Apple wins a Patent for Face ID and more specifically for techniques that Prevent Spoofing of Biometric Data
Today the U.S. Patent and Trademark Office officially granted Apple a patent that relates to Face ID user authentication, and, more specifically, to computing devices that collect biometric data for user authentication. In addition, the patent covers techniques for preventing spoofing or replays of biometric data, e.g., images used for facial recognition.
The technology behind Face ID is one of the most advanced types of hardware and software ever built into a device. The TrueDepth camera captures accurate facial data by projecting and analyzing hundreds of invisible points to create a depth map of the user’s face while capturing an infrared image of the face. With the release of iOS 15, Apple brought even more security, including improvements to anti-spoofing technology.
Apple's granted patent covers techniques for preventing spoofing or replays of biometric data, e.g., images used for facial recognition. "Replay" attacks involve using previously-captured biometric information that is typically valid (e.g., image data of an authorized person's face that previously passed biometric authentication) in an attempt to authenticate an individual.
Malicious entities may attempt to present previously-captured images of a user to a camera of a device, for example, to pass an authentication process as an enrolled user of the device. "Spoofing" attacks typically utilize invalid data, e.g., data from another device or module purporting to be from a device's camera or images of masks, busts, 3D projections, etc. that are not actually current images of a known user.
For example, malicious entities may send signals pretending to be from a device's camera unit, to trick the device into thinking that its camera captured an image of the user, when the image was actually previously-captured by another camera. This is one example of an attack that involves spoofing a camera.
As another spoofing example, a malicious entity may present a mask or bust of an enrolled user to a camera of the device in an attempt to pass an authentication process as the enrolled user.
In various embodiments, the disclosed techniques may reduce or eliminate the effectiveness of such schemes, such that authorized users who intend to authenticate biometrically are successfully authenticated while others are denied.
Apple's patent FIG. 5 below is a block diagram illustrating multiple point illuminator arrays. In the illustrated embodiment, a device includes multiple point illuminator arrays 510A-510N and one or more diffractive optics 520. These arrays may be used for depth capture modes and/or generating a probing pattern.
(Click on image to Enlarge)
In some embodiments, the device is configured to use different special illuminator arrays or patterns for different facial recognition sessions, e.g., in a sequential or pseudo-random fashion. This may prevent malicious entities from capturing an illumination pattern and re-using the illumination pattern and/or may allow multiple probing pattern-attempts before locking a user out of the device.
Apple's patent FIG. 8 below is a flow diagram illustrating an exemplary method for using multiple types of validation in a secure facial recognition session.
(Click on image to Enlarge)
If this subject matter interests you, then there's a lot of detail that you could review in Apple's granted patent 11,151,235.