NEC launches digital IDs for 20k employees in Japan using Microsoft Entra Verified ID

Deployment of a digital employee ID that combines face recognition and self-sovereign ID management has started

NEC has newly developed and started deploying a digital employee ID service that combines facial recognition and self-sovereign identity technologies. The new digital employee ID takes the place of a conventional card-type ID and is used as a smartphone application. This service, which was first introduced to employees that work at the company headquarters, will expand to all employees of the NEC Group within Japan, including Group companies, is planned to be used in a variety of ways in the future.

The application, developed by NEC, has wallet functions and stores digital employee IDs, personal attributes, facial recognition data, credentials, and other information. The information stored within the wallet can be used by employees for initiatives such as workstyle reform and DX.
 Regarding actual use of the system, Masumi Imaizumi, Senior Director of Digital ID and SmartWork DX Department gives the following explanation.

"We have already started actual application of the system, using facial recognition information stored in the digital employee ID to enable activities such as passing through security gates to facilities and floors without having to have an ID item on hand. Although NEC had already introduced facial recognition for its headquarters entrance/exit gate, through linking digital employee IDs and facial recognition information with this new service, we aim to rejuvenate communication as employees will now be able to confirm whether a person they are meeting had entered the building or who entered the building at what time, along with each other’s whereabouts. Furthermore, when employees from Group companies exchange business cards, they no longer have to exchange paper business cards but link their digital employee IDs with the business card exchange application to confirm the other person’s name and affiliation. When doing so, they can scan each other’s business card information with QR codes and exchange this as digital information.” (Ms. Imaizumi)

Regarding the facial recognition and self-sovereign ID technologies weaved into the digital employee ID system, Masato Yoshikawa, the NEC Senior Director of Biometrics and Vision AI Department, gives the following explanation.

"NEC has a long history of efforts made in biometrics, starting off with facial recognition. Our facial recognition technology is especially accurate and has achieved first place five times in accuracy evaluations conducted by the National Institute of Standards and Technology (NIST). This technology is being used at many locations, including airports. Meanwhile, in recent years, methods of handling IDs have become important within discussions on privacy and personal information management. Self-sovereign ID is one concept of Web3 and is a mechanism that enables users to manage their own data, without depending on an ID provider, through decentralized management of identity data. It is an important approach in the development of biometrics. For this project, we incorporated this self-sovereign ID and facial recognition into digital employee IDs for practical application.” (Mr. Yoshikawa)

Microsoft Entra Verified ID, Microsoft’s verifiable credential service was adopted for NEC’s digital employee ID initiative, to achieve self-sovereign ID technology.

Employee digital IDs were organized and transferred to digital employee IDs that incorporated Verifiable Credentials

Microsoft Entra Verified ID is one function offered by the ID management cloud service Microsoft Entra (formerly Azure Active Directory). Verified ID is an open standard based verifiable credentials (VC) service for self-sovereign IDs that was officially released in August 2022. 

Regarding the mechanisms of VC, Yuki Arata, Web3 Business Development Group Professional of the NEC Biometrics and Vision AI Department, gives the following explanation.

“VC is one of the technologies promoted by the W3C, which is a standards organization. Credentials are issued to and owned by the credential holder. A verifying organization confirms whether these credentials are valid by querying a trusted credential authentication system. Information necessary to verify credentials are registered in a trusted data registry, which can be made available across service providers. With this, instead of having centralized-type identity management conducted by a designated business, we are able to attain decentralized and self-sovereign-type identity management that enables users with valid credentials to receive specific services and enter restricted areas.” (Mr. Arata)

However, when implementing VC within IC cards or devices such as smartphones, there is still the risk of unauthorized use through borrowing and lending devices, loss or theft, and impersonation by persons who have obtained devices in an unauthorized way. Furthermore, there is still the issue of how to authenticate a person’s identity when communicating critical information between business partners and customers both online and offline. To address these risks and issues, NEC has independently promoted efforts to combine VC and facial recognition.

Takefumi Tozawa, Chief of the Digital ID/Workstyle DX Development Group of the Digital ID/Workstyle DX Department explains about NEC’s efforts up to the utilization of VC.

"Our efforts for digital identification, focused on facial recognition, started from demonstration experiments at the NEC headquarters building in 2020. Full-fledged operation started in 2022 at offices and places used for co-creation. Digital ID issuing started with 600 people and expanded to approximately 20,000 domestic employees by 2023. During this time, we achieved access control to buildings and floors, along with cashier-less payment at in-house stores using facial recognition. However, although we had organized digital IDs for employees, the method of management was still centralized, and their IDs were still in a card form. Going forth, there was a need for a new system that offered safe connections to continue co-creation activities with customers and partners using digital IDs. Therefore, from April 2023, we launched the headquarter-wide ‘NEC Digital ID project to establish cardless employee IDs and migrate to digital employee IDs that utilize VC and started our digital employee ID service from 2024.” (Mr. Tozawa)

The Microsoft Entra Verified ID was the most trusted service as we promoted our “Client Zero” initiative

The migration of NEC to cardless and digital employee IDs that utilize VC was born from three co-creation activities within and outside of the company.

The first was the workstyle DX with digital IDs, led by Ms. Imaizumi. The second was the initiative regarding face recognition and self-sovereign IDs led by Mr. Yoshikawa, and the third was the incorporation of Microsoft Entra Verified IDs based on our partnership with Microsoft. Mr. Yoshikawa talks about NEC’s in-house efforts.

“Based on the concept of ‘Client Zero’, which has NEC as the initial client, we initially apply the latest technologies within our own company to accelerate the internal DX. The expertise and know-how obtained through this process is provided to customers to attain their DX and in turn, create values for society. The foundation for facial recognition and digital IDs have all been practiced as a shared platform and is currently being provided to customers as NEC’s digital ID service. For this project, Ms. Imaizumi and her team have promoted cardless employee IDs for workstyle DX. The experiences acquired through this application have been put to use and improved within our self-sovereign ID initiatives, and these efforts have created products that are offered to customers. I believe we can say that this initiative embodies NEC’s ‘Client Zero’ concept in the sense of efforts made across departments and combining the expertise of each group in NEC and providing values from a customer perspective.” (Mr. Yoshikawa)

Additionally, Ms. Imaizumi talks about their partnership with Microsoft.

“We have a 40-year history of collaboration with Microsoft, and we hold a high level of trust toward their technology. Our relationship is that of cooperating to develop, verify, and promote the use of new technologies whenever they emerge. When developing digital employee IDs as well, we had great expectations toward taking on the challenge of developing a completely new service through incorporating the Microsoft Entra Verified ID as one of the most advanced technologies.” (Ms. Imaizumi)

NEC had initially been promoting efforts to use VC with self-sovereign ID and biometrics and adopted Microsoft Entra Verified ID. Mr. Arata explains about the background and reasons for adopting this service.

“Microsoft had been making efforts in VC from a very early stage and had also been making major contributions to promote W3C standardization. Although various vendors have been working on VC implementation, none of them had been engaged in development on the scale of Microsoft. The fact that this was the most trusted system when developing in-house from a Client Zero perspective, and the fact that continuous support was available when developing into a commercial service were decisive factors.” (Mr. Arata)

Microsoft’s support resolved issues in technology and response capabilities when looking toward service expansion

There are several issues that NEC sought to resolve with Microsoft Entra Verified ID.

The first was the workload increase with the change of services for implementation to accommodate specification modifications and other adjustments. As we are working with new technologies, we can expect more changes in specifications in the future. Adopting Microsoft Entra Verified ID, which contributes to W3C specification development and provides services as PaaS, enabled us to reduce such workloads and swiftly develop the service infrastructure and focus on application development.

Ensuring performance with an increase of users was also an issue. With VC, for example, queries and verifications are made from the credential holder to the verifying organization each time business card information is exchanged using digital employee IDs. There is a need to manage the infrastructure and tune performance to process an enormous amount of requests. For this reason, we decided that it would be more efficient to use services from a trusted partner than to implement our own.

Furthermore, there was the difficulty of keeping up with swiftly-evolving technology with only human resources from our company. Through cooperation with Microsoft engineers, who are also involved with specification development, we thought it would be easier to stay updated with the latest information and technology.

According to Mr. Tozawa, these issues were resolved as development using Microsoft Entra Verified ID proceeded with support provided by Microsoft.

“In terms of workstyle DX, verification speed is very important. Needing to wait for many seconds just to exchange employee IDs does nothing but cause stress. When we consulted Microsoft about this, they gave us advice regarding processing sequences and responded by changing the location and structure of the data center that provided services, among other measures. Due to this, what initially took eight seconds to process was decreased to under three seconds. Their support system was very reassuring as well, offering support from Japan along with support from each base such as Israel and the UK by engineers involved with the development of Microsoft Entra Verified ID. We also received a SDK to use in wallet application development and advice to use the Azure App Service to link data with NEC human resource information. Thanks to their generous support, we were able to smoothly and swiftly incorporate Microsoft Entra Verified ID within our digital employee IDs.” (Mr. Tozawa)

The digital employee ID system is constructed by three major components: The NEC proprietary facial recognition service “NEC Bio-IDiom Services”, Microsoft Entra Verified ID for verificable credential management, and the NEC wallet application “ID Card Holder” to store the digital employee IDs. Not only did Microsoft provide their Microsoft Entra Verified ID, they offered comprehensive support for the development of our digital employee ID system through providing component linkages, SDKs, and related Azure services. The digital employee ID was born through co-creation and the combination of NEC and Microsoft technologies.

The use of Verifiable Credentials for workability and diversity, and acceleration of Verifiable Credentials initiatives toward social implementation

Digital employee IDs have been deployed to approximately 20,000 NEC employees in Japan. Ms. Imaizumi talks about the current situation and future prospects.

“We intend to first deploy the system to headquarter employees, and sequentially expand to other bases including the Tamagawa Office and Fuchu Office, and onwards toward domestic Group companies as well. The Tamagawa Office is a place for various customer collaboration, and we will make use of digital IDs there. Moreover, we are engaged in operations related to defense at the NEC Fuchu Office, and this calls for highly confidential authentication processes such as multiple IC cards and fingerprint verification. In cases like this, we believe that both security and convenience can be achieved by combining authentication elements such as fingerprint and iris recognition in the wallet application. Furthermore, in addition to biometrics, various verification methods can be used with VC, including those that call for confidentiality, including one’s medical and disease history and proof of disability. This enables us to strive for workability and diversity while managing information based on the person’s preference. We are aiming to develop the digital employee ID to become an authentication technology that can contribute to such a society.” (Ms. Imaizumi)

In addition to highly confidential information, verifiable credentials can store information that is beneficial when released to others within and outside of the company, such as skills and qualifications. Mr. Yoshikawa sees a future with Verified ID, including the prospect of creating services from Client Zero initiatives.

“Currently, the digital employee ID service is for employees, but we will be able to issue this to NEC partners and customers in the future. Having employees prove their skills and credentials to partners and customers will improve services provided and be beneficial to one’s own career. Furthermore, as VC spreads out within society, we will be able to use it for security checks at airports and concert halls, issue coupons with authentication, and implement loyalty programs as well. As a matter of fact, efforts have started to apply the VC mechanism to overseas airports that have incorporated the NEC digital ID system. As this mechanism is one that works in other countries as well, there is also the advantage of having various VC services, including digital employee IDs, being globally applied. We believe that self-sovereign ID, including VC, has great potential to change our society. NEC participates in various consortiums toward social implementation and aims to contribute toward society by creating services out of Client Zero initiatives.” (Mr. Yoshikawa)

As a partner of NEC, Microsoft provides its Microsoft Entra Verified ID and supports their efforts toward workstyle DX and social contributions that apply NEC’s cutting-edge technologies.