PassFace: Enabling Practical Anti-Spoofing Facial Recognition with Camera Fingerprinting

Facial recognition has become the surge on mobile authentication scenarios and makes up a huge market share for various apps, such as MasterCard, Google Wallet, and AliPay. However, existing solutions suffer from various impersonation attacks, including photo-spoofing attack, video-replay attack, and 3D facial mask attack. State-of-the-art countermeasures either require additional user intervention or introduce specialized high-end sensors. Even introducing these extra efforts, these approaches still hardly defend the latest 3D facial mask attacks, which gradually become accessible due to the prevalence of low-cost 3D printing. In this paper, we propose an anti-spoofing facial recognition system, PassFace, which verifies the smartphone for authentication as the second factor merely using raw facial videos without any user intervention, to defeat impersonation attacks. In particular, when receiving a user's selfie video, PassFace identifies the user's face from the video, and meanwhile extracts the highly unique and physically irreproducible camera fingerprint, i.e., Photo Response Non-Uniformity (PRNU), built in the smartphone from key frames of the video. After that, the system compares the Peak to Correlation Energy (PCE) calculated by the estimated PRNU and the reference profile with a threshold for authentication. Experiment results demonstrate PassFace can achieve satisfactory performance in authentication and attack resistance.

Automated summary

Facial recognition technology plays a crucial role in mobile authentication, but faces various impersonation attacks. To address this issue, this paper proposes a new anti-spoofing facial recognition system, PassFace, which uses raw facial videos as the second factor for authentication to enhance security and resist attacks. Experiment results show that PassFace can achieve satisfactory performance in authentication and attack resistance.