High Assurance Identity Proofing Under NIST 800-63A IAL3
NIST (National Institute of Standards and Technology) publishes management, administrative, technical, and physical standards that ensure cost-effective security of Federal information systems. For some regulated industries this process of NIST Identity Assurance Level 3 verification (IAL3) verification may be mandatory.
Identity Proofing at IAL3 level requires evidence of superior strength, and may involve either remote or in-person verification. All attributes claimed by a CSP must consist of only boolean values that meet specific criteria such as replay resistance.
Authentication
NIST guidelines offer guidelines to determine your Identity Assurance Level (IAL), credential service provider responsibilities, and data governance practices that many online services abide by when verifying users.
IAL2 is the most frequently employed identity verification standard and involves unattended remote or in-person identity proofing processes. At this level, CSPs may assert pseudonymous identities with verified attributes in support of pseudonymous identities with verified attributes.
Trust Swiftly's NIST IAL3 verification solutions meet IAL2 requirements; anything less would likely not satisfy most business use cases and IAL3 would require an in-person check, which cannot be fully automated by our software.
At an on-site verification step, several steps are involved, such as photographing documents and users and collecting evidence. This can be completed using an approved device or kiosk which must be secured against tampering; moreover, applications must also support loading IAL3 authentication pathways, which includes checking superior documents that may have not previously been submitted.
Biometrics
At this level of identity proofing, you must obtain high-quality images of the person being assessed, biometric data and documents for comparison. Furthermore, advanced methods like multispectral UV light analysis must be employed to validate document authenticity - IAL3 identity proofing helps prevent counterfeiting while verifying that its source was genuine.
IAL 3 also mandates that CSPs compare fresh biometric samples taken during verification sessions with those recorded when issuing primary authenticators devices, by comparing live image of applicant against previously captured video clip of face; this must either be conducted personally or remotely.
IAL3 also mandates validation of various identity data points, such as names, dates of birth, addresses, phone numbers and ID numbers. These attributes can be manually or automatically verified using facial recognition technology such as Trust Swiftly which compares captured images of people to records in authoritative data sources.
General requirements
Identity proofing solutions must meet certain general criteria for effective operation, such as being capable of detecting proofing errors and verifying personal identifiable information (PII), privacy agreements and duplicate accounts and devices so as to prevent fraudulent activity and prevent social engineering by fraudsters.
PII must only be collected with the sole intent of creating an identity record and for no other purposes, in order to prevent re-identification and protect RP from impersonation, theft or other potentially damaging effects. Furthermore, CSPs should verify an authenticator's status before trying to reestablish binding - this includes checking that its services have not been terminated, disabled or revoked before trying reestablish binding; this requirement is especially pertinent in regards to mobile and remote verification services.
Requirements for onsite verification
Trust Swiftly can assist with verifications at various stages, from remote to assisted in-person. Furthermore, its software connects with multiple governments and third-party data sources in order to verify evidence such as driver licenses with DMV databases for authenticity checks as well as superior documents like passports.
Additionally, this tool can perform various verification checks on a user's face to ensure it matches what is captured on photos or documents, as well as compare non-facial biometric evidence against authoritative databases.
CSPs should verify address data against self-asserted address data to stop scalable attacks. They should also offer HD video connections with agents who will assist people through proofing processes, while being trained to recognize fraud quickly and create a structured verification process.
