How Can Anonymous Biometric Verification Protect Your Identity?

masked_man_smallOne of the great things about living in Portland, Oregon—other than being a member of ImageWare’s software development team of course—is the ubiquitous Portland summer barbecue. Since we spend most of the winter and spring inside, getting outside and enjoying the sun is a key part of summer. At those barbecues, the conversation often turns to “what do you do” and when I start talking about multi-modal biometric authentication, the response is usually pretty typical: “Biometrics instead of passwords? That’s great! But wait, are you saying now my biometrics can get stolen? That’s actually kind of scary!”

Actually, with ImageWare’s biometric identity management, it’s not scary, but it takes some explaining before most people get why that is. With all the reports of identity theft—millions of credit card numbers stolen from Target, billions of Internet passwords stolen by Russian gangs—it’s no wonder people are worried about the safety of their most precious credential: their biometrics, which make up who they are. Before the conversation turns to a dystopian future of zombie robot clones wandering the world with stolen fingerprints and irises, I grab another microbrew and stage an intervention.

So why won’t your biometrics get stolen as easily as your password that combines the name of your cat with the last four digits of your phone number? Because with ImageWare’s biometric data management, your biometrics are verified anonymously. That means that the biometrics are enrolled, matched, and stored separately from the person with whom they correspond.

What does this mean? Let’s say you’re opening an account at Moderno National Bank. As part of the account setup process, Moderno National enrolls your face and voice for security. You will use this to log in on future visits.

Behind the scenes with ImageWare’s CloudID® servers, your face and voice are converted to digital representations called templates—things such as voice pitch and measurements between facial features. Then, a randomly generated globally unique identifier (called a GUID) is assigned and is stored with the templates in an ImageWare CloudID database. There is no reference to any biographic information about the person a specific biometric represents.

Meanwhile, that GUID is also assigned to the identity information, such as your user name and account number. The information is stored in a separate database with no reference whatsoever to the biometric information. The only thing linking the items is that they have the same random 32-digit hexadecimal number.

The next time you come into Moderno National, you log in, say your voice password, and allow a photo to be taken of your face. These new biometrics are submitted to the CloudID database along with the GUID and are verified against your enrolled template. Simultaneously, the user ID is verified against its database, using the same GUID.

Since the databases are separate and linked only with a randomly generated number, anyone who managed to hack into the biometric database could only ever retrieve a lot of biometrics with no link to who they correspond to. In case you were wondering, there is no black market value for a stash of unknown faces and voices.

So in short, someone who wanted to steal biometric information and work out who those biometrics correspond to, would not only have to hack two incredibly secure databases, but also sort through two puzzles with 5.3 sextillion pieces and match up the pieces. I suppose nothing is impossible, but that sounds pretty daunting.

It’s important to note that the concepts of anonymous enrollment, anonymous verification, and anonymous verification are unique to ImageWare. No one else provides this level of security, and with patents pending, no one else can provide it.

Secure storage, separation of identity and biometric, multi-modal biometrics, and three-factor verification; these are what make ImageWare’s solution a truly secure method of authentication. There are no guarantees that we’ll avoid a robot zombie invasion, but with ImageWare’s solution, I like our chances of survival.