FIDO Authentication Explained: How FIDO Certified Facial Recognition is Used in Fintech

With security being a critical part of the Banking, Financial Services and Insurance (BFSI) industry, biometric technologies like facial recognition are now a commonplace, with many BFSI operations relying heavily upon the use of fintech (a portmanteau of “finance” and “technology”) to better serve customers. In addition to this, thanks to organizations like the FIDO Alliance, a non-profit that promotes a free and open standard of user authentication, businesses have been able to eliminate the use of traditional passwords in most circumstances while being assured that their online services and transactions are protected by minimum security standards. The FIDO Alliance and its certification program is used by many of the top tech companies including Apple, Google, Intel, Master Card, Meta, Microsoft, PayPal, and Visa.

What is FIDO Authentication?

FIDO (also known as “Fast Identity Online”) is a security protocol that enables websites and apps to replace user password input with alternative login solutions that are quicker and more secure than the traditional login.
FIDO Authentication technology aims to deliver strong password-less security across a wide range of platforms, devices, and browsers. When FIDO Authentication first began, it was compatible with just one type of security key from PayPal, but since its development, other tech industry members of the Alliance have adopted the widely extensible secure platform and used its protocols to support a multitude of authentication methods, including biometrics, for password-less, second-factor, or multi-factor authentication procedures. FIDO security is based on public-key cryptography and, as is the nature of any key, stays securely with the registered user. The key can be a physical device, a fingerprint, a voiceprint, or facial recognition data.

How Does FIDO Authentication Work?

Source : PingIdentity

As mentioned previously, FIDO Authentication uses standard public-key cryptography techniques in its services. To register an online service with a fintech company, for example, a private key and public key would be created; the public key is then held by the business while the customer holds the private key. Once the registration is complete, the customer accesses the online service by answering a challenge with their private key, which must be unlocked locally by the customer. In practice, this usually means that when a customer wishes to log onto their BFSI service, they will need to swipe a finger, scan their iris, enter a PIN, speak into a microphone, insert a dongle / token, or show their face to a device camera to verify their identity. By completing one or more of these actions, the customer will be given access to their desired service. Biometric options, including technology such as facial recognition, have become increasingly popular and are one of the easiest and more secure options for customer logins.

The FIDO Alliance assures that behind-the-scenes protocols “are designed from the ground up to protect user privacy,” and most importantly, that the user’s information never leaves the device they are using and is never stored on a server. Thus, data read by your device’s storage, fingerprint reader, iris scanner, or camera is protected and stays only on the user’s device.

Two main factors that make FIDO an ideal option for businesses are privacy and scalability. Using FIDO and cryptographic keys means that the user’s privacy is protected, as each cryptographic key used differs depending on the website. Therefore, keys are protected and, for example, can’t be used for user-tracking across web properties. Due to simple JavaScript APIs, FIDO Authentication is extremely scalable. Any business with a website or app that wants to adopt FIDO Authentication for password-less user convenience can do so with the use of API keys and is supported by all leading web browsers (Chrome, Safari, Firefox, etc.), as well as within mobile apps.

FaceMe received FIDO Alliance UAF Level 1 Certification. This means that FIDO Alliance has recognized a number of advanced FaceMe security and interoperability protocols that meet the financial services industry’s strict security requirements such as using multi-factor authentication over traditional password login.

How FIDO Authentication Strengthens Online Banking Security

Due to FIDO’s use of public-key cryptography, FIDO Authentication strengthens security for banking and also eliminates third-party transactions, thereby reducing implementation and development costs.

FIDO also benefits from a “challenge/response approach,” where the private key is unlocked with multi-factor authentication on something a registered user owns (such as a device with a webcam, fingerprint reader, or accessibility via PIN). As previously mentioned, this helps secure user authentication and removes regulatory concerns regarding biometric data usage, as the biometric confirmation data never leaves the hands of the user.

Using AI Facial Recognition in the FinTech Industry

Facial recognition technology has become an increasingly popular and secure way for industries to authenticate user identity, and this trend is no exception for the BSFI industry. Just recently, CyberLink’s AI facial recognition engine, FaceMe, received FIDO Alliance’s UAF Level 2 certification, proving its interoperability with other FIDO technology and meeting FIDO security system standards. FaceMe hopes to continue climbing the ranks of FIDO’s certification program, but already with a Level 2 certificate, business owners, developers, and users can be assured that FaceMe will provide accurate facial recognition, highly reliable anti-spoofing technology, and ease of integration for their FIDO compliant websites and app development.

BitoEx: Facial Recognition for Cryptocurrency Wallets

BitoEx is a cryptocurrency services provider that recently began implementing FaceMe’s facial recognition technology to cautomate their new enrollments and improve their regular online service security. Prior to FaceMe, BitoEx faced lengthy enrollment processes that, although were helpful in guaranteeing customer identification safety and were set by eKYC regulations and privacy laws, often caused users a wait time of up to 10 days to verify their identity and open their BitoEx accounts. Thanks to FaceMe’s AI facial recognition software, the enrollment process has been cut to just one day, improving customer satisfaction and business efficiency, while cutting down on staff processing costs.

CAC Corporation: Facial Recognition for Unmanned Smart Retail Stores

CAC Corporation is an independent software development company in Japan founded in 1966. Although this company has been long-established, it was not until recently that the company started using an internal payments system that leverages FaceMe’s software development kit (SDK). The firm’s convenience store for its employees recently made its payment system fully automated using facial recognition technology. Once employees are enrolled into the FaceMe system, users can complete checkout just by showing their face – no wallet, card, or cash required. As the system stands currently, the amount at checkout is simply deducted from the user’s next paycheck, and the user can even monitor their spending and set spending caps.

Cases such as BitoEx and CAC Corporation are just a small screenshot of the possibilities available through AI technology such as FaceMe. CyberLink hopes to continue creating new and novel uses for FaceMe and its flexible SDK for potential developers. For more information on FaceMe’s accomplishments, check out our latest articles and case studies.

FAQ