Overview of the 

ISO/IEC 30107 Project 

Anti-Spoofing and 

Liveness Detection Techniques 

Elaine Newton, PhD 

NIST 

elaine.newton@nist.gov 

1-301-975-2532 
Remote Authentication in the 

Federal Government 

• OMB Memo 04-04 

– Describes 4 assurance levels, with qualitative 

of confidence in the asserted identity’s validit

Level 1: Little or no confidence Level 2: Some confiLevel 3: High confidence Level 4: Very high c

• NIST Special Publication 800-63-1 

– Technical requirements for remote authentica

an open network in response to OMB 04-04 

• Biometrics not included in authentication 

in this guidance 

• Adopted by other countries and standard
Biometric Security Issue

Figure by Nalini Ratha, IBM 
Authentication Use Cas

Comparison For law enforcement, 

immigration, etc. • Enrollment and 

subsequent recognition attempts 

– highly controlled – Supervised / Attended 

• Successful recognition 

– Answers the question, “Has 

this person been previously encountered?” 

– Is a unique pattern 

For online transace.g. banking, healt• Enrollment 

– Less controlled – Probably not in p

• Subsequent reco

attempts 

– Unattended 

• Successful recog

– Answers the que

“How confident athis is the actual 

– Is a tamper-proof 

of a distinctive pa
Threats/ 

Attacks 

H

Confi

fa

avai

consu

authe

(and 

ove

net

QPL, 

Validation, 

or 

Certification 

Program 

Data / Data 

Formats (for 

Metrics) 

Countermeasures 

Measurement/ 

Evaluation 

Anti-Spoofing/Liveness 

Detection Standards Proj
Types of Biometric “Spoofi

From the 3rd Working Draft of IS Project 30107 
Types of Detection 

Through a biometric system 

Artefact Detection Liveness Detection Challenge-Response Alteration Detection Non-conformance DetecCoercion Detection Obscuration Detection 

Through system security policies 

Failed attempt detection Geographic Temporal 

From the 3rd Working Draft of IS Project 30107 
Examples of Data Fields for Det

Suspicious Presentations* 

• Is there a local check for SPD (yes/no)? • The local SPD decision (pass/fail) • A score between 0 and 100 provided by the s

detection mechanism, with lower scores beinof spoofed samples 

• technique specific data and their units; • level of supervision / surveillance during capt

(qualitative categories) 

( In addition to: vendor ID, algorithm ID, and sen

*From the 3rd Working Draft of IS Project 30107 
How to Participate in the 

Development of 30107 

• In the US, interested parties particip

through INCITS M1 

– http://standards.incits.org/a/public/grou

• In other countries, interested parties 

participate in their country’s TechnicAdvisory Group (TAG) to ISO/IEC JTSC37 
If you liked this... 

Join us Friday for Satellite Works

Artefact, Liveness, & Suspicio

Presentation Detection 

Where we will discuss testing, 

rates, and terms and conce

• Location: Portrait Room, NIST • Time: 09:00 - 12:00, Friday March 9, 
If you hated this... 

Join us Friday for Satellite Works

Artefact, Liveness, & Suspicio

Presentation Detection 

Where we will discuss testing, 

rates, and terms and conce

• Location: Portrait Room, NIST • Time: 09:00 - 12:00, Friday March 9, 
Thank you 

Questions? 

Elaine Newton 

elaine.newton@nist.gov 

1-301-975-2532 
Examples of Artificial and Human Subve

Presentation Characteristic Types 

Artificial Complete gummy finger, latex finger, photo of face, photo of iris, recording of 

custom contact lens, artificial/patterned contact lens, facial mask (sktheatrical contact lenses 

Partial glue on finger, false facial hair, cosmetics, removable implants, sungl

Human Lifeless cadaver part, severed finger/hand 

Altered nose job, face lift, amputation, mutilation, surgical switching of fingerpNon-Conformant voice mimicry, hand shape control, forged signature, facial expres

falsetto voice 

Conformant zero effort imposter attempt Coerced unconscious, under duress, drugged