Windows Hello for Everyone

Windows Hello

26 OEM models with Windows Hello face authentication in market

Announced Windows Hello for Business & the Companion Device Framework

195 OEM models have delivered face authentication to customers

January ’15

July ’15

Holiday ’15

June ’16

Today

Hello is there2

Consumers use it daily3

When they use it they love it!3

1Source: Microsoft Market Research Nov 2016. Represents awareness for Windows Hello amongst Windows 10 users.
2Source: Microsoft Market Research Aug 2016.
3Source: Microsoft data & statistics Nov 2016.

CUSTOMERS WANT IT

CUSTOMERS LOVE IT

Awareness

Purchase Intent

Frequent Usage

Satisfaction

you the fastest, most secure way to unlock your Windows devices.* Using your face, fingerprint or companion device, it recognizes you apart from all others. It waves you in with a friendly hello and even works on apps and Microsoft Edge websites

Fast and password-free
Enterprise-grade secure
Quick sign-in to apps and websites too
Your companion devices unlock your PC

can request to verify you are using your device.

Enrollment

Setup Process
In OOBE but can also be launched via settings.

Login

Device Unlock
Upon boot or resume, use your biometric to unlock your device

of box experience
Toast notification to prompt user to enroll their biometric sensor

secure matching
Move IHV / ISV matching engines into Virtualization Based Security (VBS) to isolate matching from OS
We already do this for face authentication today; co-engineering with fingerprint IHVs

Improving Windows Hello reliability

IFrameProvider in Creators Update and beyond
Utilize UVC driver for RGB Camera and IR Sensor Streams:
Write the face (DDI) & device MFT files
MIPI based devices are supported by Intel® or AMD
Improved Camera Pipeline Performance
Simplified driver development with use of FrameServer – less code to maintain
Better concurrency and resource management
FrameServer is required for new devices shipped with the Creators Update

Link to Windows Hello FrameServer implementation kit

FrameServer Implementation table detailed in slide appendix

iFrameProvider (legacy) devices will continue working seamlessly with Windows
Signing flow is identical for face authentication and fingerprint solutions
Driver signing applicable for new devices shipping with Creators Update and beyond (running FrameServer)
Windows Hello capable devices must meet feature hardware requirements to obtain a signed driver
Devices without a signed driver will not enable Windows Hello capabilities
Run in test mode to test your device prior to signing driver
Enforcement of signing starts in Q2CY’17

Improving Windows Hello reliability

Launched this week

Reduced Relative Illumination to 35%
Algorithm improvements reduce illumination requirements reduced system power and heat dissipation
Reduced minimum RGB resolution requirement to 480x480 for a 40°x 40° FOV
&
RGB camera FOV should exceed IR camera FOV
Improved accuracy for more reliable authentication experience

“Engineer for success in delivering the right experience to customers”

camera or fingerprint tests to obtain a signed driver

System Functional Test Update

Image Quality Test Tool

you walk away from it. With “Proximity Lock”, your computer simply figures out if you're there or not and automatically locks itself in your absence, such as with Bluetooth, among other future protocols.
Simple customer experience
Pair your phone with your device using Bluetooth – Once paired, enabled by default
Device locks upon losing Bluetooth signal
Additional Bluetooth setting - On/Off
Investigating slight delay to lock as you walk / lose signal

biometric sensor
Face and / or fingerprint
Face offers the most modern experience and delivers a delightful “WOW!” factor
Offers a competitive differentiator to other platforms
Get it right for your target customer
Touch / tap versus swipe fingerprint
Touch has become the most familiar experience because of use on mobile – considered “today’s” technology
Swipe costs less, but is considered yesterday’s technology that was rarely used because of poor experience
We see a 25% efficiency improvement with touch / tap over swipe

– new designs and form factors are emerging
Test processes are in place to hit user experience metrics, telemetry is trending up!
Cost efficiencies are occurring – MIPI, hybrid, etc.
Devices (Illuminated IR modules and systems) exit criteria
Pass Spec Validation and Image Quality (IQ) testing
Validated by matching and passing OEM and Microsoft IQ test results
Exit criteria: Meets or exceeds 1/100K FAR @ 95% TAR requirements
Verified via face data capture and validation testing

While IQ metrics continue to evolve, the exit criteria remains the same

measures

High performance optics, sensor selection, IR illumination module
Camera and component design and verification
ISP tuning
Driver development

Properly specified system
Performance verification
Camera module integration
System hardware integration and validation

Microsoft

IHV

OEM / ODM

we are doing to drive volume
Qualify high quality module designs that meet OEM requirements
Enable cost saving components lead to a reduction in BOM
Drive continued reduction in module size for thin bezel designs
Tireless support for enhanced security
Keys to success
System designs that meet or exceed design requirements
Image quality test and verification
Field test of real faces in real environments

low cost IR solutions at scale using Pre-Qualified Parts.

Scale Program is now live
All new systems launching/refreshing beginning September 2016 must meet v2.x spec
All new systems launching/refreshing (e.g. Chassis change) and pre-installing the Creators Update must meet v3.x spec
All new submissions that plan on shipping June 2017 or later must be multi-spectrum capable for enhanced authentication and improved performance for commercial customers.
Objectives
Continue to expand pre-qualified parts list to provide more solutions to meet OEM needs
Continue to provide ecosystem partners (OEMs, IHVs, ISPs) documentation, process and tools necessary to deliver solutions meeting performance and security requirements
Help to reduce the test burden for systems using Pre-Qualified modules

all module testing and validation (IQ and Field Test)
Microsoft validates driver quality
Microsoft qualified camera module published on Pre-Qualified List and available to all OEMs
Pre-Qualified IR modules have been fully tested by Microsoft to meet or exceed:
Windows Hello (Face Authentication) hardware requirements
Established Image Quality (IQ) Key Performance Indicators (KPIs)
1/100K False Accept Rate (FAR), 95% True Accept Rate (TAR)
Microsoft End-to-end Validation includes
Image Quality (IQ) testing
1,200 Face capture field test
Basic usability testing
Anti-spoofing testing/data capture

are listed on the Pre-qualified parts list (PQL) published to Connect
Microsoft performs all module testing & validation on PQL parts including image quality (IQ) & field testing
OEM self-validates the system with module from the PQL
OEMs perform limited testing including IQ, Hardware Lab Kit (HLK)
OEMs follow system integration requirements as documented in latest specification document published on MSDN
Submits results via SysDev portal

Non-qualified OEM devices
Non-qualified devices will not be supported
Not eligible for driver signing in Windows (Creators Update Requires)
Modules with unsigned drivers will be disabled
Not eligible for Microsoft marketing programs and assets

fast time to market

Modern PC Features

Quality & Certification

Tools

Component Catalogue

Master
Reference Design

Customer
Support

Factory
Support

CUSTOMIZABLE REFERENCE DESIGN

SUPPORT MODEL

Connector

Image Processor

IR Camera

2 IR LED’s

NOR Flash

50 mm

8 mm

based module
Further cost down
MIPI modules

Now:
Ready to intercept your Intel® based products with the PureIR module for Windows Hello face sign-in

Contact your Intel® account team for more details

is required to get a Windows Hello device driver published to Windows Update
The review / approval process for Windows Hello fingerprint is published on Connect.
The following IHVs have completed all the necessary reviews for Windows Hello fingerprint approval:
CDF
CDF enables you to use a device such as a phone or smart watch to quickly sign-in to your PC without using a password
Requires an app from the partner device maker to be installed on the PC to manage the interaction
The CDF review process is done through the store submission process when the partner app is submitted

location
Web
FIDO 2.0 Specification
Microsoft Edge support will launch once spec is ratified
Will enable site login and payment

using 2.x modules can continue to ship with the Creators Update as long as they do not go through a chassis change.
Systems that transition to Kabylake should send in updated IQ results if they are using a MIPI module so we can help ensure the customer experience holds true.
2.x parts that are multi-spectrum capable* can continue to ship on devices without a chassis change through the release after the Creators Update.
3.0 qualified devices may reduce illumination power to meet the 3.1 HW Specification
*For commercial devices, we highly recommend multi-spectrum concurrency on shipping parts to support the enhanced security needs of commercial customers.
No new 2.x submissions will be accepted after 3/1/2017.

all of your devices
Follow the specs and use components from approved IHVs for both face authentication and fingerprint sensors
Design for success
Use the Windows Hardware Guidance for Delightful Face Authentication Scenario 3.x specification and test using the latest Image Quality Testing Guide to plan future systems
Ensure IR modules provide ample IR Illumination for environments with high ambient light
Provide a sufficient field of view (FOV) for quick and natural enrollments and device authentications
Enable concurrent RGB – IR device access support
Migrate to FrameServer based driver designs
Embrace innovation and deliver customer value
Influence future PQL modules by providing Microsoft & your IHVs w/ your design requirements
Ensure sufficient resource and test time is built into system schedules resources/time to meet V3.x spec
Test your device upgrade with Creators Update to verify the driver works with the new driver signing process

apps you create or preinstall to work with Windows Hello anywhere your customer is required to authenticate.
Websites: Start investigations into building a FIDO server that will support password-less login scenarios.
Work with Microsoft to build an end to end proof of concept to demonstrate passwordless authentication for Edge.
Showcase Windows Hello in your marketing communications
In your ads
In your product descriptions & materials
In the retail experience - Now in the Retail Demo Experience (RDX)

Face Authentication Partner Kit
Windows Hello Fingerprint Authentication Partner Kit
Windows Hello Companion Device Framework Dev Kit
Windows Hello FrameServer Implementation Kit
App / Website Developer links
Enabling Windows Hello authentication in your apps
Bring up a FIDO server to support password-less login with Windows Hello
Build a Microsoft Edge proof-of-concept to support Windows Hello
App / Website Developer links
Face Capture Tool
System Functional Test Update
HLK tools
Please provide feedback or questions through Dev Center or contact winhec@Microsoft.com