The horcrux protocol: A distributed mobile biometric self-sovereign identity protocol

Abstract

Deployed mobile biometric authentication systems rely on mobile- or server-centric models. However, both model schemes present a single point of biometric data compromise from a security perspective. If biometric data is compromised, it poses a direct threat to users’ digital identities. A recent example of compromised biometric data includes the stolen database of fingerprint images in the US Office of Personnel Management breach of 2015. This chapter proposes a distributed identity authentication protocol, called the Horcrux protocol, in which there is no such single point of compromise. The protocol relies on two standard efforts, the IEEE 2410-2017 Biometric Open Protocol Standard (BOPS) and the decentralized identifiers (DIDs) standard which is under development by the W3C Verifiable Claims Community Group. To accomplish this, we propose specification and implementation of a decentralized biometric credential storage option utilizing the concept of self-sovereign identity using blockchains.