DOT Passive Liveness Service

v2.3.0

Overview

Passive Liveness Service is a service that enables performing passive liveness checks on uploaded selfie images, providing a robust method for verifying the authenticity of identities. With the rise of digital interactions and the increasing need for secure identity verification, Passive Liveness Service offers a reliable solution to distinguish live faces from static images or videos presented on screens or printed on paper, as well as masks and other fraudulent attempts.

By leveraging advanced facial recognition algorithms, Passive Liveness Service assesses the interaction with a live, physically present person, ensuring the integrity of identity verification processes across various applications. Whether used in authentication procedures, access control systems, or identity verification platforms, Passive Liveness Service plays a pivotal role in enhancing security and trust.

The service operates seamlessly, requiring minimal user input and no additional actions beyond uploading the image for evaluation. With its stateless architecture, Passive Liveness Service ensures efficient performance while prioritizing data privacy and security.

API Reference

The Passive Liveness Service API reference is available here

Hosting

The Passive Liveness Service is hosted by Innovatrics at address https://liveness.innovatrics.com.

Monitoring

The service version information can be accessed at /api/v1/info, providing insights into the current version deployed.

For real-time monitoring of the service’s operational status and health, use /api/v1/health. This endpoint provides information about the application’s health, including its availability and any potential issues or failures. Monitoring tools and systems can integrate with this endpoint to perform health checks and receive notifications of any anomalies or failures.

Authentication and authorization

Authentication for the Passive Liveness Service API is done via API Key authentication. Each request must include an HTTP Authorization header containing a valid base64 encoded JWT token in the Bearer format.

The service will return a HTTP 401 Unauthorized response for every request that either does not contain the Authorization header, or if the header contents are invalid (e.g.: malformed token).

Certain endpoints, such as /health and /info are not secured by design and do not require authentication.

Logging Transactions via the Innovatrics Tracking Service

For billing purposes, all transactions are tracked by Passive Liveness Service. No sensitive information is tracked and only the number and type of transactions are recorded. For more details on transaction tracking, refer to the [Transaction Tracking and Charging](https://developers.innovatrics.com/digital-onboarding/technical/transactions/) documentation.

Passive Liveness Check

The passive liveness check is a process of determining whether the presented face is a real person without requiring the user to perform any additional actions. It distinguishes live faces from presented photos or videos, masks and other attacks.

Passive Liveness Evaluation

To evaluate liveness, a POST /liveness/passive/evaluation request containing image encoded as base64 string must be made. Examples of these options are included in the Postman collection.

A successful response will contain the following fields:

score

The passive liveness score from the interval <0.0, 1.0>. Values towards 1.0 indicate higher confidence that the evaluated face belongs to a live person. The score should be compared to a threshold to determine the liveness. Higher thresholds will result in a higher false rejection rate, while lower thresholds will result in a higher false acceptance rate. Please, read more in Passive Liveness Scores for more information on setting the threshold.

evaluatedFaceId

The identifier of the detected face on which the liveness score was computed. This value corresponds to the faceId of one of the items in the faces list.

faces

A list of all faces detected in the submitted image. Each entry contains:

faceId — unique identifier of the detected face within the image.
detection.confidence — the face detection confidence score from the interval <0.0, 1.0>, where values closer to 1.0 indicate higher confidence that a human face was detected.
detection.corners — the normalized bounding box of the detected face region, expressed as four corner points (topLeft, topRight, bottomRight, bottomLeft). Coordinates are relative to the image dimensions and range from 0.0 to 1.0.

If the image contains multiple faces, all detected faces are returned in the faces list. The liveness evaluation is performed on the most suitable face, identified by evaluatedFaceId. A MULTIPLE_FACES_DETECTED warning is included in the response when more than one face is found in the image.

If the quality of the selfie does not fully match the requirements for evaluation, the response will contain a warning. If this happens, the selfie can still be used to assess liveness, albeit with reduced reliability. If you prefer not to proceed with such selfie, it is advisable to ask the user to retake the selfie and provide the new one.

Image requirements

Ideally, the photo of selfie should be created with Innovatrics’ auto-capture components, whether in mobile libraries or browser-based. These components ensure the quality requirements mentioned below:

The supported image formats are JPEG and PNG
The face should be well-lit and not obscured by any objects
The image must be sharp enough to detect the face and its features
The image should contain single face with clearly visible eyes, nose, and mouth
The face should be in the center of the image and in a frontal position
The image should get as close as possible to compliance with ICAO standard for portrait quality

Figure 1. Examples of valid image

Passive Liveness Evaluation with Video Injection Detection

A video injection attack replaces the camera stream with a pre-recorded or synthetic video, for example by using a virtual camera. To detect such attacks, the service can evaluate a binary file captured by Innovatrics’ face auto-capture component (Android, iOS or Web) instead of a plain image.

To evaluate the binary, a POST /liveness/passive/evaluation/binary request must be made with multipart/form-data content type. The binary file must be sent in the part named binary.

The service processes the binary in two steps:

First the binary is evaluated. This step checks whether the capture is genuine and extracts the captured face image.
If a face image was extracted, the passive liveness evaluation is performed on it, the same way as described in Passive Liveness Evaluation.

The binary must contain face content. If the binary was captured by a different component (for example a document or palm capture), the service returns HTTP 400 Bad Request with the INVALID_FILE error code.

A successful response will contain the following fields:

videoInjectionEvaluation

The result of the video injection evaluation:

isGenuine — true if the binary was captured genuinely, false if a video injection attack was detected.
warnings — an optional list of warnings. The UNSUPPORTED_BINARY_VERSION warning indicates that the binary was created by a version of the capture component that is not supported for the evaluation.

captureInfo

Information about the capture component that created the binary:

library — the platform of the capture component: ANDROID, IOS or WEB.
libraryVersion — the version of the capture component.

extractedImage

The face image extracted from the binary:

bytes — the image data encoded as base64 string.
imageRecordType — the type of the extracted image, for example FACE.

passiveLivenessEvaluation

The result of the passive liveness evaluation of the extracted image. It has the same structure as the response of the POST /liveness/passive/evaluation endpoint. This field is not present when no image was extracted from the binary.

The isGenuine value and the passive liveness score are independent results. To accept the selfie, the integrated system should require both a genuine capture and a passive liveness score above the threshold.

New endpoint POST /liveness/passive/evaluation/binary evaluates video injection and passive liveness on an uploaded binary file
New error code INVALID_FILE
Security patches
Upgraded base Docker image to Rocky Linux 9.8

2.2.0

POST /liveness/passive/evaluation response extended:
- All detected faces are now returned, each with relative bounding box corners and detection confidence
- Response now indicates which detected face was used for liveness evaluation
Security patches
Upgraded base Docker image to Rocky Linux 9.7