The Secure World of the "Internet of People", not things.

1. People
Terminating
Unit
THE INTERNET OF PEOPLE
1

2. Securing the Internet of People
 The Internet is insecure
 All networks are insecure
 All devices are insecure
We can Secure People
2

3. Secure Identity
 Secure Identity Number
 100% decentralized Global Identity
 100% exclusive user control
 100% disposable (forgotten)
 Self generated inside FIPS-140-2 hardware
 Usable in any Global Block Chain Rail
 No hardware or software likability or tracking Identifier
 Dual use FIDO U2F technology, supports incrementally FREE secure
Identities
 I am a Human attestation, with no personal biometric leakage
3

4. Existing Insecure Clients
 Insecure general purpose computers
 Users can access firmware settings during device boot, this can
allow users or virus to make changes in how the platform boots as
well as enable and disable various device ports, functions, and
other potential security features available on the device
 Changing environment combined with human exploits leads to
insecure computing environments for any secure client applications
4

5. Secure Client Unit
 Ensuring use of locked-down firmware in any unit.
 Secure boot
 Implement Unified Extensible Firmware Interface (UEFI).
 This allows a device to only boot trusted software by restricting the system to only allow
execution of binaries signed by a specified authority.
 UEFI Secure Boot checks the signature of each piece of boot software, including
firmware drivers and the OS. If the signatures do not match (e.g. if an attacker were to
replace the original image with a compromised OS) the platform will not boot.
 Mandatory hardware chip level Trusted Computing Module
 a cryptographic coprocessor including capabilities for random number generation,
secure generation of cryptographic keys and limitation of their use.
 includes capabilities such as remote attestation and sealed storage.
 Mandatory data encryption at rest and transit
 No User accounts
5

6. Functionality
 Securely implements our Block Chain Ledger Inter-ledger” protocols
within the Unit some functions with TPM only.
 Generates and stores key material within TPM, and registers each
unit to any number of Public Ledgers
 Supports direct FIDO ECDSA P256 Digital Signatures, with “I am
human” proof.
 Data is wrapped inside TPM, and certified by Human via FIDO
hardware token
 Mandatory online security core OS updates via Secure Boot and
TPM attestation
6

7. Trusted Computing
 TPM can create cryptographic keys and encrypt them so that they can only be
decrypted by the same TPM instance.
 TPM has a master “wrapping” key, called the storage root key, which is stored
within the TPM itself. The private portion of a key created in a TPM is never
exposed to any other component, software, process, or person.
 TPM can create a key (sealing) that has not only been wrapped but is also tied
to, and can only be utilized by, the Block Chain Ledger Rails.
 TPM, private portions of key pairs are kept separate from the memory controlled
by the operating system. Keys can be sealed to the TPM, and certain
assurances about the state of a system (assurances that define the
“trustworthiness” of a system) can be made before the keys are unsealed and
released for use.
 TPM uses its own internal firmware and logic circuits for processing instructions, it
does not rely on the operating system and is not exposed to vulnerabilities that
might exist in the operating system or application software.
7

8. The Trusted Block Chain Ledger
 The PTU are built as fixed-function devices. This implies that device knows exactly
which firmware, operating system, drivers and applications should be running on
each PTU device.
 This information can be used to fully lockdown an each PTU device by only
allowing execution of known and trusted code. Device lockdown can help
protect PTU devices by ensuring that unknown or untrusted executable code
cannot be “run” on a locked-down PTU devices.
 In order to leverage Device lockdown capabilities, it is necessary to ensure that
the boot binaries and UEFI firmware are signed and cannot be tampered with.
UEFI Secure Boot is the first policy enforcement point, located in UEFI. It prevents
tampering by restricting the system to only allow execution of boot binaries
signed by a specified authority.
 Code Integrity improves the security of the operating system by validating the
integrity of a driver or Block Chain Ledger DLL or application each time it is
loaded into memory.
 All devices have a mandatory online “trusted update” policy
8

9. The People Terminating Unit
 Right Hand Port => FIDO Token
 Left Hand Port => User device interface
 2x16 Trusted path HMI
 5G WiFi
 GPS for locational restrictions
9

10. Typical interface devices
 Physical interface
 Traders workstation
 Payment terminals
 Wireless
 Insecure Mobile devices
 FIDO token can be used via NFC and Mobile devices
People Terminating Unit, removes need to trust insecure devices and things.
10

11. The Secure Internet of People 11