Defeat Deep Fakes and Imposters with Verified ID and Face Check

Entra Verified ID and Face Check: A Detailed Summary

Key Concepts:

• Decentralized Identity (DID): A self-owned, independent identity that doesn't rely on a central authority.
• Verifiable Credential (VC): A digitally signed attestation about a subject (user) issued by a trusted issuer.
• Holder: The user who owns and controls their verifiable credentials in a digital wallet.
• Issuer: An entity that creates and signs verifiable credentials.
• Verifier: An entity that requests and verifies verifiable credentials.
• Digital Wallet: An application (e.g., Microsoft Authenticator) used to store and manage verifiable credentials.
• DID Web: A trust system that uses public/private key pairs and web infrastructure for decentralized identity.
• Face Check: A feature that uses Azure AI Vision face APIs to compare a user's live selfie with the photo in their verifiable credential or Entra profile.
• Access Packages: Bundles of permissions and access rights in Entra ID.
• Entra ID P1 License: A Microsoft Entra ID plan that includes basic verified ID capabilities.

1. Core Principles and Architecture

• The core principle is user-centricity: the user (holder) is in complete control of their verifiable credentials.
• The user stores VCs in a digital wallet, typically on their mobile device (e.g., Microsoft Authenticator).
• Issuers create VCs, digitally signing them with their private key. The issuer's DID is included in the VC.
• Verifiers request VCs from users. They verify the VC's signature using the issuer's public key, obtained from the issuer's DID document.
• A trust system underpins the entire process. DID Web, using public/private key pairs, is a common trust system.
• Entra ID, as an issuer, uses DID Web. The public key material is hosted at a well-known URL (e.g., /.well-known/did.json).
• The authenticator app uses DID ION for its decentralized identity.

2. Use Cases and Applications

• Enhancing Security: The primary use case is to enhance security and resilience against phishing attacks, including deep fakes.
• Onboarding: Verify the identity of new employees to prevent fake accounts or impersonation, especially from nation-state actors.
  • The user presents a government-issued ID to a trusted identity verifier (e.g., Lexus Nexus, Clear).
  • The identity verifier performs due diligence and signals Entra ID upon successful verification.
  • Entra ID then issues the verifiable credential to the user's wallet.
• Account Recovery/Help Desk Operations: Enhance the security of account recovery processes.
  • The help desk issues a challenge code to the user.
  • The user presents their verifiable credential.
  • Only after successful verification does the help desk proceed with the account recovery.
• High-Privilege Access: Require verifiable credentials for granting access to sensitive resources or access packages.
  • The user requests access to a high-privilege access package.
  • They must present a verifiable credential.
  • The system verifies the credential before granting access.

3. Entra Verified ID and Face Check

• Entra ID can act as both the issuer and the verifier of verifiable credentials.
• Face Check: Compares the user's live selfie with the photo in their verifiable credential or Entra profile.
  • Uses Azure AI Vision face APIs, including liveness detection.
  • The video feed is not stored or shared with the verifier.
  • The verifier receives a confidence score indicating the likelihood that the person in the selfie matches the identity.
  • Requires the Microsoft Authenticator app to prevent injection attacks.
• Setup:
  • Quick Setup: Entra ID manages the DID and key vault. Uses the user's Entra ID profile picture for face check.
  • Advanced Setup: Allows for custom DID names and control over the DID document storage.
• Integration with Access Packages:
  • Require a verifiable credential and face check as part of the access package request process.
  • This adds an extra layer of security for sensitive resources.

4. Step-by-Step Example: Access Package with Face Check

1. Configure an access package in Entra ID.
2. In the request policy, require a verifiable credential from a specific issuer (e.g., savvlettech.net).
3. Specify the credential type (e.g., "verified employee").
4. Enable the "Require face check" option.
5. The user requests the access package.
6. The system generates a QR code.
7. The user scans the QR code with the Microsoft Authenticator app.
8. The app prompts the user to perform a face check.
9. The user shares the verifiable credential and the face check claim.
10. The system processes the request and grants access if all requirements are met.

5. Licensing and Costs

• Basic verifiable credential issuance and verification are included in Entra ID P1.
• High-assurance entitlement management requires the Entra ID Governance suite.
• Entra ID P1 includes 8 free verifications per user per month, pooled across the organization.
• Beyond the included amount, each verification costs $0.25.
• The average user is unlikely to exceed the included amount.

6. Activity Log

• Entra ID provides an activity log for verifiable ID-related events.
• The log is not real-time and may have a delay of 15-20 minutes.
• It shows issuance and verification events.

7. Notable Quotes

• N/A

8. Technical Terms and Concepts

• DID Document: A JSON document that contains metadata about a DID, including its public key material.
• Wallet SDK: A software development kit that allows developers to create digital wallets that are compatible with verifiable credentials.
• Liveness Detection: A technology that verifies that a selfie or video is of a live person and not a static image or a 2D video.
• False Positive Rate: The probability of incorrectly identifying someone as a match during face verification.

9. Synthesis/Conclusion

Entra Verified ID and Face Check provide a robust solution for enhancing security and trust in various scenarios, including onboarding, account recovery, and access management. By leveraging decentralized identity principles and biometric verification, organizations can significantly reduce the risk of fraud and unauthorized access. The ease of setup and integration with existing Entra ID features, such as access packages, makes it a valuable tool for modern identity management. The face check feature adds an extra layer of security by ensuring that the person presenting the credential is the actual owner of the identity.