Type 2 change framework

[woodbe]

This is to close #17 and provide a framework for how to define the materials needed.

[n-kai]

"Requirements for Tools" in [Face Toolbox Overview] states as follows. So we have to discuss and modify the following text first.

This toolbox defines two level of tools—​Type 1 and Type 2—​to cover variety of tools to conduct the PAD testing efficiently. Not all tools have both levels.

Type 1 tools are inexpensive and can be used by novices to capture and upload images to social media. An attacker may also create face artefacts with such uploaded images without difficulty. Detailed attack methods using uploaded images have been published on the Internet, so the evaluator shall try this type of artefact first.

Type 2 tools have better performance (e.g., higher resolution) than Type 1 tools. Such tools should be the latest available (i.e., released at least within one year from the date of PAD testing, or as recent as possible depending on the type of device). Those tools may be expensive, but can be rented at an affordable cost. The reason why such tools should be used is that the PAD algorithm may show good rejection performance for artefacts used to train the algorithm, but reduced rejection performance for artefacts the algorithm has never seen before. Attackers may additionally create high-quality artifacts to maximize the chance of successful attacks.

[woodbe]

@n-kai I have tried to make a modification that I think will do what we need, using recentness as strictly an example of what it could mean, along with "industry recognized" leading device. This should be broad enough but also set some goals.

@gregott can you look at the changes I made in the table and fill those in? I have some XXXXX marks where I had no idea what to put in terms of DPI/resolution, and I'm not even sure if that is the right way to look at it, so it may be that those are just wrong and should be replaced completely.

[woodbe]

@woodbe to add in camera info from @gregott and update printer to "dedicated photo printer". Still need to work on display screen info.

[woodbe]

So I just realized that the printer description is actually for Type 1, not Type 2, which is specifically to be professional services. Should we add a dedicated photo printer to type 2 and just adjust the type 1 to not be too old but can still be an AIO?

[gregott]

I would leave Type 2 as professional services as long as those professional labs are in the class of WHCC or White Wall and not Walmart or Shutterfly.

As for the Type 1 printer specs, a dedicated photo printer with a minimum resolution of 2400 x 1200 dpi would be good. I am thinking of printers similar to Canon Pixma Pro-1000, Canon imagePROGRAF PRO-1000, Epson Expression Photo HD XP-15000, Epson SureColor P700 Inkjet Printer, etc. These are low end professional or high end enthusiast grade printers. Further, I would recommend the use of OEM pigmented inks when printing the PAIs.

[gregott]

Here is what I would recommend for M2 Screen, Type 2:

• Use a UHD (4K) or higher resolution display (TV or computer monitor)
• Do not use TN (Twisted Nematic) displays
• Do not use strobed backlight displays
• Recommend IPS (In-Plane-Switching) or OLED displays

Some recommendations for displaying the PAI to the TOE:

• Adjust camera to screen distance to minimize moiré patterns
• Adjust camera and screen orientations to minimize reflections seen by the camera

I am not sure what is meant by “Test user’s face shall be displayed or replayed on the screen in full scale.” In fingerprint attacks, having a life size PAI is rather important. In situations where the biometric is being collected by a video camera, the TOE will scale as needed, within limits. So, I am not sure this is needed here. Generally, you want to fill the screen to the greatest extent possible if displaying on a mobile device. On a TV or large enough computer monitor you may want to try to get the face to be close to life size. That would allow the PAI to be roughly the same distance from the TOE as a real face would be, and that may not be a bad thing. All of this may depend on the PAD technique. If it needs to see some of the background behind the user then the size of the face relative to the display may change.

[woodbe]

@gregott I have updated with this information. I put the moiré patterns into the overview document with the screen presentation info (reflection stuff already there).

[n-kai]

@gregott

I am not sure what is meant by “Test user’s face shall be displayed or replayed on the screen in full scale.”

My initial version simply said that M.2 Type 1 (Mobile device screen) should include user's full face.

I fully agree with you and “Test user’s face shall be displayed or replayed on the screen in full scale” in M.2 Type 1 should be replaced with “Screen shall include test user's full face and this face image shall be taken by the test user where the user holds the mobile device like normal face verification"

[n-kai]

L128 in the PR should be replaced with “Screen shall include test user's full face and this face image shall be taken by the test user where the user holds the mobile device like normal face verification" as I commented.

[woodbe]

@n-kai I have made the update to line 128 and committed it into this change.

[woodbe]

Merged based on 7/26 call