# BioShare: An Open Framework for Trusted Biometric Authentication under User Control
## 1 Introduction  
With the prevalence of smartphones and e-commerce, biometric identification technologies are widely used by service providers and are favorably accepted by most consumers. Fingerprint identification and face recognition have become standard features on most Android and iOS devices, and payment platforms based on facial recognition are increasingly popular in countries such as China. Meanwhile, privacy protection has become a serious topic and is attracting comprehensive attention from scholars and governments. The European Union released the General Data Protection Regulation (GDPR) [1, 2, 3] in 2018, the United States issued the California Consumer Privacy Act (CCPA) [4, 5] in 2018, and China published the Personal Information Protection Law (PIPL) [6] in 2021. Google, Facebook, British Airways, and many other companies were fired for data leakage, unauthorized usage, and other data issues. We are currently faced with the dilemma between data usage and privacy protection, and we need a technical solution to achieve both goals within the same framework. Currently, there are two types of solutions available: local processing solutions and centralized-processing solutions. The former method is to process and store personal biometric data in local trusted environments integrated in personal mobile terminals, and the representative implementations include Apple Touch ID/Face ID and Windows Hello. Through local trusted computation, each user has full control of his/her biometric data without the risk of privacy leakage, but authentication services are restricted onlyto local mobile apps. As such, the services are secure but not open. The latter method uses a centralized system to collect and process biometric data in centralized-processing mode on public servers, and typical application scenarios include many payment platforms based on facial recognition, as described in Section 2.3. With the help of powerful servers, service providers can provide open biometric authentication services to various network applications efficiently. However, when raw biometric data or extracted feature data are stored by service providers in their database servers, users are put at risk of privacy leakages due to improper maintenance or malicious attacks. While user biometric data are fully controlled by service providers without strict regulation and independent audit, users have no control of their private data and are faced with the abuse of personal data. As a conclusion, the first method is secure but not open, while the second method is open but not secure. We need a framework that provides both secure and open biometric services. In this paper, we propose BioShare, a framework that provides both secure and open biometric services.To achieve this goal, we store and process biometric data in secure environments (terminal TEEs and server enclaves) to ensure security, and we coordinate the terminals and the servers to provide open services for network applications. Our framework is designed around three key principles:  
**a. Each user has full control of his/her biometric data. ** Biometric services are provided in either forwarding mode or authorized mode. In the forwarding mode, personal biometric data are stored in the user's terminals. In the authorized mode, biometric data are temporarily stored in the server enclave under user authorization, and users can cancel the authorization at any time. Both modes ensure users have full control of their private data. **b. Open bioauthentication services are efficiently provided to network applications. ** We design standard interfaces for biometric services, develop service request handler modules running on the server side, and provide open services to network applications. **c. Biometric data are stored and processed in trusted environments to prevent privacy leaks. ** On the terminal side, we use Trusted Executive Environments to protect biometric data. On the server side, we use enclave technologies to ensure data security.