For years the authorities have been concerned about this scam: Attackers merge two biometric passport photos into a "morph" using image editing software. If done well, the morph resembles the two people whose images were combined. In the next step, the fraudsters officially insert the morph into an identity document, for example by submitting the image when renewing a passport. The result is a document that, except for the image, has complete integrity and has actually been issued by the authorities. This is then taken to the border crossing. The matches between the morphed passport photo and the faces of both fraudsters are often close enough to fool both biometric software and border control officials. This means that the passport can be used not only by the person to whom it officially belongs, but also by someone else. And that person can now cross a national border under a false identity. Incidentally, the procedure sometimes even works with the pictures of more than two people.

The criminal trend has not gone unanswered. Organisational security measures such as "live enrollment", where passport photos for new identity documents must be taken on site and under the supervision of authority employees, or the training of border officials counter the fraudulent methods. Authorities are also increasingly relying on intelligent software such as Morphing Attack Detection. These are algorithms that can recognise facial morphs during automated border control. The way they work varies depending on the type of algorithm. secunet offers an algorithm that works according to the principle of differential MAD. This involves comparing a potentially morphed facial image with a second image, which is usually taken live in the presence of officers and is therefore trustworthy.

Outstanding test results

The differential MAD from secunet performed very well in the independent and internationally recognised "Face Analysis Technology Evaluation (FATE) MORPH" test conducted by the US National Institute of Standards and Technology (NIST). The secunet algorithm performed particularly well in the category of high-quality morphs. Although high-quality morphs are not difficult for experienced attackers to create, they are particularly difficult to recognise. A subcategory of the test consisted of morphs that were printed out and scanned in again, as is usual for passport photos, leaving virtually no traces of manipulation in the image. For this type of morph, the secunet algorithm outperformed all other of the more than 30 methods that took part in the test - and by a wide margin.
How many morphs a particular MAD algorithm recognises also depends on how it is tuned. One of the parameters is the bona fide classification error rate (BPCER), also known as the false alarm rate. It indicates how often the algorithm has falsely recognised true IDs as morphs. A low value is therefore desirable.

However, it is not enough to simply set the BPCER to the lowest possible value, as this has a negative effect on the rate of successfully detected morphs: Although there are fewer false alarms with a low BPCER, fewer morphs are also detected than with a higher BPCER value. Good fine-tuning is therefore essential. In the NIST test, the secunet algorithm recognised 84% of the printed and rescanned morphs at a moderate BPCER of 1% and even 93% at a slightly higher BPCER of 2%. In comparison, human test subjects only recognised 60% of the morphs.

MAD from the cloud

This shows that morphing attack detection can make a significant contribution to combating identity fraud at border crossings. However, mobile deployment scenarios, where officers use mobile devices such as smartphones to verify their identity, have been challenging to date: The algorithms with their extensive AI models are difficult to implement on mobile devices. The solution in these cases can be a cloud-based setup.

With the secunet bioserver, secunet has been offering a solution for the provision of server-based biometric applications for some time now. Its purpose is to integrate various biometric technologies and make them available as centralised services. For example, facial images or fingerprints can be synchronised. The secunet bioserver is based on a modern microservices architecture. This means that sub-steps of an application are encapsulated as individual micro-applications and packaged in so-called containers so that they can communicate and collaborate with the other microservices in a standardised way. The orchestration of the individual microservices is handled by the free software Kubernetes. The modern architecture of the secunet bioserver makes it easy to connect it to existing infrastructures and to manage the applications.

The high-performance MAD algorithm from secunet can now also be provided in such an environment. This is how it works in practice: During a mobile identity check, the officers use their specially secured smartphones to capture the personal data and the image in the ID document. A live image is also captured for comparison. The data is encrypted and sent to the solution in the cloud. There, the MAD algorithm checks it and reports back to the officers on the probability that it is a morph.

High security even in the cloud

Personal data is particularly vulnerable. Therefore, only a cloud infrastructure that is digitally sovereign and meets high security requirements can be considered for such a setup. secunet has realised the cloud-based MAD application in the infrastructure of its wholly-owned subsidiary SysEleven. It is completely "made in Germany" and fulfills the sovereignty criteria of the Open Source Business Alliance. It has already proven its high level of security in numerous customer projects in critical environments, for example in the first cloud solution for air traffic control at a German airport. SysEleven also has extensive expertise in operating microservice architectures using Kubernetes.

In the cloud, Morphing Attack Detection ensures that the prospects for morphing fraudsters remain cloudy at best - just as the locally deployed solution has been doing for some time.