2-6--ADOT_ECD_DLSSU_RFP--NEC_Functionality_and_Reliability_FINAL_2022-04-18.pdf

An NEC Response to the Arizona Department of Transportation – Enforcement and Compliance Division ECD Drivers License Security Software RFP – BPM004292

Section 6 – NEC Functionality and Reliability

Page 6-1

6 NEC Functionality and Reliability RFP Reference: APP Portal, Financial Questionnaire, Proposal Requirements for Drivers License Security Software Overall Solution, Functionality and Reliability; ADOT ECD DLSS RFP, Scope of Work, Sections 7–9

NEC Corporation of America (NEC) appreciates the opportunity to present the Arizona Department of Transportation (ADOT) with an overview of our NeoFace® Facial Recognition System (FRS) and fraud prevention solution. Designed to meet and exceed ADOT’s requirements as stated in the Request for Proposal. NEC’s, implementation, support, and maintenance teams will provide ADOT with a fully compliant identity management and fraud investigation platform that will fulfill and surpass all requirements as envisioned today. The flexible and modular structure of the NeoFace FRS architecture and cloud hosting model will allow ADOT to dynamically respond to emerging business priorities quickly and efficiently, with minimal impact to existing functions.

* * * B E G I N C O N F I D E N T I A L I N F O R M A T I O N * * *

A commercial off-the-shelf (COTS) solution, the NeoFace FRS leverages the latest industry standard technology components and technology platforms to provide superior performance, flexibility in deployment, and reduced costs, enabling IT departments to better plan and manage resources and security. As a result, the NeoFace FRS provides a lower total cost of ownership via an easier and more affordable path for future upgrades.

The FRS solution, hosted on the Microsoft Azure Government℠ cloud (using both infrastructure and platform services), combines the latest facial recognition algorithms with a microservices architecture (MSA), providing the flexibility, reliability, and speed that agencies need to perform their work effectively.

At a high level, NEC’s FRS solution offers the following advantages:

• Fully integrated FRS that allows for centralized, cloud-hosted transaction control, storage, management, and auditing of all system processing.

• Component-based architecture supporting future system growth for additional, transaction volumes, or database storage.

• Highly accurate and reliable NEC matching algorithm, tested and validated by the National Institute of Standards and Technology (NIST), resulting in increased system accuracy and performance.

• Best-in-class client applications designed for ease of use, investigator efficiency, and rich user experiences, accessed by hypertext markup language (HTML) 5-compliant web applications for broad user access.

• Improved investigator efficiency, owing to:

Optimized facial detection algorithms reducing the failure to enroll rate.

Already developed multi-step review enrollment workflows, allowing peer review of fraud decisions.

Integrated case management for fraud and police investigation searches.

Higher differentiation of candidate scores, allowing for reduction of backlogs and increased case throughput.

Selecting NEC’s proposed solution will provide the benefits of a cost-effective service model backed by years of hosting experience.

Page 6-2

• Fully integrated administration, management, and reporting capabilities, allowing full system control from a single web client application.

• Dynamic workflow management that provides the flexibility to instantly change business rules, system workflows, and reporting requirements without system interruption.

6.1 Architectural Overview

As a solutions provider, NEC builds and delivers turnkey systems that meet our clients’ precise needs and specifications. The FRS architecture focuses on the integration of industry standard platform components with facial recognition specific software to provide a solid infrastructure that can fully support ADOT’s requirements. Figure 6-1 is a diagram illustrating the proposed FRS.

Page 6-3

Figure 6-1: Proposed NeoFace FRS Solution Configuration

Page 6-4

6.1.1 Components Overview

Table 6-1 provides an overview of the proposed baseline components that will be delivered as a part of the solution.

Table 6-1: NeoFace FRS Solution Components

Component Description

Identity Services (Back-End Components)

NEC Digital Platform

(NDP)

The NDP manages all workflows and external interfaces. It maintains the work-in-progress (WIP) queue and tracks all activities and roles for all users. The NDP hosts all the necessary external interfaces, web applications, and administrative access. The NDP houses all services relating to FRS transaction control.

Agency Gateway Service Provides interoperability with third-party applications and services, providing interfaces to external subsystems, including:

• ADOT MAX System – The gateway service will integrate to the MAX system for the daily processing of license and ID card applications. In addition, database maintenance operations can also be initiated by the MAX system to maintain synchronization between systems.

• Mugshot System – Optional interface to the mugshot system for the enrollment and management of the mugshot photo gallery.

• Other State DL systems – Optional integration with other State DL systems providing FR services to detect fraud across state lines.

Elastic Matching Service NEC’s NDP Elastic Matching Service provides integrated services for facial recognition matching. For more information, see Section 6.2.4, “Elastic Matching Service.”

NEC Clients/Applications (End User Components)

NeoFace Reveal Web Application

Leveraging Microsoft Windows, the Reveal workstation serves as the user interface to access facial recognition functionality. It provides a single logon point to run all available user functions such as image capture, image enhancement, search submission for back-end facial recognition matching, and search verification. User profile, however, dictates available functions. For more information, see Section 7.2, “NeoFace Reveal.”

Insights Workbench The Insights Workbench web application provides a central location for administrative maintenance and monitoring of all functions, such as user management, transaction/workflow management, system configuration and settings, and reporting functions. For more information, see Section 7.3, “Insights Workbench.”

Mobile WAY Mobile WAY is a mobile application for commercial smartphones. It supports multimodal biometric capture, rapid data entry, and easy credential reading for quick identifications.

For more information, see Section 7.4, “Mobile WAY.”

Page 6-5

6.2 NEC Digital Platform

The NEC Digital Platform (NDP) is based on microservices architecture and enables containerization of biometric workloads and non-biometric system workloads. NDP’s Identity Management System (IDMS) provides a scalable and secure capability to enable NEC-patented biometric solutions exposed through REST APIs that support biometric identification, identity management, and face recognition applications while seamlessly integrating with NEC’s cloud-based elastic matching service. The containerized platform is run in a Kubernetes environment, allowing for dynamic resource allocation. The platform provides centralized infrastructure for logging, messaging, and monitoring services for all FRS solution components.

Figure 6-2 provides an overview of the NDP architecture, which is based on open standards and has been designed for ease of use and interoperability with other systems through modern, standards-based communication protocols.

Figure 6-2: NEC Digital Platform Architecture

The NEC Digital Platform has three primary layers, as detailed Figure 6-3. Details of relevant microservices are identified in the figure below and described in the following sections.

Page 6-6

Figure 6-3: NEC Digital Platform Functional Layers

6.2.1 NDP API Gateway

NDP provides an API gateway that manages the calls and interfaces from all clients and external services, then routes them to the appropriate microservice, with request routing, composition, and protocol translation performed within the platform. The API gateway handles a request by invoking multiple microservices and aggregating the results to determine the best path. The API gateway is the platform conductor that organizes the requests being processed by the microservice architecture and creates a simplified experience for the user. The API gateway monitors and secures the underlying API by providing rate limiting to identify and throttle noisy neighbors, routing requests to appropriate services and versions of the application. In a microservices deployment, the API gateway takes one request and connects it to several services, aggregating the response.

The API gateway is set up in front of the microservices and becomes the entry point for every new request being executed.

The NDP API gateway provides a range of filters that allow services to apply functionality quickly and nimbly to the edge.

The filters identified below perform the following functions:

• Authentication and Security provide authentication requirements for each resource.

• Insights and Monitoring track meaningful data and statistics that give an accurate view of production.

• Dynamic Routing directs requests to different backed clusters as needed.

Page 6-7

• Stress Testing increases the traffic to a cluster to test performance.

• Load Shedding allocates capacity for each type of request and drops a request that exceeds the limit.

• Static Response Handling builds some responses directly at the edge instead of forwarding them to an internal cluster.

• Multi-region Resiliency routes requests across multiple regions or data centers to diversify our elastic load balancing (ELB) service usage.

6.2.2 NDP Common Service Components

The NEC Digital Platform provides a set of common services that other platform services and applications leverage and extend. Some important core common services for implementations include:

• RBAC – NDP’s role-based access control (RBAC) provides centralized access control for users and services within the NeoFace FRS solution. RBAC simplifies user management by providing the ability to define roles, which can then be assigned to individual users based on their job functions. Each defined role grants permission to perform a full set of functions rather than requiring the system administrator to assign these same functions to a user one by one. For example, a system administrator role could grant full access to all administrative functions in the system, including tasks such as system monitoring and user management; a manager role could provide full access to end user functionality but limited access to administrative functions, such as queue management and reporting; and an investigator role could restrict the user’s access to more specific end user job functions, such as search submission and candidate verification.

General principles of RBAC include:

A single user can be assigned multiple roles.

Multiple users can be assigned to the same role.

A role can grant authorization to perform multiple functions.

A specific function can be assigned to multiple roles.

• System Management Console – NDP’s System Management Console, also known as Insights Workbench, provides the user interfaces and views for the user to perform the various system-configuration-related functions of the NDP core platform and services, such as:

Manage users, roles, and permissions.

Manage system settings, such as parameters, resources, and code tables.

Manage batch jobs and monitor the job execution.

Manage applications and provide single sign-on (SSO) capabilities to launch the managed applications.

• Monitoring Service – The Monitoring Service dashboard provides users an interface to view the list of system event notifications that were raised to the system. It also provides the functions for users to view the event details and manage the event escalation information. The Monitoring Service provides infrastructure, application, and network monitoring capabilities, and provides different filtering, viewing, and notification options. The NDP Monitoring Services uses tools such as Kibana and Prometheus.

NDP also provides a “Batch Monitoring” function user interface for monitoring and management of the batch execution status in the identity management (IDM) console.

• Workflow Management – NDP’s Business Process Management Service (BPMS) manages and executes business processes and workflows performed by the FRS applications. BPMS uses the Activiti BPM framework, Page 6-8 an open-source workflow engine written in Java that can execute business processes. NDP’s workflow management engine provides a customized and configurable workflow process that can be easily managed and extended at the customer level. NDP’s workflow module offers manageability in law enforcement environments that need variations in business rules, data flow, and operational procedures.

• Data Analytics – NDP provides multiple processes and techniques for analyzing the raw data gathered in the platform and generates meaningful conclusions based on the use case.

• Data Transformation – NDP’s Data Transformation service provides the tools to convert data from one format or structure into another format or structure. This can be used to map NIST data to internal data formats or provide modification or expansion of different transaction types. Users can customize data mapping templates to provide system flexibility and expandability to address evolving standards.

6.2.3 NDP Infrastructure Service Components

The NEC Digital Platform provides a set of infrastructure services that can be leveraged or extended by other platform services and applications. Some important infrastructure services include:

• Matching and processing services – NDP integrates with NEC’s biometric matchers to provide biometrics matching. NDP will embed NEC’s Biometric Manager component, which readily interfaces to NEC’s existing biometric matching products.

• Notification services – NDP will integrate and support standard pub/sub notification services (like Amazon SCS) for microservices and distributed system and server-less applications. The notification service will provide the adaptor to integrate third-party notification service providers such as Twilio and will support protocols such as SNMP, HTTP, HTTPS, SMTP, email, JSON, and SMS. It will also support the push notification protocol.

• Log management services – NDP provides log management services based on Fluentd, Elasticsearch and Kibana. Log management deals with large volumes of computer-generated log messages. Log management generally covers log collection, centralized log aggregation, long-term log storage and retention, log rotation, log analysis, log search, and reporting.

• Audit services – NDP provides audit services based on Cassandra, Elasticsearch, and Kibana. The Kibana dashboard view displays the list of system audits that were recorded by the system’s audit service. It also enables users to search and view audit details.

• Reporting Engine – NDP’s reporting engine provides users the organized representation of the information in the system, including display on screens, printed hardcopies, or exported softcopies in Microsoft Excel or Word or PDF.

Page 6-9

Figure 6-4: Report Generation Process

• Event bus service – NDP provides a common interface for all use case implementations and provides an internal event bus infrastructure service that allows different components to communicate with each other without knowing about each other. The event bus service uses ActiveMQ. NDP’s scalable, highly available dynamic event bus service needs little configuration.

• Key storage – NDP’s key storage or vault is a storage capability that can be used to store private keys of asymmetric key pairs. For example, an asymmetric key pair is generated for each edge during its registration, and the private key is stored in the vault and is used to decrypt images coming from that edge.

• Data storage – NDP provides platform-agnostic data storage services for both SQL and NoSQL. For storing SQL data, NDP provides MySQL, MSSQL, and Oracle database service. NoSQL data can be stored in an Apache Cassandra database.

6.2.4 Elastic Matching Service

The NEC elastic matching service provides integrated services for biometric template-based matching. A COTS, scalable software matching solution, the matcher uses a component-based architecture providing extraction, identification, verification, and fusion services using the industry’s most accurate and proven algorithms.

Page 6-10

The core computational units for matching are scalable, using a cloud-derived, container-based architecture that allows for dynamic scalability of resources to meet processing and response time needs. Many processing components (using a clustered architecture) may be used on an on-demand basis to deliver performance requirements. Components are dynamically provisioned by the system to meet system demands without interruption to current operations.

The matcher uses a stateless transaction strategy, eliminating the need for an internal transaction manager and reducing latency associated with stateful transaction management while providing the response times necessary for high throughput requirements.

The matcher architecture is based on distributed, parallel-grid computing, which provides superior performance (massive parallel processing) and scalability (adding new plug-and-play servers as needed). The architecture is also designed to support fault-tolerant computing by distributing multiple copies of the matching template data throughout the system. The risk of a single point of failure in the matching system is thereby eliminated through both component and template redundancy integrated with the design.

The proposed matching subsystem also has the flexibility to fine-tune parameters for all modalities and function types, including encoding processes to manage SLAs pertaining to solution performance and accuracy. The system supports a combination of runtime settings (defined on a per-transaction basis) and system-configurable parameters to affect the entire matching process. The configurable parameters listed below provide a sample of the options available to tune system performance and response times. As part of our project implementation and quality control, NEC will set these parameters to meet the defined project accuracy and performance requirements:

• Matching parameters – Using these parameters makes it possible to fine-tune the system for higher performance, accuracy, and transaction rate.

• Speed of algorithms – Controls accuracy-performance factors.

• Rotation and distortion parameters algorithm – Increases tolerance for enrollment errors and image quality.

• QC parameters – Sets parameters for automated QC and correction.

6.3 Interfaces

The API gateway of the NDP platform provides a plug-in architecture that supports a wide variety of interface protocols and data messaging formats. For the ADOT solution, the following interfaces are envisioned:

• ADOT MAX system – As the existing FR provider, NEC has already integrated with the MAX system through REST-based web services. This interface supports the daily processing of license and ID card applications, including image submission and facial recognition processing responses. In addition, database maintenance operations can also be initiated by the MAX system to maintain synchronization between systems. Having already completed the integration with the MAX system will streamline the implementation process as NEC has already coded the interface, allowing full use of the existing protocols and reducing the required testing for implementation.

• Mugshot system (optional) – The RFP includes the option to register a separate mugshot gallery for FR investigative searching. Assuming that this interface will be different from the MAX interface, NEC will develop this interface for the enrollment and management of the mugshot photo gallery should the option be chosen.

Page 6-11

• Other State DL systems (optional) – The extensibility of the API gateway allows additional interfaces to be implemented, including interfaces to other FR systems used for fraud prevention in neighboring states. This interface will allow for detection of fraud across state lines.

* * * E N D C O N F I D E N T I A L I N F O R M A T I O N * * *

6.4 Reliability via Microsoft Azure

The Azure cloud platform provides a suite of services that enable continuity of operations in the event of a system failure or data center loss.

• High availability – The Azure cloud is designed to provide high availability (HA) systems at both the container and storage levels.

Container orchestration provides a single-instance availability at 99.9%.

Multiple instances of containers in an HA cluster provide 99.95% availability at the instance level.

Data storage uses a 3× replicated strategy with cyclic redundancy checks for data corruption.

Replication across geographic regions further ensures a guaranteed data availability of 99.99% and durability of 99.99999999999999%.

• Geo-redundant storage – All data stored in the system, including virtual machine (VM) backups, matching templates, and audit/reporting information uses geo-redundant storage, which automatically creates, updates, and validates additional data copies in a geographically separate region.

• Azure Backup – Azure Backup services create and store copies of all container instances, enabling a point-in-time recovery for system resources. In addition to recovering corrupted images, backups can be used to simplify rollback processing as part of the configuration management process.

• Azure SQL – The Azure SQL database provides a high availability disaster recovery solution out of the box.

Availability is guaranteed to exceed 99.99%.

All data is replicated six times across geographically separate data centers.

Geo-replication of databases between regions using a transaction-level asynchronous strategy ensures consistent commits of data at the backup location.

6.5 Liquidated Damages

NDP and the Microsoft Azure Government cloud are designed to provide high reliability and uptime. In the event of downtime, however, please see NEC's proposal for response times in Table 1 – Response Time, and for liquidated damages in Section 3, "Cloud Solution & Maintenance Requirements."