Smart biometric template storage often requires a hybrid approach

One of the key issues that comes up when talking with leaders in the biometric security space is around who owns and where to store the biometric data — particularly face authentication templates with the mathematical details of a person’s face. Should they be kept in the cloud or stored locally?

For context, I think it is safe to say that the use of biometrics to manage authentication and identification across the globe is only going to increase. Of course, biometric data runs the gamut, covering anatomical data from fingerprints to voice scans to face profiles. We also need to keep in mind that this is a constantly evolving field and technologies developed today will most likely morph and change in the years ahead. But the challenge will be how to safely and securely manage and protect this kind of data.

Biometric identification historically has required a centralized database which allows the data of several persons to be compared allowing an accurate decision to be made. “Yes, it is person A” — or it is not. One of the challenges of an identification process requiring an external database is that the user does not have physical control over their biometric data, with all the privacy questions and possible security risks which that brings.

Biometric authentication can in fact be delivered without such a centralized database. The data can simply be stored on a local device, such as on a smartphone, laptop or tablet, such as Apple and SensibleVision have done for their consumer-oriented face authentication. A decentralized storage with full user control of the biometric data on the device may be preferred. For users, such a method inherently involves less risk as the hacker must breach each individual device. This alone is a powerful benefit given the increasing frequency of large-scale data hacks which compromise centralized password and face recognition repositories.

Source: Pixabay

Today, policies related to storing and managing biometric data are still being defined. The recently enacted GDPR laid out some initial guidance, defining biometric data as “special categories of personal data” and prohibiting its “processing.” The objective is to protect people from having their information, including data like face templates, shared with third parties without their consent.

The best solution for biometric data management could be a secure hybrid storage approach. But it needs to be driven by use cases. There is biometric data that can be stored locally, but then shared with authorized other devices. The user always maintains control of their biometric templates. For example, you can easily store a biometric face template on a smartphone. There is no reason to have it in the cloud. The exception might be if you wanted to set up an enrollment profile that could recognize you in many different settings. You would first enroll on your phone and then be able to open the doors of your home or office with your face, all without re-enrolling.

In other situations, users might find be willing to have their face profile data in the cloud — having a provider assume the responsibility and the risk of protecting their data, for example, to gain easier access to airport screening. When stored in the cloud, there is always the risk of having your biometric data compromised by hackers — a scenario we are seeing all too often these days. On the other hand, sometimes speed and convenience offsets some of the potential risks.

The bottom line is that there is no single right answer. As in every situation where business is trying to figure out how to exploit a leading-edge technology, there are pros and cons. Developing a viable biometric data strategy will require companies to determine what makes it easy for customers to interact, as well as feel their data is secure. And then use that insight to define the best approach for storing biometric data, including face templates, on either a user’s individual device at the edge of the network or in a centralized database that they monitor and manage.

All IoT Agenda network contributors are responsible for the content and accuracy of their posts. Opinions are of the writers and do not necessarily convey the thoughts of IoT Agenda.