Written by Text: Florian Rienhardt, German Federal Office for Information Security / BSI
Modern electronic identity documents do not just feature optical-physical content and corresponding physical security properties. Since the introduction of electronic passports and electronic identity cards, the built in RF-chip is a modern identity document’s additional and essential protection feature that increases the overall security and confidence into such documents.
Although it is – in theory – possible to perform checks on the electronic part of modern identity documents only, a typical document inspection also relies on the optical-physical features of identity documents to read and process the visual inspection zone, MRZ or CAN in further steps interconnecting with the RF-Chip. Machine assisted inspection systems also perform cross-checks between the electronic part of a given document and the optical-physical part. For example, doing a cross-check of the printed MRZ against the MRZ in data group 1 of the chip or a basic “comparison by view”-check between the facial image printed on the identity document against the biometric photo stored in data group 2 etc.
Through the use of advanced document scanner technology paired with custom-tailored document inspection software, it is possible to verify and to compare all the data printed on the document or stored on a chip within seconds and to check if the identity document is original, valid and not manipulated. By using biometric matching algorithms, agencies are also able to verify a person in real-time against the genuine biometric data stored on the RF-chip of an identity document.
Challenges
The number of electronic identity documents issued is still rising. For example, in Germany about 90% of the issued passports are ePassports and the last “classic” German non-chip passport becomes invalid in 2015. With a volume of about 30 million border crossings at the Frankfurt Airport Schengen Border for example, checking identity documents by hand is neither reason- able nor practical. Automated and machine assisted document inspection systems must be installed to guarantee fast entry-exit and an overall short exposure time at a checkpoint without any security impacts.
Coexisting with the classic, stationary booth control scenarios, more and more flexible, mobile and volatile control scenarios, and fully mobile document checking booths, ABC-gates, in-car checkpoints etc are coming up. Worldwide developments and the installation of automated border control gates (ABC-gates), like EasyPASS in Germany will result in self-service systems being increasingly used by passengers in the near future. To be future-proof, reliable document inspection systems should also take different document scenarios, environments and inspection systems into account.
Despite the organizational and technical circumstances with respect to the environment of a document checking process, modern inspection systems should also support all the various features and different protocols modern electronic identity documents come along with.
over the years, a rising ecosystem has grown, with manufactures of security paper and RF-based security chips, optical and electronic readers and document inspection software systems inventing and marketing their products all over the world. As noted above, beside these technical requirements, such systems are installed within different environments and with different needs.
With respect to these volatile settings a consistent document inspection system should at least handle the following principal points:
- How to define a whole and general document checking process in the context of official document checks.
- How to perform consistent checks on different identity documents at border control /entry-exit booths, ABC-gates, stop-and-search operations etc.
- How to consistently check documents on changing systems.
- How to audit, review, evaluate and rate different document inspection systems and their inspection performance from a global and centered point of view.
Formalizing the border control process in a Technical Guideline
There are already existing standards, specifications and guide- lines, such as the ICAo DoC 9303 or the FRoNTEX best practice guidelines regarding document inspection, but they do not specify a whole machine assisted document inspection process nor how to do process identity documents in border control scenarios in general. Having generalized specification and definitions of such a process is very important for national and international tenders and also to successfully operate such systems with constant quality of service over a specific period of time.
The German Federal office for Information Security (BSI) in collaboration with the Federal Criminal Police (BKA) and the Federal Police (Bundespolizei) composed the Technical Guide- line TR-03135 that contributes to the new conditions regarding modern, machine assisted document inspection processes and systems. The guideline builds on and extends the requirements for document inspection as defined in the FRoNTEX best practice guidelines. The content of the Technical Guideline is a normative description of the necessary requirements and procedures that are required for a fully featured check on modern electronic identity documents.
The Technical Guideline is multi vendor capable with respects to current state of the art document inspection systems right on the market. It formulates, specifies and defines
• good practice document inspection environments, featuring different scenarios like classical control booths, furthermore new developments like ABC-gates, ultra mobile document inspection systems etc.
• optical-physical document checks regarding most of the currently used optical-physical features on printed identity documents like classical oCR-reading, Visual-Inspection- Zone parsing, visual-, UV- and IR-light absorption, including pattern checks on such illuminated regions etc.
• electronic checks with respect to all well known ePassport and eID protocols such as BAC, PACE, Passive Authentication Active Authentication, Chip Authentication and Terminal Authentication.
Logging and auditing the technical steps of document checks
Besides the document inspection process, the Technical Guideline also describes a logging format given in XML, which allows to monitor and to rate all technical activities carried out during a document inspection process. The logging and auditing scheme generally measures the quality of the document inspection processes across different environments, regardless of the finally used hard- and software systems.
This is used, in particular, to optimize the process of machine assisted document inspection, to adapt to new situations and to ensure that reliability, quality, transparency and traceability is in place. In this way, for example, characteristics of certain chips can be identified in order to customize the software in a timely manner should there be problems e. g. in checking a specific identity document.
The Technical Guideline proposes a central logging server that collects all technical information from all connected inspection systems attached to the overall document inspection environment, regardless of a single implementation. Again, the Technical Guide- line is completely vendor independent, making the document inspec-tion systems multi vendor capable and thus the logging completely independent from a specific implementation or environment.
Conclusion
The Technical Guideline TR-03135 normatively describes requirements and procedures that are e. g. required for a whole document check process in border control scenarios. The Technical Guideline builds on and extends the requirements for document inspection as defined in the FRoNTEX best practice guidelines. The guide- line is multi-vendor capable with respect to the current state of the art document checking systems right on the market. It is actively edited and maintained by BSI, BKA and Bundespolizei and feedback by the industry is highly appreciated at any time.
Right now, the guideline is available only in German, but it is planned to be translated into English language in 2014. The guideline and the XML logging scheme is available for download at: http://goo.gl/C52YD5.
This article was first published in the VAULT, #13, November 2013