SCAMPER | Strengthened authenticated platform for private personal information

Region:

Flanders

Financed by

Enabling trusted digital identity through privacy-first authentication

Current digital identity systems rely heavily on central authorities, creating privacy and security risks. While Self-Sovereign Identity (SSI) improves data ownership, important challenges remain. Privacy guarantees are still limited, with insufficient unlinkability and a lack of secure and verifiable biometric integration. SCAMPER addresses these challenges by developing a secure and privacy-preserving authentication framework. It combines securely processed biometrics with SSI and Solid technologies, while ensuring alignment with GDPR and eIDAS 2.0.

Target group

SCAMPER is aimed at organisations involved in digital identity and authentication solutions, across industry and the public sector:

Providers of digital identity and authentication platforms
Industrial and IoT operators using sensor-based authentication systems
Technology providers developing Self-Sovereign Identity (SSI) or Solid-based data vaults
Public sector organisations deploying GDPR- and eIDAS 2.0-compliant digital identity solutions

Context

Today’s digital identity systems are largely based on centralised architectures, which create single points of failure and limit user control over personal data.

Self-Sovereign Identity (SSI) improves data ownership, but still lacks strong privacy guarantees and a standard strong link with the user. In particular, important challenges remain. Issuer is not fully ensured. Similarly, unlinkable revocation is still difficult to achieve in practice.

In addition, biometric authentication is typically tied to specific devices and trusted hardware, which limits flexibility and makes recovery more complex. Processing biometric data from remote sensors introduces additional security and privacy risks, requiring protection both in transit and during computation. Verifiable techniques, such as zero-knowledge proofs and approaches based on fully homomorphic encryption and multi-party computation, offer promising solutions, though their performance remains a key limitation.

Bringing together biometrics, verifiable data processing and decentralised identity in a secure and privacy-preserving way therefore remains an open challenge.

Objectives & results

SCAMPER aims to develop a secure and privacy-preserving authentication and digital identity framework, integrating biometric technologies within SSI and Solid environments.

Main objectives of the project

Develop and evaluate strengthened fuzzy extractors for robust and privacy preserving biometric authentication
Design and analyse privacy-enhancing credential mechanisms that support selective disclosure
Enable issuer indistinguishability and implement unlinkable revocation mechanisms
Develop a Solid-compatible Digital Data Vault for secure data storage and sharing
Build and validate an interoperable demonstrator aligned with GDPR and eIDAS 2.0

Key results

A distributed Digital Data Vault prototype enabling secure and controlled data sharing
A demonstrator combining authentication and privacy-enhancing technologies
Datasets of biometric embeddings and signed sensor data for testing and validation
Legal analysis and recommendations to support compliant deployment

Approach

SCAMPER follows a structured and integrated approach, combining technological development with validation and compliance assessment.

Secure data processing
The project ensures integrity-preserving pre-processing of sensor data and enables real-time, verifiable data selection and transformation using zero-knowledge techniques and secure processing methods.
Privacy-preserving authentication
It develops strengthened fuzzy extractors and designs credential issuance mechanisms based on zero-knowledge proofs. In addition, it implements advanced techniques such as ring signatures and accumulator-based revocation.
Digital Data Vault development
A Solid-compatible Digital Data Vault is designed and developed, integrating SSI mechanisms while ensuring robust access control and strong unlinkability guarantees.
Integration and validation
All components are integrated into a Solid-based platform, where interoperability and performance are validated. The project also includes user testing and a thorough assessment of compliance with GDPR, eIDAS 2.0 and the AI Act.