Ontology for Bio-Key Authentication: Modalities, Security Levels, Privacy, and Governance

Biometric authentication has become a primary mechanism for accessing critical systems, from corporate facilities and banking applications to healthcare records and smart home devices. The term bio-key encompas ses both the use of physiological and behavioural traits as authentication keys and the hardware security tokens (FIDO2 keys) that integrate biometric sensors. Despite widespread adoption, there is no formal ontology that in tegrates the full bio-key authentication chain, namely enrollment, biometric capture, template storage, matching, decision, and access grant, with security assurance levels, privacy requirements, and governance mechanisms. This gap produces semantic interoperability failures, inconsistent security assessments, and weak auditability, especially when biometric templates are compromised or when authentication decisions are contested. The criticalasymmetry is that biometric traits are irrevocable: unlike passwords, a com promised fingerprint or iris pattern cannot be reissued. Existing ontologies focus on biometric modalities in isolation or on hardware tokens, but none formally models the complete chain as a data governance and privacy problem. This doctoral project proposes two complementary contributions: (i)a formal ontology, built with the OntoView method, that describes bio-key authentication chains, their security levels, privacy constraints, and governance gates, serving as an instrument for interoperability, risk assessment, and regulatory compliance; and (ii) a verification method, based on the on tology, that specifies and evaluates biometric gates and audit requirements, with direct impact on privacy protection and social well-being. For high value targets, the ontology distinguishes single-party authentication from quorum-based authentication (M-of-N), in which M co-present custodians must each authenticate with their own bio-key and the access secret is split among N parties. The ontology and method will be validated by encodingreported cases, by expert evaluation, and by an empirical study on a si mulated multi-modal biometric testbed with scripted spoofing, replay, and collusion scenarios.