Liveness Detection

Introduction¶

Liveness detection is a critical security feature in Guacamole that prevents unauthorized access using photos, videos, or masks of authorized users. This guide explains how liveness works and how to configure it for your security needs.

Understanding Spoofing Attacks¶

What is Spoofing?¶

Spoofing attacks attempt to bypass facial recognition by presenting fake biometric data:

• Photo Attacks: Holding up a printed photo or phone screen
• Video Attacks: Playing a video of the authorized user
• Mask Attacks: Using 3D printed or silicone masks
• Deepfake Attacks: AI-generated facial videos

Why Liveness Detection Matters¶

Without Liveness detection:

• Anyone with a photo could unlock your computer
• Social media photos become security vulnerabilities
• Physical security is significantly weakened
• Compliance requirements may not be met

Liveness Detection Levels¶

Guacamole offers multiple liveness detection levels:

Off (Not Recommended)¶

Anti-spoofing is disabled entirely.

Aspect	Detail
Security	None against spoofing
Speed	Fastest recognition
Use Case	Testing only, not for production

Warning: Never disable liveness protection in production environments.

Balanced¶

Background analysis detects liveness without user interaction.

Aspect	Detail
Security	Moderate - detects most photo attacks
Speed	Minimal impact on recognition speed
Use Case	Balance of security and convenience

How It Works:
1. Analyzes facial texture and depth cues
2. Detects screen/paper reflections
3. Monitors for natural micro-movements
4. Works continuously in the background

Advanced¶

Requires user interaction for verification.

Aspect	Detail
Security	High - defeats most spoofing attempts
Speed	Adds 1-2 seconds for verification
Use Case	High-security environments

How It Works:
1. Standard face recognition first
2. Prompts for liveness action
3. Verifies action was performed naturally
4. Grants access only after verification

Depth Vision¶

Uses infrared depth camera for 3D verification.

Aspect	Detail
Security	Highest - defeats all common attacks
Speed	Fast, hardware-accelerated
Use Case	Maximum security, enterprise

How It Works:
1. IR camera captures depth map of face
2. Verifies 3D structure matches real face
3. Photos and videos appear flat, rejected
4. Works in complete darkness

Requirements: - Device with IR depth camera - Intel RealSense or Windows Hello camera - IR camera enabled in settings

Configuring Anti-Spoofing¶

Setting the Protection Level¶

1. Open Guacamole settings
2. Go to General > Liveness
3. Select your desired level
4. Save changes

Anti-Spoofing Sensitivity¶

False Positive Handling¶

If legitimate users are being rejected:

1. Check lighting conditions
2. Ensure camera lens is clean
3. Consider using IR camera if available

Detection Methods¶

Texture Analysis¶

Examines skin texture patterns:

• Real skin has unique micro-texture
• Printed photos have print patterns
• Screens show pixel patterns
• Detected automatically

Motion Analysis¶

Monitors natural facial movements:

• Real faces have subtle movements
• Photos are completely static
• Videos may have unnatural loops
• Detects involuntary micro-expressions

Reflection Detection¶

Identifies screen and paper reflections:

• Phone screens have glass reflections
• Photos may have glossy surface
• Detects specular highlights
• Works with passive analysis

3D Depth Verification¶

With IR camera:

• Builds 3D model of face
• Compares to registered depth map
• Photos appear flat
• Masks often have wrong depth

Security Scenarios¶

High-Security Environments¶

Recommended Configuration:
- Anti-spoofing: Depth Vision or Advanced

Use Cases:
- Financial institutions
- Healthcare with PHI access
- Government systems
- Research facilities

Standard Office Environment¶

Recommended Configuration:
- Anti-spoofing: Balanced or Advanced

Use Cases:
- General office work
- Corporate environments
- Standard security requirements

Remote/Mobile Workers¶

Recommended Configuration:
- Anti-spoofing: Balanced

Considerations:
- Variable lighting conditions
- Different environments
- Balance security with usability

Best Practices¶

Deployment Recommendations¶

1. Start with Balanced: Begin with passive liveness checks
2. Monitor Results: Check for false positives/negatives
3. Adjust as Needed: Increase security based on risk assessment
4. Train Users: Explain why liveness detection is important

Combining with Other Security¶

Liveness detection works best with layered security:

1. Windows Password: Fallback authentication
2. Physical Security: Lock offices, secure devices
3. Network Security: VPN, firewall protection
4. Access Logging: Track all authentication attempts

Regular Audits¶

1. Review authentication logs periodically
2. Check for unusual patterns
3. Test anti-spoofing effectiveness
4. Update policies as threats evolve

Troubleshooting¶

Legitimate Users Rejected¶

Symptoms: Liveness detection blocks authorized users.

Solutions:
1. Improve lighting conditions
2. Clean camera lens
4. Create new profile
5. Use IR camera if available

Slow Recognition¶

Symptoms: Liveness Detection may add significant delay.

Solutions:
1. Use Balanced instead of Advanced
2. Upgrade to Depth Vision with IR camera
3. Check CPU usage

Liveness Detection Not Working¶

Symptoms: System accepts photos/videos.

Solutions:
1. Verify liveness detection is enabled
2. Check the protection level
3. Test with Advanced mode
5. Use IR camera for best results

IR Camera Issues¶

Symptoms: Depth Vision not available.

Solutions:
1. Verify device has IR camera
2. Check IR camera drivers
3. Enable IR camera in settings
4. Try Windows Hello to verify camera works

Technical Details¶

Algorithm Overview¶

Guacamole uses multiple techniques:

1. Deep Learning Models: Trained on spoofing datasets
2. Temporal Analysis: Analyzes video frames over time
3. Multi-Spectral Analysis: Combines RGB and IR when available
4. Ensemble Methods: Multiple algorithms vote on result

Performance Impact¶

Level	CPU Impact	Recognition Delay
Off	None	None
Balanced	~5%	~1s
Advanced	~10%	~3 seconds
Depth Vision	~3% (GPU)	~1s

Compliance Considerations¶

Regulatory Requirements¶

Liveness detection may be required for:

• HIPAA: Healthcare data protection
• PCI-DSS: Payment card security
• SOC 2: Service organization controls
• GDPR: Data protection (security measures)

Audit Documentation¶

Maintain records of:

• Liveness Detection configuration
• Security incidents
• Policy changes
• User training completion