BOPS – Biometric Open Protocol Standard Emilio J. Sanchez-Sierra

The problem (Introduction) Access control, Authentication and Authorization. At some point in human history, someone was not allowed somewhere (or know something). My house is, well, for me. No one unauthorized should be allowed to enter. The same applies with my car and other possessions that I want secure. The usual way of protecting unauthorized access to my property is by means of a car key. In other words, I possess something that allows me access.

The problem (Introduction) Access control, Authentication and Authorization. In times of war, we have used passphrases to identify allies, even if I have never met them before in my life. They 'knew' something, that asserted in a way, their identity and/or belonging to a group.

The problem (Introduction) Access control, Authentication and Authorization. Problems: Physical Objects can be copied. Passwords can be overheard or inferred. Part of the solution: Multi factor authentication Something you have Something you know

The problem (Introduction) Access control, Authentication and Authorization. The good: Adequate solution for access control. The not so good: Identity assertion.

Biometrics Biometrics is the science of measuring human beings based on unique biological features that are part of our bodies at birth: face, fingerprint, palm print, voice, vein patterns, retinal blood vessel patterns, DNA, retina, and iris. Friction ridges on a finger

Biometrics Consumers, Research and Biometrics 52% of smartphone users want to use their fingerprints instead of the passwords, a further 61% want to use fingerprints to unlock their phones, and 48% want to use eye recognition. Another survey, sponsored by PayPal and the National Cyber Security Alliance, found that 53% of those surveyed are “comfortable” replacing passwords with fingerprints. Also 45% would opt for a retinal scan.

Biometrics Consumers, Research and Biometrics Microsoft Research funded a study that titled “The Quest to Replace Passwords: A Framework for Comparative Evaluation of Web Authentication Schemes”, the cornerstone conclusion of which indicates that the vast passwords replacement transition should conform to the following criteria: nothing to carry, efficient to use, and easy recovery from a loss. The Microsoft study goes as far as concluding such criteria could be achieved mostly in the biometric schemes.

Biometrics Consumers, Research and Biometrics Passwords are not the correct solution for a digital world The first computer password (as far as we known), was deployed in part by Fernando Corbató in the 1960's. The purpose of the implementation of passwords was for "compartmentalization so people didn’t have to live in a communal setting". In other words: Access Control

Biometrics Consumers, Research and Biometrics Unexpected events: Networking Web / Internet Moore's Law

Biometrics Consumers, Research and Biometrics Passwords, it seems, are an artifact of two eras overlapping.

What is BOPS? BOPS stands for Biometric Open Protocol Standard. The purpose of BOPS is to provide an open and biometrics-agnostic multilevel security protocol and platform. In layman terms it allows non technical users interact with a system using multi-factor authentication (one of them being biometrics) that integrates with systems in a simple manner (from a technical point of view).

What is BOPS? During the following explanations, consider the following elements always present. All communications between Devices/Clients and BOPS are done via two way (mutual) SSL authentication. The transport layer of encryption uses 571 bit Elliptic Curve Encryption.

What is BOPS? States: Pre Genesis (prior enrollment) Genesis Post Genesis Components: Client Device BOPS Server

What is BOPS? Pre Genesis: Client Device Contains OTP in the form of certificate for a 1 time 2 way secure sockets layer connection to be used during Genesis. BOPS Server Awaiting connection from Devices for Genesis

What is BOPS? Genesis The client uses the 1 time certificate to establish connection with the BOPS server, the Client submits all uniquely identifying information for the device. BOPS server replies with a new 2-way SSL Key containing identity, a password for encryption and decryption, and a set of values which prevent replay. The user device is considered enrolled at this point and can interact with other services via the use of the API.

What is BOPS? Post Genesis (after enrollment) Client Device Contains new encrypted certificate for 2 way SSL with BOPS Server Encrypted Biometrics BOPS Server Device Information (NO BIOMETRICS, NO KEYS nor other artifacts are stored)

What is BOPS? Implementations of BOPS and Examples Genesis

What is BOPS? Implementations of BOPS and Examples

What is BOPS? Genesis The client uses the 1 time certificate to establish connection with the BOPS server, the Client submits all uniquely identifying information for the device. BOPS server replies with a new 2-way SSL Key containing identity, a password for encryption and decryption, and a set of values which prevent replay. The user device is considered enrolled at this point and can interact with other services via the use of the API.

What is BOPS? Implementations of BOPS and Examples

What is BOPS? Machine enrollment to account

What is BOPS? Login via Push Notification

What is BOPS? Login from device to machine

What is BOPS? Implementations of BOPS and Examples

Thanks you for your attention. Questions?

References: The standard for implementation is BOPS, IEEE specification P Oasis has a similar standard “in process” for Biometric security called Identity Biometric Protocol Standard (IBOPS). We also use this standard for implementation. Some Images taken from