Abstract

This specification defines a standardized framework for the Human Centric management of biometric information (data), ensuring personal ownership, secure storage, and permissive discoverability and usage through privacy-preserving technologies. Leveraging semantic web standards (excluding OWL and Schema.org), it enables interoperable, secure, and user-controlled biometric systems that uphold the inalienable nature of biometric data as an extension of personal identity. The framework supports use cases in justice, healthcare, and identity verification while prioritizing privacy, security, and individual autonomy.

Status of This Document

This is an unofficial draft specification intended for community review and feedback. It has not been endorsed by any standards body and is subject to change based on further development and input. Contributions and issues can be submitted via the GitHub repository.

Introduction

Biometric data, such as fingerprints, facial recognition patterns, and iris scans, are unique identifiers inherently tied to an individual’s identity. As digital transformation accelerates, the management of biometric data raises significant concerns about privacy, security, and personal autonomy. Centralized systems often undermine individual control, increasing risks of misuse, unauthorized access, and data breaches.

This specification proposes a decentralized framework for biometric data management, where individuals retain ownership and control over their data, recognized as an inalienable extension of self. By utilizing semantic web standards (specifically RDF Schema and SPARQL extensions, excluding OWL and Schema.org), decentralized storage technologies, and cryptographic methods like zero-knowledge proofs, this framework ensures secure storage, consent-based discoverability, and privacy-preserving usage.

The framework aligns with human rights principles (e.g., UDHR, Article 12) and philosophical considerations of personal identity and autonomy, ensuring that digital transformation upholds the sanctity of natural persons.

Terminology

Biometrics

Unique physical or behavioral characteristics used for identification, such as fingerprints, facial patterns, or voiceprints.

Personal Data Store (PDS)

A secure, encrypted storage location controlled by an individual, hosting their biometric data.

Decentralized Storage

A method of storing data across multiple locations without reliance on a central authority.

Zero-Knowledge Proofs (ZKP)

Cryptographic techniques that allow verification of information without revealing the information itself [[ZKP]].

Linked Data

A method of publishing structured data to be interlinked and queried using semantic web technologies.

SPARQL-MM

An assumed extension of SPARQL for querying multimedia data (to be defined if not standardized).

SPARQL-Fed

A mechanism for executing SPARQL queries across distributed endpoints [[SPARQL11-FEDERATED-QUERY]].

Architecture

The decentralized biometrics system is built on a distributed architecture where biometric data resides in individual Personal Data Stores (PDS). No single entity controls the data, and access is granted only through consent-based mechanisms.

Data Model

The data model is defined using RDF Schema (RDFS), a lightweight semantic web standard for structuring linked data. This model excludes OWL and Schema.org as per requirements.

@prefix rdfs:  .
@prefix db:  .
@prefix dct:  .

db:BiometricRecord a rdfs:Class ;
    rdfs:label "Biometric Record" ;
    rdfs:comment "A record containing biometric data and metadata for an individual." .

db:hasBiometricData a rdfs:Property ;
    rdfs:domain db:BiometricRecord ;
    rdfs:range db:BiometricData ;
    rdfs:label "has biometric data" ;
    rdfs:comment "Links a biometric record to its biometric data." .

db:BiometricData a rdfs:Class ;
    rdfs:label "Biometric Data" ;
    rdfs:comment "The actual biometric data, such as a fingerprint or facial scan." .

db:owner a rdfs:Property ;
    rdfs:domain db:BiometricRecord ;
    rdfs:range db:Person ;
    rdfs:label "owner" ;
    rdfs:comment "Identifies the individual who owns the biometric record." .

db:Person a rdfs:Class ;
    rdfs:label "Person" ;
    rdfs:comment "An individual who owns and controls a biometric record." .

db:consent a rdfs:Property ;
    rdfs:domain db:BiometricRecord ;
    rdfs:range db:Consent ;
    rdfs:label "consent" ;
    rdfs:comment "Links a biometric record to its consent policy." .

db:Consent a rdfs:Class ;
    rdfs:label "Consent" ;
    rdfs:comment "A policy defining access permissions for a biometric record." .

db:created a rdfs:Property ;
    rdfs:domain db:BiometricRecord ;
    rdfs:range dct:created ;
    rdfs:label "created" ;
    rdfs:comment "Timestamp of when the biometric record was created." .
        

This model supports extensibility for additional metadata, such as guardianship details or data provenance.

Storage

Biometric data is stored in a decentralized manner using technologies like IPFS or blockchain-based solutions. Each PDS is encrypted, with access restricted to the owner or authorized guardians.

• IPFS Integration: Biometric data is encrypted and stored on IPFS, with content hashes recorded on a blockchain for integrity.
• Encryption: Data is encrypted using AES-256 or equivalent standards for both at-rest and in-transit protection.
• Access Keys: Cryptographic keys are managed by the individual or their guardian, ensuring exclusive control.

Implementations MUST ensure that no unencrypted biometric data is accessible outside the PDS.

Discoverability and Usage

Discoverability and usage are enabled through semantic web querying standards:

• SPARQL-MM: Supports queries over multimedia biometric data (e.g., facial recognition patterns). If not standardized, implementations SHOULD define a compatible extension.
• SPARQL-Fed: Enables federated queries across PDSs, allowing authorized parties to search without centralizing data [[SPARQL11-FEDERATED-QUERY]].

Example SPARQL query to locate biometric records with specific attributes:

PREFIX db: 
SELECT ?record
WHERE {
    ?record a db:BiometricRecord ;
            db:hasBiometricData ?data ;
            db:consent ?consent .
    FILTER (?consent = "authorized")
}
        

Access is controlled via the Consent Manager, ensuring data is shared only with explicit permission.

Privacy and Security

Privacy and security are foundational:

• Zero-Knowledge Proofs: Enable verification without exposing raw data (e.g., proving a fingerprint match without revealing the fingerprint) [[ZKP]].
• Encryption: All data MUST be encrypted using standards like AES-256.
• Consent Enforcement: Cryptographic signatures or smart contracts ensure data access aligns with user consent.

Implementations MUST protect against unauthorized access and data breaches.

Guardianship

For individuals unable to manage their biometric data (e.g., minors, individuals with disabilities), a guardianship mechanism is defined:

• Authorization: Guardians are designated through secure, auditable processes (e.g., legal documentation or multi-party consent).
• Accountability: All guardian actions are logged on a blockchain or similar immutable ledger.
• Revocation: Individuals or legal authorities can revoke guardianship, transferring control back to the owner.

Implementations SHOULD provide user-friendly interfaces for guardianship management.

Use Cases

• Justice and Law Enforcement: Biometric data access for identification, requiring a warrant or explicit consent.
• Healthcare: Secure sharing of biometric data for personalized treatment, with patient consent.
• Identity Verification: Privacy-preserving authentication for services like banking or travel.

Conformance

As well as sections marked as non-normative, all authoring guidelines, diagrams, examples, and notes in this specification are non-normative. Everything else in this specification is normative.

The key words MUST, MUST NOT, SHOULD, and MAY are to be interpreted as described in [[RFC2119]].

An implementation conforms to this specification if it:

• Implements the RDFS-based data model (Section [[[#data-model]]]).
• Stores biometric data decentrally (Section [[[#storage]]]).
• Supports discoverability and usage via SPARQL-MM and SPARQL-Fed (Section [[[#discoverability]]]).
• Employs zero-knowledge proofs for privacy-preserving verification (Section [[[#privacy-security]]]).
• Adheres to privacy, security, and guardianship requirements (Sections [[[#privacy-security]]], [[[#guardianship]]]).

Security Considerations

Implementations MUST address the following risks:

• Data Breaches: Robust encryption and decentralized storage mitigate unauthorized access.
• Misuse of Biometrics: Consent enforcement prevents unauthorized usage.
• Key Management: Secure key storage and recovery mechanisms are critical to prevent loss of access.

Privacy Considerations

Biometric data is highly sensitive and inalienable. Implementations MUST:

• Minimize data exposure using zero-knowledge proofs.
• Ensure explicit consent for all data access.
• Comply with privacy regulations like GDPR.

References