Oracle Cloud Infrastructure Documentation

Configuring Voice Biometrics

Voice biometrics provides a passive assurance and audit signal during supported speech workflows in Oracle Cloud Infrastructure (OCI) Identity and Access Management (IAM).

How Voice Biometrics Works

Voice biometrics compares a voice sample with an enrolled voiceprint for an authenticated user. The comparison returns a match, mismatch, or inconclusive result.

Enrollment creates the voiceprint after the application provides notice and obtains the user's consent. Verification occurs only during a voice-enabled interaction that the user starts.

Assurance Role

Voice biometrics is an audit-oriented Identity Assurance signal. It isn't an authentication factor, step-up authenticator, account-recovery method, or sole approval mechanism for high-risk actions.

A consuming application can record the comparison result for audit purposes. It can also route a mismatch or inconclusive result to an administrator for investigation.

Privacy Boundaries

Voice analysis applies only to audio captured for a user-visible purpose. Voice analysis excludes always-on microphone access and passive background listening.

Enable Voice Biometrics

Associate a Voice biometric store with an identity domain and enable Voice biometrics.

Configuring Voice Biometrics in IAM

Before you enable the voice biometrics factor, complete the following prerequisites:

  • You must be an identity domain administrator.

  • The voice biometric store must be in the same region as the identity domain's home region.

  • You must update the biometric consent text before enabling the voice biometrics factor.

Associating the Voice biometric store with the identity domain seeds biometric consent. Before you enable Voice biometrics, update the biometric consent text in the Terms of Use section of the Console.

  1. Open the navigation menu  and select Identity & Security. Open the navigation menu  and select Identity & Security. Under Identity, select Domains. Select the domain in which you want to work. Select the Authentication tab.
  2. On the identity domain's Authentication page, enter the Voice biometric store's Oracle Cloud identifier (OCID) to associate the store with the identity domain.
    This creates a biometric consent entry in the identity domain.
  3. In the Console, open the Terms of Use section and update the biometric consent text.
  4. Return to the identity domain's Authentication page and enable Voice biometrics.

Voice Biometric Lifecycle

Voice biometric registration, verification, and unenrollment manage a user's voiceprint.

Register a Voiceprint

After the application provides notice and obtains consent, it submits a qualifying voice sample for the authenticated user. The biometric service creates a voiceprint and associates it with the user.

Verify a Voiceprint

The application submits a voice sample from an authenticated session for comparison with the enrolled voiceprint. The comparison returns a match, mismatch, or inconclusive result.

Unenroll a Voiceprint

Unenrolling from Voice biometrics deletes the user's voiceprint and associated biometric data.

Voice Assurance Flows

Voice assurance flows enroll a voiceprint and generate a passive comparison result during supported speech workflows.

Enroll a User's Voiceprint

  1. The user authenticates to the application and starts a voice-enabled workflow.
  2. The application checks whether the user has an enrolled voiceprint.
  3. If the user has no voiceprint, the application provides notice and requests consent.
  4. After obtaining consent and microphone permission, the application captures and submits one or more qualifying voice samples to the biometric service.
  5. The biometric service creates a voiceprint for the authenticated user. The application confirms with IAM that enrollment is complete.

Compare a Voice Sample with an Enrolled Voiceprint

  1. The authenticated user starts a supported voice-enabled workflow.
  2. The application captures speech and sends voice samples to the biometric service for comparison with the user's enrolled voiceprint.
  3. The biometric service returns a match, mismatch, or inconclusive result.
  4. The application records the result in the audit context for the authenticated session.
  5. The workflow can route a mismatch or inconclusive result for investigation without interrupting the user with another voice challenge.