Up until now, there was no industry standard in place to protect data once it leaves a device and enters the cloud. But that seems to be changing as Hoyos Labs unveiled the formalization of its Biometric Open Standards Protocols (BOPS).
BOPS consists of a set of rules that govern secure communications among a variety of client devices including mobile phones, desktop computers and ATMs, among others, and a trusted server managing the acquisition and manipulation of biometric data captured by those devices.
The BOPS guidelines make use of The U.S. Department of Defense’s Trusted Computer Systems Evaluation Criteria (TCSEC) and are biometric agnostic.
“Nearly every smartphone, digital device or computer system that has a financial component to it will have a biometric component built into it in the very near future. The concerns about fraud, hacking and personal privacy have created a tidal wave of momentum on this front,” said Hector Hoyos, chief executive at Hoyos Labs.
“Now, securing all of the biometric data that’s being generated is of the utmost importance. As with every major technological breakthrough, a series of accepted standards and protocols must be widely adopted from the manufacturer and database management end before consumers can fully be comfortable. BOPS are those standards and protocols,” Hoyos added.
The BOPS system addresses the five most widely recognized key security consideration components:
• Identity assertion – The BOPS identity assertion platform provides a guarantee that named users are who they claim to be. The identity assertion implies reliance on human biometrics; however, the BOPS is an interoperable standard and can incorporate any identity asserter, or a number of asserters, that provides this guarantee.
• Role gathering – Role gathering focuses on the data confidentiality and privileged access based on the rules enforced by a known system. To determine whether a specific access mode ends up allowed, the privilege of a role compares to the classification of the group to determine if the subject has authorization for a confidential access.
• Access control – The BOPS supports access control between the named users and the named objects (e.g., files and programs). The adjudication mechanism is role-based and allows users and administrators to specify and control the sharing of those objects by named individuals, or defined groups of individuals, or by both.
• Auditing – The BOPS supports all auditing requests at the subject/object level or at the group level. The BOPS uses Aspect Oriented Programming (AOP) to ensure all calls end up safely written to an audit trail. A RESTFul web services and JSON interface provides a mechanism to read the audit trail.
• Assurance – The auditing of all BOPS specifications and proof of the security model to prevent a system from unknowingly ending up compromised.