LICET: A Cryptographic Protocol for Physiological Human-Intent Verification in Autonomous AI Agent Authorization

3.1. Biometric Sources

LICET MUST accept biometric input from any of the following sources:¶

• BLE GATT Heart Rate Profile (IEEE 11073)¶
• Android Health Connect API¶
• Apple HealthKit¶
• Direct I2C sensor integration (e.g., MAX30102)¶
• Software simulation (development environments only)¶

3.2. Captured Signals

Three signals MUST be captured over window t_c:¶

• f_HR: Heart rate in beats per minute (BPM)¶
• s_O2: Peripheral oxygen saturation in percent (%)¶
• v_HRV: Root mean square of successive differences (RMSSD) of inter-beat intervals in milliseconds (ms)¶

3.3. Coercion Detection Function

The coercion detection function C maps physiological signals to a risk level:¶

C(f_HR, v_HRV) =
  HIGH    if f_HR > 130 AND v_HRV < 20
  MEDIUM  if f_HR > 100 AND v_HRV < 35
  LOW     otherwise

Physiological basis: under acute psychological coercion, the sympathetic branch of the autonomic nervous system simultaneously elevates heart rate and suppresses HRV [THAYER2012]. This dual-axis collapse distinguishes coercion from aerobic exercise, where HRV may be maintained or recover rapidly.¶

3.4. Cognitive Impairment Detection

I(s_O2) =
  IMPAIRED  if s_O2 < 90
  NORMAL    otherwise

3.5. Authorization Decision

Authorization MUST be denied if any of the following conditions hold:¶

• C(f_HR, v_HRV) is MEDIUM or HIGH¶
• I(s_O2) is IMPAIRED¶
• Captured signals are outside valid sensor ranges¶
• Capture window t_c produces insufficient data points¶

4.1. Intent Hash

The intent hash uniquely identifies the requested action:¶

h = SHA-256(a || id_A || tgt || ts)

where || denotes concatenation, a is the UTF-8 encoded action descriptor, id_A is the UTF-8 encoded agent identifier, tgt is the UTF-8 encoded target entity, and ts is the Unix timestamp encoded as a 64-bit big-endian integer.¶

4.2. Session Key Derivation

A per-event session key SHALL be derived using HKDF [RFC5869]:¶

k_s = HKDF(hash=SHA-256, IKM=k_m, info=h, L=32)

where k_m is the server master key (minimum 256 bits, generated using a cryptographically secure random number generator) and h is the intent hash. Session key isolation ensures that compromise of k_s for event i does not expose k_s for any other event j, nor the master key k_m.¶

4.3. Biometric Temporal Signature

sigma = HMAC-SHA256(h || f_HR || s_O2 || v_HRV || ts, k_s)

The biometric values f_HR, s_O2, v_HRV MUST be encoded as IEEE 754 double-precision (64-bit) big-endian floating-point values.¶

Properties:¶

• Event-unique: ts ensures no replay across distinct events.¶
• Action-bound: h is embedded; sigma is cryptographically invalid for any action other than the one specified in h.¶
• Non-invertible: biometric values cannot be recovered from sigma without k_s.¶

5.1. Proof Generation

1. w  = SHA-256(sigma || h) mod q
2. PK = w * G
3. r  randomly sampled from Z_q
4. R  = r * G
5. c  = SHA-256(R || PK || h) mod q
6. s  = (r - c * w) mod q

Proof: pi = (R, c, s, PK)

5.2. Proof Verification

Given pi = (R, c, s, PK) and intent hash h, a verifier V checks:¶

s * G + c * PK =?= R
AND
c =?= SHA-256(R || PK || h) mod q

If both equalities hold, V is convinced that the prover possessed knowledge of the biometric signature sigma for this intent hash, without learning sigma, f_HR, s_O2, or v_HRV.¶

6.1. Chaining

L_0 = SHA-256(entry_0 || "LICET-GENESIS")
L_n = SHA-256(entry_n || L_{n-1}),  n >= 1

Any retroactive modification to entry i invalidates L_i through L_n, making tampering mathematically detectable by any party recomputing the chain.¶

6.2. Integrity Verification

Implementations MUST provide a publicly accessible mechanism to verify the full hash chain and return a boolean integrity result, without requiring authentication.¶

7.1. Replay Attack Prevention

Each authorization event produces a unique intent hash h binding the action, agent identifier, target, and timestamp. Implementations MUST reject authorization requests with timestamps outside a configurable window (RECOMMENDED: 60 seconds).¶

7.2. Coercion Detection Limitations

The concurrent HR/HRV threshold is a statistical, not absolute, protection. Population-level thresholds may produce false positives for individuals with baseline tachycardia or false negatives for highly trained individuals. Future versions of this protocol SHOULD define a personalized baseline calibration procedure.¶

7.3. Biometric Privacy

Raw biometric values MUST NOT be stored in the ledger. The ZKP mechanism defined in Section 5 ensures that auditors can verify authorization validity without accessing biometric data, satisfying data minimization principles of privacy regulations.¶

7.4. Master Key Protection

Implementations MUST protect the master key k_m using hardware security modules or equivalent mechanisms. Key rotation procedures MUST be defined by each deployment.¶