Architecture

The Biometric Platform for ID Issuance is built on the Innovatrics ABIS platform — a two-tier system consisting of a platform layer for identity lifecycle management and an ABIS biometric backend for matching, deduplication, and template management. The platform layer orchestrates the complete applicant journey from multi-channel enrollment through population-scale deduplication to ID credential issuance, while the biometric backend provides the matching engine that underpins every identity assertion.

Platform layer

Integration service

The integration-service is the primary API entry point for all external systems. It exposes a REST API following OpenAPI Specification 3.0 with OAuth authentication, and a GraphQL interface for internal service communication. Enrollment stations, portable enrollment kits, Android handheld devices, civil registry systems, and document issuance authorities all connect through this service.

Data service

The data-service owns the authoritative identity store. It provides a GraphQL interface to the integration layer and manages persistence of applicant records, biometric templates, linked travel documents, workflow state, and issuance history to the underlying SQL database.

Deduplication service

The deduplication-service is the central integrity gate of every ID issuance programme. Before any credential is issued, every enrolled applicant's biometric templates are searched 1:N against the full population database to detect duplicate registrations. This prevents multiple IDs being issued to the same person and cleans incoming data from legacy systems before expanding enrollment.

Outcome	Meaning	Next step
New identity	No existing match found	Applicant record created; issuance proceeds
Verified identity	Match found; data consistent	Existing record confirmed; credential issued
Duplicate requiring adjudication	Match found; data inconsistent	Record flagged; routed to supervisor for manual review

Synchronization service

The synchronization-service distributes identity subsets from the central database to regional enrollment stations and service points. This enables local 1:1 verification and enrollment at distributed sites while keeping the central database as the authoritative source of record.

Authorization service

The authorization-service handles OAuth-based access control across all API endpoints. Policy evaluation is delegated to Open Policy Agent (OPA), enforcing fine-grained permission rules across enrollment channels, adjudication queues, and administrative functions. Keycloak provides OAuth/OIDC identity management for all operator and system accounts.

Enrollment and operator interface

Component	Role
enrollment	Multi-channel capture orchestration: stationary kiosk (counter-based), portable enrollment kit, and Android handheld device. Captures face (with liveness detection), fingerprints, iris, and contactless palm
adjudication	Split-screen face and fingerprint comparison interface for supervisor review of deduplication exceptions and conflict resolution
administration	Workflow management, priority processing queues (including VIP issuance), system configuration, and operational reporting
applicants	Applicant record browser covering the full lifecycle: registration status, linked documents, biometric template references, and issuance history
queues	Workflows browser, overview of resolve queues, hits and performed actions

WebAFIS

webafis provides browser-based access to the ABIS backend for supervisors and administrators. It consists of a web server for interactive operator access and background workers for asynchronous processing — including batch deduplication jobs, scheduled gallery maintenance, legacy data import runs, and reporting pipelines.

ABIS biometric backend

Fast service

The fast-service is the biometric API consumed by the platform layer. It exposes:

• Read operations (Identify, Verify, Get) — biometric search and retrieval against the population gallery
• Write operations (Create, Update, Delete) — template ingestion on enrollment, record updates, and deletion

Extractor

The extractor performs biometric feature extraction from raw images, producing templates for all enrolled modalities: face, fingerprint (rolled and plain), iris, and palm. Extraction includes ICAO facial image compliance checks, NFIQ-based fingerprint quality scoring, and ISO/ICAO compliance validation for biometric passport and travel document issuance.

Matcher

The matcher is the multimodal biometric matching engine for Faces, Fingerprints, Palmprints, and Irises. It is deployed as a horizontally scalable cluster, coordinated by ZooKeeper, and backed by Apache Ignite distributed in-memory caches. The active cache architecture allows the full population gallery — spanning tens of millions of records — to be searched at high throughput, achieving thousands of full searches per minute.

Image service

The image-service handles storage and retrieval of raw biometric images: enrollment photos, fingerprint scans, iris captures, and palm images. Image storage is independent of the biometric template store and can be backed by the MinIO object store or direct database storage depending on deployment configuration.

Deployment architecture

All inbound traffic enters through Traefik, the ingress reverse proxy. Traefik handles TLS termination, load balancing across service instances, and routing to the appropriate backend.

The data-service persists structured applicant records to a SQL database (Oracle, PostgreSQL, or MSSQL). Biometric images and binary artifacts are stored in MinIO (S3-compatible object storage). Regional enrollment stations may run a local MinIO instance that replicates to the central store.

The biometric matching pipeline uses Apache Ignite distributed in-memory caches to keep hot biometric templates immediately available — separate caches for fingerprint, iris, and face templates. ZooKeeper coordinates Ignite cluster membership and Matcher node topology. Cache Persistence writes Ignite state to durable storage so caches can be warmed from disk on service restart without a full gallery reload from the database.

RabbitMQ provides an asynchronous message bus for enrollment events, deduplication job submissions, and workflow state transitions.

Kubernetes handles workload orchestration and service discovery.

Observability is provided by Jaeger and OpenTelemetry for distributed tracing and Grafana for metrics dashboards. Vault manages secrets, certificates, and encryption keys across the deployment.

Disaster recovery

The platform supports an active-active configuration with a primary data center (DC) and a disaster recovery site (DR), each running a complete stack.

Resource	Replication mechanism
SQL database	Oracle Data Guard or equivalent — synchronous or asynchronous replication to the DR SQL instance
MinIO object store	Side-bucket replication — enrollment images and binary artifacts mirrored continuously to the DR cluster
Matcher cluster	Independent Matcher instances run in the DR site; Ignite caches are populated from the replicated template store

In active-active mode the DR site can independently serve enrollment, deduplication, and verification requests, providing zero-downtime availability across large national programmes where continuous operation is a regulatory requirement.

See also

• High Level Overview — licensed module breakdown for interface, biometric processing, enrollment, and infrastructure
• Enrollment Channels — stationary stations, portable kits, and remote digital onboarding channel details