Token or No Token: Bringing Sanity And Order To The World of Identity Assertion

By: Hector Hoyos, Chairman and CEO Hoyos Labs

It is said that the definition of insanity is doing the same thing over and over again, expecting a different result every time. I feel that this is the direction into which the identity assertion industry is headed-into the realm of insanity.

A few years ago, in 2010 I deployed the world’s first completely iris-based access control system at Bank of America Headquarters in Charlotte, North Carolina. It was based on the original proprietary technology and products, the HBOX and Eyelock, that I invented at the company I founded Global Rainmakers, Inc., now known as Eyelock Corp. It was true sights of beauty to see thousands upon thousands of Bank of America (BAC) team members gain entry to their workplaces all around the city of Charlotte with nothing more than a glance of their irises. Yes, that is correct, no tokens or access cards of any kind were used, and yes this was the HQ of one of the largest financial institutions in the world. It took us nearly 3 years to achieve such milestone. That deployment in the Summer of 2010 reshaped the face of the access control and the biometrics industries.

Yet today, 3 years later, like the setback that general aviation suffered when the Condorde was removed from service, it appears that both industries have forgotten the lessons learned from that BAC deployment.

One word defines all those lessons: CONVENIENCE. Back then there was a single paradigm that drove the success of that deployment and every other successful deployment across the world: CONVENIENCE. Think about this for a minute. If you knew that it was as safe as using your access card, would you rather not have to carry an access card and just use what you never leave home without, your iris-biometrics? Well, a good portion of the folks at BAC at first did not accept our Iris systems, voicing many concerns over privacy and data security; however, all those concerns were quelled upon seeing their co-workers waltz into the building right through the access points, without having to dig into their wallets or purses to pull out an access card. I was a personal witness to this. I wanted to understand the human behaviors factor in all that we were doing. It turned out to be The key element in the success of our deployments.

I remember an exchange I had with a very nice lady who worked at BAC HQ in Charlotte. She was holding a cup of coffee in her left hand, her bag and coat in her right hand, and had files tucked under her right arm. I glanced at her and very quickly inquired what she thought of my irisgate. “ Look at me, are you kidding, its as CONVENIENT as a fast food drive-through,” she responded. There it was! After all the years of R&D and the tens of millions invested, after all the long hours discussing the sleek look of the housing, after all the science and

1

technology innovation accomplished, it was best summed up from a real world user and her 20 second experience-what the user wants, recognizes, cares about, and remembers is the CONVENIENCE. I felt like a famous producer at the premiere of his hit movie, except that my premiere only lasted 20 seconds. Then I glanced back across the lobby of this fantastic Gold Leeds structure BAC built in the center of Charlotte, and felt a warm fuzzy feeling as I saw hundreds of additional users take for granted what everyone had originally thought to be impossible, daunting, unacceptable-token-less iris-based access.

Fast-forward 3 years. I am reading a Forbes article about Google introducing Google ID in 2014. Hmm, Interesting. As I progress through the article the more confused and perplexed I become. Google is proposing a 2-factor authentication system (2FA) using a username, a pin, plus a Yubikey token that connects to the USB port of your computer. Wow! What just happened? Had I gone back in time unknowingly? I knew Google was a member of the FIDO (Fast identity Online) Alliance, which supports biometrics in combination with a similar token. Yet now they had changed their minds and decided to completely drop biometrics?

To begin with, like many, I never agreed with the flawed proposition of the FIDO Alliance requiring carrying a physical token to identify you. For years I had spread the “gospel of biometrics according to Hoyos”, in which I predicted that at some point in the near future we would have to drop usernames, passwords, and pins, and that all of them would be replaced with biometrics on mobile devices-smartphones to be precise. Many of my writings throughout the years pointed in this direction. The main reason I pointed to smartphones as the biometrics acquisition tool is because of the issue of CONVENIENCE. Its something we always carry that we cannot do without, not an extra something. Many folks over the years, in both the private and public sector, discounted my position of a world in which all identities will be asserted by means of our biometrics, simply telling me that passwords would never go away, even though they had nothing to back their position other than their corporate opinion. I based my position on facts stemming from my real world experiences.

Today, I feel vindicated, because it is no longer the “gospel of biometrics” or even the “gospel of CONVENIENCE” according to Hoyos that is sending the message out to the world. Today, studies abound from Ericson, Paypal, IBM, Microsoft, and the Ponemo Institute that say exactly what I have been saying for the last 10+ years.

According to Ericson’s study titled: “Your Body The New Password”, 52 percent of smartphone users want to use their fingerprints instead of passwords, a further 61 percent of people want to use fingerprints to unlock their phones, and 48 percent are interested in using eye-recognition.

Another study by Paypal shows that consumers “are OK” with biometrics, and that 53 percent of those surveyed are “comfortable” replacing passwords with

2

fingerprints, and 45 percent would opt for a retinal scan. I’m sure they meant an iris scan, which shows how successful the biometrics industry has been educating consumers about types of biometrics.

IBM Fellow and Speech CTO David Nahamoo states that over the next five years, your unique biological identity and biometric data – facial definitions, iris scans, voice files, even your DNA – will become the key to safeguarding your personal identity and information. and replace the current user ID and password system.

Microsoft Research funded a study titled “The Quest to Replace Passwords: A Framework for Comparative Evaluation of Web Authentication Schemes.” Among its main conclusions they state that the replacement to passwords should conform to the following criteria: nothing to carry, efficient to use, and easy recovery from loss. They go so far as to state that these criteria are achieved mostly by biometric schemes, and further state that tokens do NOT achieve this.

After reading this I was really confused, because as Google did before, Microsoft had also joined the mighty ranks of the FIDO Alliance. Yet FIDO’s standard identity authentication protocol requires the use of a Yubikey token, but Microsoft Research’s Cormac Herley in Redmond placed his name representing Microsoft Research on the study cited above. So which is it: To use a token or not to use a token? Is Microsoft going against their own study because they don’t believe in its results or have they lost faith in biometrics at a time when the overwhelming majority of consumers are clamoring for biometrics to replace their usernames and passwords?

What makes a company and a product successful is the adoption and continued support by consumers of its offerings. If there is something I have learned in all my years in the technology business is that this is an absolute truth. Consumers rule!!! Consumers the world over, all want the same thing: CONVENIENCE. Sure they want to be secure, but NOT at the cost of their CONVENIENCE. Any proposed scheme by any company or Alliance that intends to go against the grain of consumers in this sense will fail. So there it is, I just predicted the fall of the FIDO Alliance, as well as anyone else that attempts to architect and engineer an inconvenient identity authentication process. So much for swinging at windmills! Yet this time I am armed with something called HoyosID.

3

HoyosID is an identity assertion platform, which utilizes your smartphone as the biometrics acquisition device by using an app, which runs on Iphone and Android.

The HoyosID Identity Assertion Platform leverages all available resources to secure the digital access management in a unique, convenient, and secure way. If you don’t want to use usernames and passwords, and securely login with your biometrics, HoyosID will facilitate such for you. You simply click on the login in a web page, which awakens the HoyosID app on your smartphone, you look at it, it acquires your biometrics, and logs you in. If you are not you, then our IDS (Intrusion Detection System) will block your smartphone and you. To hack you, someone must first appropriate your smartphone, and then attempt to hack it. So the HoyosID architecture effectively forces hackers to have to attempt hacking a user at a time. Gone will be the days of massive attacks that affect multitudes of consumers from a single breach.

At Hoyos Labs we have invested most significantly into spoofing counter measures development. Spoofing is passing an authentication on the digital systems using a false credential that seems to be valid of an actual user registered in the system, such as a high-resolution photograph of you. Liveness detection counter measures are how the mobile application could recognize a live person from decoy images.

HoyosID also prevents replay attacks, which is when someone attempts to “inject” a recording of yourself into the system as someone else.  HoyosID employs 2-way SSL to connect to the server that uses IDS and proprietary algorithms for encryption. The IDS identifies the attempts to replicate timestamp and blacklists the offending devices quickly and permanently.

A very critical differentiator to HoyosID is that it provides a Biometrics Open Protocol Standard (BOPS), which is an open source API that enables the integration into the HoyosID identity Assertion Platform of any third party biometrics solution in the market. Yes we did! 3rd party. So if you want to use your fingerprint through your Iphone 5S or the Samsung with iris identification, when available, on the HoyosID Platform, you could do that. The HoyosID platform through BOPS enables the interconnection to it of any device that opens, closes, and turns on or off, to be controlled with any biometrics device(s) that communicates through it.

In HoyosID there are no biometrics stored anywhere, except in your smartphone, and in an encrypted mode. When the SSL private key is generated it is done by the server and not the device, and is not stored anywhere, since its lifetime is limited to a few seconds. The IDS and HoyosID proprietary algorithms that work in the back-end allows detecting the real user from someone who tries to impersonate you over the network. The HoyosID Identity Assertion Platform

4

currently runs on Amazon Web Services for its server, which uses proven cryptographic methods to secure its infrastructure.

Users will soon be able to download the HoyosID Identity Assertion Apps at no cost to them, for use in their Iphones or Android phones from the Google Play Store and Apple’s App Store in the first quarter of 2014. Hoyos Labs’ HoyosID will initially support iPhone, Samsung Galaxy S4, Galaxy Note 2, and as well the HTC One. Those who think of themselves as my competitors will most likely dismiss me; however, I place my Faith in the hands of consumers who rule. It’s a brand new identity assertion world.

5