Description (User Story)

This user storey shows the user proving that they are present at the the device that is making a presentation to the Verifier without releasing any user biometric information from the device.

Narrative

The user has performed some sort of biometric identification to the Device (such as a face or digit scan) that unlocks the device's ability to authenticate the user. The user taps the device on a verifier and is then asked if it is ok to release information the the Verifier as displayed on the Device's screen. The user makes some gesture that allows the requested data to be released to the Verifier. The user is admitted (or not) to the place that they are trying to enter.

Actors

• The User and Holder will typically be the same person and so the proof generated by the Device is typically just that the two are verified by the Device to be the same individual (i.e. that the person in possession of the Device (the User) is the known Holder of the Device.)
• Proof of presence and notarization provide the same sort of abstraction, some sort of legally mandated evidence that the real world person made an intentional act. As technology advances and deep fakes of all sort abound, this is never more that a best-effort attempt to satisfy others of our intention to act. It will never be possible to be any more than evidence that must be judged by some entity which is here called the Verifier.

User Stories

1. A user walks up to a venue that has a age limitation carrying their smartphone which contains all of their identity credentials.
2. The venue has an automated access portal that is unmanned and has no line. There may be another access portal with a long line.
3. The user opens their smart phone with a face scan and holds it up for validation.
4. The phone displays the venue's identify information on the phones screen with the data that will be needed for them to access venue. (It may even contain a ticket that the user acquired online earlier.)
5. The user again shows their face to the smartphone as a well to accept the request for data and prove that they are still in possession of the device.
6. The portal verifies the information and allows one individual to pass through.

Prerequisites / Assumptions

•  The Holder has a Device that can accept biometric input from the current User and faithfully present acceptable evidence that the data send from the device was intentionally released by a User that matches the biometric profile stored in the Device.
• The Device is known and can make assertions on its own behalf that can be validated by the Verifier. This typically means that it has keying material held in a non-exportable location such as the secure enclave.

User Case Details:

Privacy

• The only data released is that shown to the user on their phone prior to a biometric scan.

Data Provided

Data Retained

Diagram

Steps

Primary Use Case

The anticipated normal sequence

Secondary Use Case(s)

Alternate or variant sequences

Sequence Diagram

End State

The Verifier is convinced that the User(subject) is the Holder of the device and intends to make the presentation of data to the Verifier. If necessary the Verifier can later claim that they have sufficient proof that the user meets some sort of statutory requirement (for example that they are of an age to access legally controlled substances or material).

Success

Markers or metrics that indicate success

Failure

Markers or metrics that indicate failure

References

Champion / Stakeholder

List of the people that created the use case

Related Material

Resources and Links