for Screen detection
Engines
Incode’s “identity engines” are Incode’s core AI models. Most of Incode’s models are based on
machine-learning techniques. Incode’s “ID verification” model, for example, considers many
features of an ID and then uses computer vision and learning to determine if the ID is real or
not. These powerful models allow Incode to perform fingerprint recognition, face recognition,
ID verification, and other identity-based use cases.
Identity Servers
Incode also maintains several identity servers which help us develop a customer’s full digital
identity. These services, for example, scrape data from online accounts from utilities, other
banks or social media sites, run queue management software for Clients, and help send
money amongst customers around the world.
Incode Omni’s engines and identity servers are not, however, enough to build great customer
experiences.
Let’s assume, for example, that Company wants to check if a user’s face is already registered
in the database. Incode does use the underlying “1-to-N face recognition engine” model to
search for the user, but this is not sufficient. Incode’s supporting SDKs are needed to help the
user capture their picture on the phone, apply brightness and glare modeling to the photo,
and give the user necessary feedback as they are capturing the selfie.
If Company is building this experience within an Android app, the Client would integrate with
Incode’s “Face Login Native SDK” for Android (native) for this use case. The Client can directly
integrate with this SDK. The Client does not need to integrate with both the relevant
CONFIDENTIAL INFORMATION PROPERTY OF INCODE TECHNOLOGIES INC. 20
AUGUST 2022
supporting SDK and the relevant engines. Incode ensures that all supporting SDKs come
pre-integrated with our engines. This reduces the integration complexity and increases
the time to market for the application.
Develop products and use cases using our low-level engine APIs, or develop products using
our experience-ready plug and play SDKs or via Incode’s Admin portal self-service flows.
The following diagram shows the architecture scheme with Incode’s main micro-services,
main instance database and additional modules.
• Isolation. Each application can only access its own container space. If an application
gets compromised, it won’t be able to access other applications.
• Security by default. Swarm provides features that are enabled by default that
improve application security such as read only containers.
• Portability. A container could be run anywhere since the whole definition stays
within.
• Scalability. Applications can be easily scaled by launching more containers (with
orchestration).
• Easier elasticity. Dynamic provisioning becomes straightforward.
• Images of all microservices are provided through docker hub
• Documentation for deployment and management of services
• Regular updates of images with new features
• Regular security updates
• All releases ensure backward compatibility
4. On-premises
Using a Container Platform (Docker or similar), components and services are
deployedon container images
The microservices are connected to one instance database; we follow a replication scheme
following active/active scenarios to provide redundancy and high-availability. And the global
application can be connected to other services such as queue management, video-conference
communication service, other services connected via an API, etc.
ABOUT INCODE
Incode is a provider of secure biometric products for banking, payment and retail industries. The
company’s flagship suite, Incode Omni, is an end-to-end omnichannel identity platform that
enables seamless access across multiple channels to reach and engage the next-generation
consumer.