Skip to main content

Architecture

ABIS for Criminal Investigations is built on the Innovatrics ABIS platform — a two-tier system consisting of a platform layer for identity and case management and an ABIS biometric backend for matching and template management. Criminal-specific services extend the platform with forensic workflows, latent print processing, video investigation, and case record management, while the shared biometric backend provides the multimodal matching engine used across all ABIS deployments.

Platform layer​

Integration service​

The integration-service is the primary API entry point. It exposes a REST API following OpenAPI Specification 3.0 with OAuth authentication, and a GraphQL interface for internal communication. Enrollment stations, external forensic systems, regional offices, and third-party case management tools all connect through this service.

Data service​

The data-service owns the authoritative identity and case record store. It provides a GraphQL interface to the integration layer and manages persistence of biometric records, applicant profiles, case metadata, and cross-case links to the underlying SQL database.

Deduplication service​

The deduplication-service runs 1:N biometric searches on enrollment to detect duplicate records before they enter the authoritative database. In multi-gallery deployments — where criminal, civil, and watchlist records coexist in separate galleries — the deduplication service can be configured to search across gallery boundaries.

Investigation service​

The investigation-service is specific to the criminal deployment. It manages criminal case records, tracks latent fingerprint job lifecycle (submission, candidate generation, examiner assignment, ACE-V workflow), detects cross-case connections between evidence items, and generates PDF reports for legal and court use.

Synchronization service​

The synchronization-service distributes identity subsets to regional stations, enabling field operations with local biometric search capability even under low-bandwidth or intermittent connectivity.

Authorization service​

The authorization-service handles OAuth-based access control, with policy evaluation delegated to Open Policy Agent (OPA). Keycloak provides OAuth/OIDC identity management for all operator and system accounts.

Operator interface​

ComponentRole
case-managementCase record browser with evidence linking, cross-case detection, and court exhibit creation. Central interface for criminal case investigators
editor-service (latent editor)Latent print markup tool: minutiae annotation, ridge highlighting, and side-by-side probe/candidate comparison for examiner verification under ACE-V methodology
video-managerVideo processing tool for pre-recorded surveillance footage: face detection, frame extraction, and 1:N identification against enrolled databases
instant-searchRapid subject lookup across criminal, civil, and watchlist galleries with configurable search parameters
comparison-toolSide-by-side examiner comparison interface for ACE-V analysis workflows
adjudicationSplit-screen biometric adjudication for deduplication exceptions and identity conflicts
administrationSystem administration, user management, audit logs, and monitoring dashboard
applicantsApplicant record browser for enrolled subjects across criminal and civil galleries

WebAFIS​

webafis provides browser-based access to the ABIS backend for operators without access to the specialist front-ends. It consists of a web server for interactive access and background workers for asynchronous jobs including batch processing, scheduled exports, and gallery maintenance tasks.

ABIS biometric backend​

Fast service​

The fast-service is the biometric API consumed by the platform layer. It exposes:

  • Read operations (Identify, Verify, Get) — biometric search and retrieval against the gallery
  • Write operations (Create, Update, Delete) — template ingestion, record updates, and deletion

Extractor​

The extractor performs biometric feature extraction from raw images, producing templates for all supported modalities. For criminal deployments this includes ten-print fingerprint extraction, latent print processing, palm print extraction, iris feature extraction, and face template generation. Quality assessment runs per modality, including NFIQ-based fingerprint quality scoring.

Matcher​

The matcher is the multimodal biometric matching engine for Faces, Fingerprints (ten-print and latent), Palmprints, and Irises. It is deployed as a horizontally scalable cluster, coordinated by ZooKeeper, and uses Apache Ignite distributed in-memory caches to serve sub-second search results across large criminal galleries.

Image service​

The image-service handles storage and retrieval of raw biometric images — crime scene photos, latent print scans, surveillance stills, and enrollment images — separate from the biometric template store.

A single ABIS deployment can host multiple logically independent galleries:

GalleryContents
CriminalEnrolled subjects with criminal records; primary gallery for ten-print and latent searches
CivilPopulation-scale civil identity records; used for cross-civil identification where licensed
WatchlistWatch-listed persons of interest; continuously searched on encounter or enrollment

The fast-service routes each biometric operation to the target gallery. Cross-gallery searches — for example, matching a latent print against both criminal and civil galleries simultaneously — are configurable per operation.

Deployment architecture​

All inbound traffic enters through Traefik, the ingress reverse proxy. Traefik handles TLS termination, load balancing, and routing.

The data-service persists structured records to a SQL database (Oracle, PostgreSQL, or MSSQL) and binary objects (images, video stills, latent scan files) to MinIO (S3-compatible object storage). Regional stations may run a local MinIO instance that replicates to the central store.

The matching pipeline uses Apache Ignite distributed in-memory caches — separate caches for fingerprint, iris, and face templates — to minimize search latency on large galleries. ZooKeeper coordinates the Ignite and Matcher cluster topology. Cache Persistence backs Ignite state to disk for fast cache warm-up after restart.

RabbitMQ provides asynchronous messaging between services for enrollment events, latent job queuing, and workflow notifications.

Kubernetes handles workload orchestration and service discovery.

Observability: Jaeger and OpenTelemetry for distributed tracing; Grafana for metrics dashboards. Vault manages all secrets, certificates, and encryption keys.

Disaster recovery​

The platform supports active-active and active-passive DR configurations.

ResourceReplication mechanism
SQL databaseOracle Data Guard or equivalent — synchronous or asynchronous replication to the DR instance
MinIO object storeSide-bucket replication — images and case files mirrored continuously to the DR MinIO cluster
Matcher clusterIndependent Matcher instances run in the DR site with Ignite caches populated from the replicated template store

In active-active mode the DR site can serve matching and case management requests independently, providing continuity in the event of a primary site failure.

See also​