Search-Preserving Anonymization (SPAn) is a privacy-first approach that enables organizations to perform high-fidelity biometric search, verification, authentication, classification, and collaboration while using anonymized biometric data.
Unlike most biometric systems that store raw biometric information which links back to an individual, SPAn transforms biometrics into anonymized versions that preserve search and lookup functions while preventing re-identification.
The result is a powerful new approach to biometric privacy protection that places privacy protection first, maximizing public trust, significantly reducing risk of privacy breach, simplifying compliance obligations, and supporting trusted biometric operations at scale.
Search-Preserving Anonymization (SPAn) is a form of biometric anonymization that retains only the proximity information required to compare biometrics while removing the ability to identify, reconstruct, or derive information about the original individual.
To qualify as a SPAn-compliant algorithm, a transformed biometric must meet the following five criteria:
Together, the SPAn criteria achieve the highest possible level of data minimization for search and match. Only the mathematical minimum of information necessary for biometric search is retained. It is the strongest position for privacy protection that also supports search and match.
It should be no surprise that many global privacy regulations implicitly require SPAn by necessitating optimal data minimization. These include the European Union GDPR, California CCPA / CPRA, Texas TDPSA, Utah UCPA, Brazil LGPD, Canada PIPEDA, United Kingdom UK-GDPR, Australia APP and New Zealand IPP.
Most biometric systems rely heavily on data that remains linked to an individual’s identity.
This creates risk and ongoing concerns such as:
Because biometric information is permanent and cannot be changed like a password, organizations face increasing pressure to minimize the collection, storage, and exposure of biometric data.
SPAn addresses these challenges by making anonymization the default state for biometric search. SPAn is the strongest Privacy-First approach.
A common misconception is that anonymization limits biometric functionality.
SPAn supports the same operational capabilities organizations already rely on, including:
Organizations can therefore gain the benefits of anonymization without sacrificing any functionality related to biometric search.
Privacy regulations and standards increasingly require organizations to demonstrate proportionality, data minimization, and privacy-by-design as defined by standards such as GDPR. SPAn achieves the highest standard of privacy-by-design compliance.
Because SPAn removes the biometric data elements that create privacy risk, organizations can focus compliance assessments on assertable SPAn compliance and examination of the privacy impact of additional attribute collection.
This can significantly reduce and focus effort required for:
SPAn makes proportionality requirements substantially easier to satisfy because optimal data minimization has already been achieved.
Organizations implementing biometric systems often face sizeable effort when attempting to satisfy privacy and protection requirements outlined in standards such as:
Because SPAn is built around anonymization, non-reversibility, and optimal data minimization, many of the controls, assessments, and protection objectives addressed by these standards are inherently satisfied.
Rather than treating privacy as an additional layer applied after deployment, SPAn incorporates privacy protection directly into the stored biometric data (Privacy First), reducing implementation complexity and helping organizations accelerate compliance initiatives.
SPAn creates new opportunities for secure collaboration between organizations.
Whether supporting multiple agencies, trusted ecosystems, or federated identity initiatives, organizations can determine whether records relate to the same individual without sharing personally identifiable information.
This enables:
SPAn is particularly valuable in digital wallet and verifiable credential environments.
If a traditional biometric template is compromised, the privacy consequences can be severe.
With SPAn:
Search-Preserving Anonymization (SPAn) is a biometric privacy technology that transforms biometric information into an anonymized form that preserves the ability to search and match biometrics, and support common applications, such as to authenticate, verify, classify, and perform unique people counting, without revealing the identity of the individual concerned or allowing the extraction of personal characteristics from the biometric data. Traditional biometrics can permanently compromise users, whereas SPAn biometrics are anonymized, revocable, and reissuable, with a low or indiscernible risk of exploitation.
Yes. Search-Preserving Anonymization is a Biometric Privacy- Enhancing Technology. SPAn removes identifiable personal information from the transformed biometric, which enhances privacy while preserving the ability to perform biometric search and match functionality.
Yes. Being able to search is a defining characteristic of Search-Preserving Anonymization. SPAn retains only the proximity information required for biometric comparison while removing information that could identify an individual or reveal personal characteristics from the original biometric.
Yes. SPAn can be applied to biometric systems that require comparison of biometric records, including facial recognition applications, which require search and match capabilities.
SPAn can support a wide range of biometric applications, including authentication, verification, facial recognition, identity collaboration, digital identity programs, trusted credentials, trust ecosystems, age verification, and unique person counting. The objective is to preserve the operational benefits of biometric matching while reducing the privacy risks associated with retaining identifiable biometric data.
SPAn is likely to become best practice for systems that utilize biometric information to match a user against a list of known individuals. As a privacy-preserving approach, SPAn offers several advantages over traditional methods, including stronger privacy protection, reduced data exposure, lower complexity and greater versatility.
SPAn does not require the retention of an individual’s original biometric information, which can significantly reduce the honeypot risk associated with centralized biometric databases. SPAn also supports revocability and the ability to reissue, which means SPAn biometrics are not permanent unlike traditional biometrics. As well, SPAn biometrics are mathematically more efficient than many other methods used to protect traditional biometric data, including encryption methods.
Because of its characteristics, SPAn can help organizations address requirements in many standards and privacy frameworks. For example, SPAn represents optimal data minimization for the common purpose of searching and matching biometric samples. SPAn is an anonymization method which means it can be used to meet requirements of standards that require double-blind protections.
By reducing the need to retain conventional biometric data, SPAn can support both centralized and decentralized architectures equally, without making the choice of solution architecture solely on the basis of biometric data exposure, privacy or regulatory concerns.
Many traditional biometric systems retain biometric data that link back to an individual or contain information that creates privacy and security risks if compromised. SPAn transforms biometric data into an anonymized form that retains only the information required for comparison and prevents original biometric information or personal characteristics from being extracted. As well, traditional biometrics can represent a high level of risk because a breach can compromise a user permanently. In comparison, SPAn biometrics can be revoked and reissued, and if compromised, there is no viable risk of identifying the original biometric source.
Pseudonymization replaces identifiers with alternate values, but the resulting information can generally still be linked to an individual using additional information. Tokenization is a specific method used to achieve pseudonymization, so they are closely related. In comparison, SPAn is an anonymization approach. This means that the transformed biometric cannot be used to identify the original individual or biometric sample, nor to derive personal characteristics.
Homomorphic encryption allows computations to be performed on encrypted data without first decrypting it. The encrypted data remains protected, but someone with the appropriate key can still decrypt it. In comparison, SPAn is an anonymization approach that transforms biometric data into an anonymized form that supports biometric search and match without retaining the personally identifying information associated with conventional biometrics. Unlike homomorphic encryption, SPAn has no method to reestablish personal information, because this information is not retained.
Sharding divides data into separate pieces and stores those pieces across different systems, locations, or databases. While this can reduce the risk of a single database being compromised, the underlying biometric data remains present across the shards and can be reconstructed when the pieces are recombined. In comparison, SPAn transforms biometric data into an anonymized form, which does not retain personal information, preventing reconstruction of the original biometric or extraction of any personal characteristics.
Organizations increasingly need to use biometrics for identity, authentication, security, public safety, digital identity, and other applications while addressing growing concerns about privacy and cybersecurity. SPAn provides an approach for making biometric anonymization part of the underlying architecture rather than relying on controls applied after biometric data has been collected. Controls have risks, vulnerabilities and process management challenges, so not retaining personal information is the preferred option where business needs can still be satisfied. SPAn is a compelling approach that reduces present and future cyber risks from agentic agents, bad actors, and quantum computing.
Yes. Search Preserving Anonymization (SPAn) is a privacy-preserving approach specifically designed for biometric data. SPAn preserves privacy by transforming an original biometric into an anonymized form that can no longer link back to the individual who provided the original biometric information. SPAn enforces optimal data minimization, retaining only the minimum data required to perform biometric search and match.
SPAn takes a different approach from encryption, decentralized storage, and conventional biometric template protection. Rather than relying only on controlling access to identifiable biometric templates, SPAn is designed to transform the biometric into an anonymized form while preserving the ability to search and match. SPAn can be integrated into centralized, decentralized, or hybrid architectures depending on the requirements of the application.
SPAn improves biometric privacy by removing personal information, transforming biometric data into an anonymized form, and minimizing the information retained for the purpose of search and match. SPAn also supports the revocation and reissue of transformed biometrics. This substantially reduces risks associated with data breaches, unauthorized access, insider misuse, and inappropriate use of biometric information.
No. SPAn is designed so that the transformed biometric does not contain the personally identifiable information associated with the original biometric.
SPAn is designed to prevent the transformed biometric from being used to re-identify the original individual or derive personal characteristics. This can substantially reduce re-identification risk compared with systems that do retain original biometric data or templates.
Yes, SPAn protects the identity of the individual the biometric is related to, regardless of the type of biometric involved (e.g. fingerprint, face, iris, etc.). Once the original biometric sample is supplied, it is first anonymized by the inquiring party before being submitted to the lookup or match service. This means the inquiring party does not disclose any identifying information about the individual in question. This protects both the individual’s identity and the confidentiality obligations of the organization performing the lookup request.
SPAn can reduce the impact of a biometric database breach or an edge device compromise by ensuring that stored and searchable biometric data is anonymized rather than using conventional and identifying biometric templates. An attacker who obtains the transformed SPAn biometric is not able to reconstruct the original biometric or extract personal characteristics from it.
Yes, SPAn is considered secure. SPAn improves the security and privacy of biometric data by preventing the transformed biometric from being reversed into the original biometric or being used to derive personal characteristics. SPAn satisfies the GDPR “motivated intruder” test (Recital 26), and unlike traditional biometrics, SPAn does not retain PII. This by itself addresses many security concerns. SPAn also supports revocation and reissuance, allowing compromised biometric records to be replaced. The ability to reissue biometric records can be used to remedy or add protection against known or future security concerns, including technologies such as quantum computing, or when verifier organizations have their authorization removed.
Yes. A key requirement of SPAn implementations is the ability to revoke and reissue anonymized biometric identifiers. This allows organizations to replace a biometric record when security concerns change, a verifier relationship changes, or additional protection is needed.
The traditional centralized storage of biometrics poses a significant security and privacy risk, which is why such approaches are often considered unsuitable for commercial applications. SPAn addresses this risk by changing what is stored and searched. Instead of retaining conventional biometrics linked to personal information, SPAn stores an anonymized biometric that cannot be used to reconstruct an original biometric template, derive personal characteristics, or link biometric information to individuals.
SPAn reduces the potential impact of a breach by removing identifiable biometric information from the stored biometric information. An attacker who gains access to a SPAn database is not able to recover the original biometric data or derive personal characteristics.
Unlike traditional biometrics, the SPAn transformation removes identifiable biometric information so that what is stored is void of PII. This by itself addresses many security concerns because the stored information is not useful to a hacker. Also, SPAn supports the ability to cancel and reissue biometrics, which adds further protection against threats or concerns.
Yes, SPAn requires that the transformed SPAn biometric cannot be used to derive secondary characteristics such as age, gender, ethnicity, or eye colour. This means a biometric system cannot be repurposed for demographic profiling.
Yes, Search-Preserving Anonymization (SPAn) natively supports negative identification, anonymous blocklists and duplicate-prevention checks. Standard anonymization techniques (like blurring, pixelation, or heavy cryptographic hashing) remove the structural data needed to compare two biometrics, making it impossible to determine if a person is in a database or not.
SPAn solves this by utilizing closeness-preserving or distance-preserving mathematical transformations. When a biometric sample is enrolled or scanned, SPAn strips away all Personally Identifiable Information (PII) and secondary characteristics (like age, gender, or race) while retaining the proximity information needed for negative recognition.
For a negative recognition test, if an applicant is clean and not on a blocklist, their SPAn biometric will sit outside the “closeness threshold” of every entry in the anonymized database. The SPAn system will return zero matches, safely confirming negative identification. For a flagged match, if a blocked individual requests services, their SPAn biometric will land close to their enrolment record triggering a match, alerting operators to a blocklist violation, without the operators ever having to know the true identity of the actual user.
SPAn supports privacy principles such as data minimization, privacy by design, proportionality, and removing the ability to re-identify. It simplifies aspects of privacy risk assessment by allowing compliance review to focus on other areas. SPAn does not by itself make an organization compliant with a particular privacy law or regulation.
SPAn supports GDPR principles such as data minimization, privacy by design, proportionality, and protection against re-identification. SPAn is not, by itself, a guarantee of GDPR compliance. Compliance depends on what other data is collected, the purpose of processing, governance, security controls, and the organization’s legal basis for processing PII data, not just anonymized biometric data.
SPAn directly supports the ISO/IEC 24745 standard by fulfilling its core requirements for biometric template protection. ISO/IEC 24745 mandates that protected templates exhibit three primary security properties: irreversibility, unlinkability, and renewability/revocability, all of which are provided automatically by SPAn.
ISO/IEC 30136 provides a framework for evaluating biometric protection mechanisms. Because SPAn requires non-reversible, revocable, data-minimized, and anonymized biometric transformations, it will directly address 75% to 80% of the core objectives outlined in the current 2018 ISO/IEC 30136 standard.
Yes, Search-Preserving Anonymization (SPAn) makes it significantly easier to navigate and comply with biometric consent requirements, primarily by satisfying strict legal mandates for data minimization. However, whether it eliminates the need for consent entirely depends on your regulatory jurisdiction.
Combination re-identification privacy risk is the danger that an anonymized or de-identified dataset can be linked back to a real person when seemingly harmless or non-direct data fields are combined with other available information.
When the combination of attributes or data fields includes biometrics, using SPAn means that biometric identifiers can be excluded from risk considerations. Once biometrics are anonymized, they no longer contribute, either individually or when combined with other fields, i.e., they cannot play a role in reidentification. This means the scope or emphasis of Privacy Impact Assessments (PIAs) can be directed to the remaining non-biometric attributes that could contribute to combination reidentification risk.
Search-Preserving Anonymization operates on biometric identifiers and is significant for proportionality decisions because it directly affects a fundamental test in data privacy law, namely achieving the mathematical minimum of data retention. SPAn provides data minimization for biometric search and match, one of the most common building blocks of biometric systems.
In regulatory frameworks (such as the European Union GDPR, California CCPA/CPRA, Texas TDPSA, Utah UCPA, Brazil LGPD, Canada PIPEDA, United Kingdom UK-GDPR, Australia APP and New Zealand IPP), a proportionality decision requires assessing whether the privacy intrusion of a technology is justified by, and limited to, its objective. Traditionally, biometric deployments fail or struggle with proportionality tests due to the permanent, unchangeable nature of biometric data and the high risk of repurposing, profiling, or re-identification.
SPAn systematically shifts this equation across three dimensions of proportionality:
1. Enforcing Data Minimization
A core tenet of proportionality is that data collection be limited to what is strictly necessary for the purpose of searching and matching. Because SPAn retains only the proximity information needed for comparison, an organization can prove it is not storing or processing data beyond that required for search and match, including Personally Identifiable Information (PII) or secondary characteristics (such as age, gender, or ethnicity).
2. Reducing Risk of Privacy Harm
Traditional biometric breaches can have severe consequences because facial geometry or fingerprints cannot be rotated or reissued like a password. This severe risk tips proportionality against deployment and decentralized solution architectures due to the honeypot risk. SPAn biometrics cannot be used for tracking of individuals or for identity theft, which structurally lowers the systemic privacy risk, making an implementation, whether centralized or decentralized, more likely to be deemed proportionate.
3. Preserving Utility Without Compromising Privacy
Because SPAn preserves match accuracy, offers revocability and reissuability where traditional biometric templates do not, regulators conducting a Proportionality Assessment can see that the same business utility is achieved with substantially lower privacy risk.
Yes. SPAn biometrics support trusted credential recovery and reissuance when a user loses access to a device or trusted credential. A biometric captured during enrollment can be converted into an anonymized (SPAn) biometric that is stored by the credential issuer or their service provider. During recovery, the user’s biometric can be matched against the stored SPAn biometric to verify the user’s identity and therefore their entitlement to recover or to permit reissue of the credential.
No, it is not necessary, but it is recommended. Most issuers will offer alternative identity proofing options that do not require biometrics. However, identity proofing must be strong, otherwise recovery/reissue is likely to be targeted for vulnerabilities by bad actors. Biometric verification can provide a fast, accurate, and potentially self-service way to verify that the person requesting recovery is the legitimate credential holder. Unlike SPAn, traditional biometrics often rely on retaining PII, which adds complexity, cost and risk, as well as public concern about the safety of personal biometric information.
A SPAn-based recovery process typically involves two stages:
For a trusted credential recovery use case, the enrolment SPAn biometric is stored by the credential issuer and matched to verify the user’s identity and, therefore, their entitlement to recover or reissue a trusted credential at the time of recovery.
The required assurance level is determined by the credential issuer and the requirements for the credential. The assurance level must be maintained throughout the entire enrollment process.
Yes. Maintaining chain of custody throughout enrollment and recovery is essential for trusted credentials. The issuer must be able to establish that the biometric and identity evidence used during enrollment and recovery belongs to the legitimate credential holder and that every identity, private key, and digital certificate remains authentic, uncompromised, and verifiable from initial creation through end use.
Yes. The credential issuer determines whether a trusted credential is device-bound. If a credential is restricted to one device, recovery can issue the credential to a new device while revoking the credential on the previous device, noting that digital wallets that offer built-in synchronization across devices will not synchronize trusted credentials that have a requirement for device-specific binding.
If the trusted credential is not device-bound, the issuer can determine whether the trusted credential may be used on multiple devices and how many devices are permitted. It is then optional for a user to revoke credentials on a prior or lost device (until any cap on the number of devices is reached).
Yes, SPAn directly supports and complements the First Person/First Peoples Project. The First Person community-oriented approach relies on self-certifying decentralized identifiers (DIDs), verifiable relationship credentials (VRCs), and cryptographic proofs to authenticate peer-to-peer connections and establish relationships between people and organizations. SPAn adds a biometric method that verifies whether a person is the individual enrolled in the relationship, without storing sensitive, permanent, personally identifying biometric data. As a result, these approaches are highly complementary and bring the full value of their respective strengths when used together.
Age verification and age assurance processes frequently use conventional biometric information to confirm who a person is before retrieving their age details or applying age assurance tests. SPAn, however, can verify that a person corresponds to an enrolled individual without knowing their actual identity. Importantly, SPAn allows biometric verification to occur at the same time as the age test occurs, whereas many systems only perform biometric verification at the time of enrollment, making them vulnerable to fraud or misuse, for example, if another person has access to the device.
Yes and No. SPAn significantly reduces the risk of age assurance steps being exploited. SPAn does not perform age assurance itself but is highly complementary to age assurance processes. SPAn relies on anonymized biometric information to confirm who a person is before retrieving age details or initiating age assurance tests. Because SPAn preserves the ability to perform biometric search and match, it is highly suitable for supporting age assurance processes, and unlike many other approaches SPAn allows biometric identity proofing to occur at the same time as the age tests are applied, significantly reducing risk of the age assurance system being manipulated.
Yes. SPAn can support solutions in which different parties receive only the information they need to perform their role. For example, one service can verify that a person corresponds to an enrolled individual without knowing their actual identity and then provide their anonymized SPAn biometric to a second service that is able to apply the requested age test for that individual (i.e. double-blind age verification). SPAn-based age verification solutions store only anonymized biometric information and use biometrics to prove age information is for the same person who is being verified, whereas some systems only perform biometric verification at the time of enrollment, making them vulnerable to fraud or misuse, for example, if another person has access to the device.
Yes, SPAn indirectly supports AgeKey and the OpenAge initiative. SPAn and AgeKey solve different problems. AgeKey itself relies on FIDO2 passkeys to provide double-blind age verification. Because local device verification is explicitly considered as a core part of the FIDO specification, if SPAN is used for local verification, a more secure solution results. While the FIDO passkeys offer protection from one set of attack vectors, by never sending out a password that could be compromised, SPAn offers protection from a different set of threats, such as a biometric being exposed from a compromised local device.
Yes, SPAn supports and is complementary to FIDO Passkeys by providing a more secure approach for the management of biometric information. FIDO Passkeys rely on the device operating system to collect and verify a PIN number or biometric(s) provided by the end user. If the supplied PIN or biometric(s) match stored versions, the operating system permits the private key to be accessed in order to establish the trusted connection using FIDO passkey’s cryptographic handshake of private/public key pairs.
SPAn is more secure, as it is able to provide biometric verification without the operating system having to store personal and non-revocable biometric data. While the FIDO passkey workflow offers protection from one set of attack vectors, such as man-in-the-middle attacks by never sending out a password that could be compromised, SPAn offers protection from a different set of threats, such as a biometric being exposed by a compromised local device.
Yes, SPAn can easily be combined with biometric systems that test for liveliness. Because liveliness testing and biometric matching address different parts of the biometric verification process, SPAn and liveness detection can be used together as complementary components of a biometric authentication or verification solution.
Yes. Search-Preserving Anonymization (SPAn) prevents AI agents from obtaining personal biometric data and reduces public anxiety associated with autonomous AI agents. As AI agents grow more capable of crawling the web, scanning environments, and autonomously executing transactions, they present significant threats to personal identity, privacy, and accountability. SPAn addresses these threats for biometric identifiers by mathematically altering the biometric templates so they cannot be used to identify an individual or to extract an individual’s characteristics – this is not something that AI agents can bypass because this information has been removed.
No. SPAn biometrics do not include information that would identify an individual or provide characteristics about an individual such as age, gender, ethnicity, or eye colour. If AI agent(s) were to breach a database of SPAN biometrics, they would find only a sea of anonymized patterns that cannot be reverse-engineered into biometric traits or linked to real people. SPAn preserves the information needed for biometric comparison while removing information that links back to individuals.
Search Preserving Anonymization (SPAn) is designed to protect biometric templates against spoofing, known as Presentation Attacks, by removing personally identifiable information (PII) while keeping enough mathematical “closeness” for data matching. For this reason, SPAn does not stop AI agents that break into trusted communication, but it will stop agents from being able to exploit a person’s sensitive biometric data. This is because there are no links to individuals retained or that support segmentation by trait or characteristic. This makes SPAn a significant impediment to AI agents that act with malicious intent or that overstep boundaries of privacy, policy, or regulation.
Yes, SPAn can easily support temporary biometric requirements, for example, if a biometric is only permitted for use during a specific time period. This is possible because SPAn allows revoking of a biometric, and this can be either on demand or after a set period of time.
Yes, SPAn allows participating agencies to retain control of their respective mugshot repositories while supporting cross-agency investigative collaboration. SPAn enables searching and matching of biometric data, including FRT, between different police agencies, allowing one agency to confirm whether one or more other agencies have information about an individual of interest without sending personally identifying facial recognition information.
Importantly, a potential match does not automatically authorize the disclosure of an individual’s identity or associated investigative records. Any subsequent information exchange remains subject to applicable legal authorities, agency policies, information-sharing agreements and established investigative procedures.
SPAn can, in most cases, be added to existing FRT systems by granting access to existing FRT templates or to enrolment images, and then optionally transition other, or all, workflows to be anonymized.
While SPAn does not automatically govern the retention or deletion of original images held in police systems, SPAn does play an important role when conducting an investigative facial recognition search by protecting both unknown probe images and existing mugshot repositories. Instead of traditional facial recognition workflows that require storing or sharing identifiable, raw facial images, which are vulnerable to data leaks, misuse and sharing restrictions, SPAn converts all facial data into permanently anonymized biometric forms that still support search and matching but are not subject to the same concerns of data breach, misuse or restrictions because of privacy.
SPAn complements existing law enforcement governance and accountability frameworks rather than replacing them. SPAn can simplify certain technical privacy considerations without replacing an agency’s governance responsibilities.
Search-Preserving Anonymization (SPAn) does not eliminate the requirement for human review, legal authority, privacy assessments, or other governance controls when law enforcement uses facial recognition technology (FRT). While technical privacy measures like SPAn alter how biometric data is handled and stored, processing biometric data triggers comprehensive compliance requirements. Also, SPAn does not solve external governance risks, such as whether a police agency’s third-party database vendor compiled its source images lawfully.
However, the fact that SPAn incorporates privacy protection directly into the biometric means the comprehensive compliance requirements are much more easily satisfied. Many investigative processes, including inter-organizational collaboration, are able to benefit from significantly simpler and faster privacy assessments. i.e., while a Privacy Impact Assessment (PIA) is almost always mandatory if biometrics are involved, the level of rigour is substantially reduced if the biometric is a SPAn biometric simply because, by definition, SPAn biometrics do not contain personally identifying information and can’t be used to extract personal characteristics.
No, SPAn does not replace an agency’s existing facial recognition system. SPAn is a complementary capability that can be added to or used to extend an agency’s existing facial recognition system. For example, adding SPAn to one agency’s system can allow other agencies to perform search and match functions without affecting the source agency’s existing system or internal processes. Selected investigative processes can also be optionally switched to SPAN, and this can be done in an orderly manner, with parallel service operation as required during transition.
Using SPAn to store biometrics on edge-computing devices provides a stronger foundation for secure, privacy-first device authentication by protecting against device compromise. Rather than relying on traditional and sensitive biometric template matching, SPAn permanently transforms a biometric into an anonymized form. It retains only the spatial proximity or “closeness” information required to confirm that a live authentication attempt matches an enrolment record, and does this without storing a biometric that is vulnerable to permanent compromise.
Yes. SPAn can be applied to decentralized architectures in which biometric processing or storage occurs on a user’s device or on ‘edge’ devices. The edge device can perform authentication locally without storing a biometric that is vulnerable to permanent compromise.
SPAn represents a significant and recent technical advancement in how centralized biometric databases can be secured, particularly against the “honeypot” risk. SPAn is defined by a set of criteria that guarantees data minimization and anonymization. Because SPAn is new, there is still considerable focus by professionals on older, traditional methods of cryptographic-based solutions. As privacy regulation, cybersecurity concerns, and public expectations around biometric data continue to evolve, there is increasing demand for SPAn solutions where privacy protection is built directly into the stored biometric identifiers.
Yes, SPAn can help customers with systems that utilize multiple biometric capture technologies (multi-modal biometrics), e.g. facial recognition, iris, palm prints or fingerprints, as well as customers who have multiple systems for one modality, that don’t easily integrate, or that need to be searched separately. Because SPAn operates against biometrics in general it is not limited to one biometric modality and can act as common service for searching against multiple separate systems.
Yes. Because SPAn supports revocability and reissuing of biometrics, this capability can also be used to help migrate seamlessly between technologies or to upgrade from one version to a new and better version of biometric capture or identification capability. As biometrics become available from the new technology or capability, SPAn can issue the new replacements and then expire the old biometrics so that the transition between systems or technologies is seamless to those using the service.
Attain Insight is a member of the Biometrics Institute, supporting the responsible, ethical, and privacy-preserving use of biometric technologies worldwide.
