Using distance-preserving transformations to keep sensitive data safe

Abstract

In some examples, methods, systems, devices, and machine-readable media are disclosed for securing biometric data using distance-preserving transformations. A distance-preserving transformation is a function that maps elements to the same or another metric space so that the distance between elements in the new metric space is equal to the distance between elements in the original metric space.

Description

Background Art

[0001] Current methods of authenticating users on computer systems typically rely on usernames and passwords and, in some cases, one-time codes. These methods have many disadvantages. For example, the strongest passwords are those with random characters rather than words or phrases. However, these random passwords are difficult to remember, so users often choose passwords with words or phrases that are vulnerable to dictionary attacks. In a dictionary attack, an attacker tries various combinations of common words and phrases from a list of common words and phrases known as a dictionary. In addition, so-called two-factor authentication safeguards that require the use of a one-time code sent to a second trusted computing device, such as a smartphone, are also vulnerable to attacks. For example, a cellular phone provider was tricked into providing a malicious individual with access to a legitimate individual's text messages.

[0002] A biometric is a measurable characteristic of a person that is able to identify that person within a certain level of uniqueness. Biometrics are particularly well suited for authenticating users because of the particularly high levels of uniqueness of several common biometrics. For example, fingerprints are considered unique to each person and can be used as a very accurate indication that the person is who they claim to be. Example biometric information with a high degree of uniqueness includes fingerprints, iris structure, retinal structure, DNA composition, facial data (e.g., feature distances), voiceprints, ear structure, etc.

[0003] In order to authenticate a user using biometrics, the user first establishes biometric authentication by presenting a sample of their biometrics to a computing device for capture or scanning. For example, by pressing a finger on a fingerprint sensor, by allowing an image of the iris, a retinal scan, or a facial scan. Such biometric data is captured and sampled as a collection of one or more data points called a biometric template. A biometric template is a digital representation of one or more features extracted from the scanned biometric data. For example, the location of ridges and valleys in a fingerprint. Once this initial template is stored, the user is configured to use their biometrics for authentication. This initially saved biometric template can be called a sample biometric template because it is used as a sample-identifying the user's real biometrics and compared with the biometric template submitted in subsequent authentication attempts. When someone attempts to authenticate a device using biometrics, the person presents their biometrics to a computing device for capture or scanning. The biometric data is captured and sampled as one or more data points and stored as a "challenge template." The challenge template is compared with the sample template, and if they match, the user is authenticated and authorized to access one or more computer resources protected by the biometric data. If the templates do not match, then the user is not authenticated and the user may be denied access to one or more computerized resources.

[0004] Contrary to usernames and passwords, biometrics do not require passwords to be remembered, so they cannot be forgotten. Additionally, biometrics are difficult to forge. For example, it would be difficult for a malicious actor to: 1.) obtain a retinal scan of an individual; and 2.) replicate that retinal scan in front of a retinal scanner. Therefore, biometrics are an attractive option for application developers interested in secure authentication methods. BRIEF DESCRIPTION OF THE DRAWINGS

[0005] In the accompanying drawings, similar reference numerals may describe similar components in different views, and the drawings are not necessarily drawn to scale. Similar numbers with different letter suffixes may represent different instances of similar components. The accompanying drawings generally illustrate various embodiments discussed in this document by way of example and not limitation.

[0006] Figure 1 Schematic data flow of a biometric system according to some examples of the present disclosure is shown.

[0007] Figure 2 A flow chart of a method for applying a distance preservation function to protect the security of a biometric template according to some examples of the present disclosure is shown.

[0008] Figure 3 A flow chart of a method for applying a distance preservation function to authenticate with a network-based authentication service according to some examples of the present disclosure is shown.

[0009] Figure 4 A flowchart of a method of authentication service according to some examples of the present disclosure is shown.

[0010] Figure 5 A schematic diagram showing a user device and a network-based authentication service according to some examples of the present disclosure is shown.

[0011] Figure 6 is a block diagram illustrating an example of a machine upon which one or more embodiments may be implemented. DETAILED DESCRIPTION

[0012] Although biometric authentication has many benefits, the use of biometrics also brings some disadvantages. For example, as mentioned above, biometric authentication requires users to register their biometric data (e.g., provide sample biometrics). If a user has multiple devices and / or accounts that they wish to use biometrics for authentication, they usually need to register by providing biometric samples for each of these devices and accounts. This registration time usually annoys users. In addition, in the case of some biometrics (e.g., fingerprints), users must remember which fingerprint they submitted as a sample to each device. This may cause user confusion when attempting to perform subsequent authentication. In order to eliminate these problems, sample biometric data can be stored in a network-based (e.g., cloud-based) server, which is then communicatively coupled to the user's device. When a user wishes to authenticate through one of their devices, the challenge biometric is then sent to a network-based server, which determines whether the user is authenticated by comparing the challenge template with the sample template. This allows a single registration process to be performed on all of the user's devices.

[0013] Regardless of where the biometric templates are stored (within each device or in a network-based server), secure biometric storage is important because, in contrast to passwords, biometric data cannot be changed if the user's data is stolen. By moving the biometric templates to the cloud, authentication services become an attractive target for hackers. One way to protect this data is to use encryption. For example, encryption can include transforming the biometric template from a first form to an encrypted form using an encryption function e(x, k), where x is the biometric template and k is a secret key. An attacker who has access to the stored encrypted biometric data may not be able to exploit the data without knowing the key used to decrypt the biometric template.

[0014] Unlike passwords (in cases where the user knows the password or not), a series of scans of the same fingerprint, iris, face, etc. may produce slightly different biometric data due to scanner accuracy, differences in user position, ambient light differences, etc. Since biometrics generally rely on the location (or positional differences) of various detected features (e.g. ridges or swirls on a fingerprint, facial features, ...), and since the encryption algorithm scrambles the biometric data (scrambles these locations and / or distances), two very close biometric templates that are both encrypted by the same key may be very different. To handle these differences, the biometric templates can be compared during decryption. Therefore, the encrypted sample is decrypted during the authentication attempt by using the key to produce the original sample, which is then compared to the challenge template. This allows the newly scanned biometric to be directly compared to the sample. The tolerance for errors can then be exploited, for example, a threshold distance between measured points on the fingerprint. However, in order to decrypt the sample biometric template, the device performing the authentication must know the decryption key and must store it, which may make the decryption key accessible to an attacker. Other types of transformation functions (eg, hash functions) suffer from the same problem that the transformed values ​​do not retain important information for making authentication decisions (eg, the location of points or distances between points), necessitating the storage of the inverse of the function.

[0015] In order to avoid using decryption keys or applying inverse functions, and to avoid authentication problems caused by small differences between the challenge template and the example template, the biometric template can be quantized before it is transformed or encrypted. That is, for a given sampled biometric point (e.g., a point on a fingerprint), the point can be mapped to the next closest point. Another way to think about this is that the biometric can be downsampled. Because the probability that the challenge template may be the same as the example template is increased before the encryption function and / or transformation function is applied, the probability that the encrypted or transformed template is the same is also increased. This increases the tolerance for small changes between the biometric captured by the example and the challenge. By performing this quantization, the encrypted example and the encrypted challenge template can be compared without first decrypting them. The disadvantage of this method is that it reduces the accuracy of the biometric in determining identity.

[0016] Another way to solve this problem is to capture several biometric examples. For example, facial recognition examples of the user are captured under various lighting conditions and from various angles. All of these examples are then encrypted or transformed and stored. After a subsequent authentication attempt, the encrypted challenge template is compared to all of the examples. If one of them matches, the user is authenticated. This approach is expensive in terms of storage. Although a single template may be relatively small in terms of required storage, in an authentication service that may store biometric example templates for millions of users, the required storage quickly increases to double, triple, or even quadruple. In addition, because the authentication system needs to check the challenge template against not one but two or more example templates, the processing time is increased. If the authentication service is processing a large number of authentications, this additional processing time is not insignificant.

[0017] In some examples, methods, systems, devices, and machine-readable media for securing biometric data using distance-preserving transformations are disclosed. A distance-preserving transformation is a function that maps elements to the same or another metric space so that the distances between elements in the new metric space are equal to the distances between elements in the original metric space. Exemplary distance-preserving functions include translation, rotation, and reflection. Thus, if two points were distance X apart before the transformation, they remain distance X apart after the transformation. For example, if a template has a point (3, 5) and a second point (7, 8), then the distance is In a distance preserving function, any transformed template will preserve the distance. For example, if the transformed points are converted to (8, 10) and (12, 13), the distance between them will still be 5.

[0018] Distance-preserving functions protect biometric data by transforming it into a form that is not easily reversible. One advantage of using distance-preserving transforms for biometrics over other transforms is that local distortions on the device (such as fingerprint smudges or misalignment) are converted into similar distortions on the transformed biometric template. As already mentioned, the ability to tolerate some ambiguity in biometric data is important because the process of scanning a biometric has some degree of error associated with it. Because distance-preserving transforms do not change the relationships between points within a particular biometric, there is no need to apply quantization processes that reduce the accuracy of the biometric, nor is there a need to apply a decryption key before comparing the challenge template to the example template.

[0019] By utilizing a distance preserving transform, it becomes possible to compare a single transformed example to a transformed challenge template without decrypting the example or using multiple transformed examples. The transformed challenge template and the transformed example can be compared and if they are within a predetermined distance of each other, a match can be constituted. Since the computer system does not need to decrypt anything or check the challenge template against several examples, a significant improvement is provided in the functionality of the computer system by reducing the time required to authenticate a biometric challenge. Since a single example is stored, less storage is also required. In addition, this makes the disclosed process more secure because keys and inverse functions are not stored or utilized, so it is impossible for an attacker to gain access to the biometric.

[0020] Figure 1 A schematic data flow of a biometric system 100 according to some examples of the present disclosure is shown. During a setup phase, a user may present one or more biometric features 104, such as fingerprints, irises, faces, retina, etc., to a computing device 102. The computing device 102 may include one or more biometric scanners 106-A, such as a fingerprint reader, an iris scanner, a retina scanner, a camera (for facial recognition), etc. The scanner 106-A may digitize the biometric features. For example, for a fingerprint, a scanner may read patterns on a user's finger and convert them into digital representations of those patterns. A sampler 108-A may convert the digital representations of those patterns into a series of one or more data points. For example, the location of the ridges of a fingerprint, the distance between facial features for facial recognition (e.g., the distance between a nose and a mouth), etc., generates biometric data referred to as a biometric template. In some examples, the sampler 108-A may be part of the scanner 106-A. The biometric template generated during the setup phase may be referred to as an example biometric template 110.

[0021] The transformer 112-A may transform the example biometric template 110 into the protected example template 116 by applying a transformation function (e.g., a distance preserving function). The transformer applies the transformation function using one or more transformation function parameters 114. In some examples, to prevent replay attacks in the event that the protected example template 116 is stolen, the transformer 112-A may also apply one or more user-specific values ​​to modify the example biometric template (e.g., a random value). This allows the user to change the protected example template 116 by changing the user-specific values ​​in the event that the user-specific values ​​are compromised by re-registering with new user-specific values ​​(which produces a new protected example template 116). In other examples, the function parameters 114 may include user-specific values ​​that change the transformation applied based on the user-specific values ​​for the same reason and produce the same effect, namely, preventing replay attacks by changing the protected example template 116.

[0022] The protected example templates 116 may be stored locally on the computing device 102, or the protected example templates 116 may be transmitted to one or more network-based services, such as an authentication service 140, via a communication network. The authentication service 140 may have one or more server computing devices 142, one or more data storage devices (e.g., databases) 118, etc. The server computing device 142 may include or implement the comparator 120 (e.g., a hardware or software component of the server computing device 142). The protected example templates 116 may be stored in the database 118 and associated with an identifier of the user (e.g., a user name, password, or other credentials).

[0023] When the user wishes to use their biometrics for authentication later, the user can use the same computing device or a different computing device. Figure 1 As shown, the components labeled A and B can be the same component on the same device, or different instances of the same component on different computing devices. Figure 1 As shown, a different computing device 107 in the form of a laptop computing device is used. As part of the authentication process, the user presents his biometric 105 (which may be the same biometric as 104) to a scanner 106-B on the computing device 107. The sampler 108-B samples the biometric representation produced by the scanner 106-B in the same or similar process as that used by the sampler 108-A. This produces a challenge biometric template 126.

[0024] Transformer 112-B applies the same transformation function as applied by transformer 112-A using function parameters 128 (which may be the same function parameters as function parameters 114) to generate a protected challenge template 130. In examples where user-specific values ​​are applied, the user-specific values ​​may also be applied. The generated protected challenge template 130 may be compared with a protected example template 116 stored locally on a computing device (e.g., computing device 102 or 107 may implement comparator 120), or may be sent to an authentication service 140 via a communication network, where it is compared by comparator 120. Comparator 120 may then compare protected challenge template 130 with protected example template 116, and output a message or signal 124 granting access if they match, or a message or signal 122 denying access if they do not match. These messages or signals may be instructions to one or more computing devices (e.g., user computing devices (e.g., 102 and / or 107), third-party servers or services, etc.) indicating whether the authentication was successful or failed.

[0025] The comparator 120 may require an exact match - that is, unless the protected example template exactly matches the protected challenge template, an access denial message will be sent. In other examples, the comparator may have a threshold error level that can be tolerated and still grant access.

[0026] The function parameters 128 and 114 may be stored on the computing devices 102 and 107, or they may be stored on the authentication service 140. In examples where the transformers 112-A and 112-B are implemented on each computing device and the function parameters 128, 114 are stored at the network-based authentication service 140, the network-based authentication service 140 may send the function parameters to the computing devices 102, 107 for use in the transformers 112-A and 112-B to transform the biometric template into a protected template. In examples where the function parameters 128 and 114 are stored on each computing device, the network-based authentication service 140 may assist in distributing the function parameters 128, 114 to devices that are set up to use biometric authentication.

[0027] In some examples, transformers 112-A and 112-B use one or more distance preserving functions, such as one or more translations, rotations, and reflections. In some examples, function parameters 128 and 114 can be one or more of the following: selection of one or more translations, rotations, and reflections; and / or the number and / or magnitude of various transformations. For example, function parameters 128 and 114 can specify that translation and rotation are to be applied without reflection, and that the translation has a specific magnitude and the rotation is through a specific specified angle. In addition, the transformation can be a specific sequence of translations, rotations, and reflections, for example, the transformation can be a translation of a first magnitude, a rotation of a second angle, and a further translation of a third magnitude.

[0028] Function parameters 114, 128 may be randomly determined at registration, may be determined by a user, an administrator, pre-programmed into the system, etc. In some examples, the function parameters may be distributed to all user devices of the user. In some examples, the function parameters may reside in an authentication service and may be transmitted to computing devices 102 and 107 periodically or as part of an authentication procedure. In other examples where the function parameters reside in an authentication service, transformers 112-A and 112-B may be implemented in a network-based authentication service.

[0029] In other examples, the function parameters may be determined based on a secret of the user (e.g., a password; a public or private key; or a second biometric). For example, the secret may be input into a selection function to select function parameters, which are then used by transformers 112-A and 112-B to transform the example and challenge templates into protected templates. In some examples, the method provides an advantage in that the function parameters 114 and 128 are not stored, and therefore a method for assigning function parameters 114 is not required. In addition, if the protected example template 116 is compromised, then in the event that an attacker injects the protected example template 116 during authentication without providing the biometrics 104, 105, the user can change the protected example template 116 by changing the secret and re-registering the example to prevent replay attacks.

[0030] As a simple example, a user secret in password form can be represented by a series of Unicode numbers. These numbers can correspond to a sequence of translations, rotations, and reflections. For example, a password: "password 1234" can be converted to the numbers 112, 097, 115, 115, 119, 111, 114, 100, 049, 050, 051, 052. In some examples, this is applied to a pattern. For example, a translation of 112, then a rotation of 097 degrees, then a reflection (115 mod 2) = 1 time, then a translation of 115, then a rotation of 119 degrees, and so on. In these examples, the user can apply their password both at registration and later when authenticating.

[0031] Scanners 106-A and 106B; samplers 108-A and 108B; transformers 112-A and 112-B; and comparator 120 may be implemented in hardware or software of a computing device (e.g., computing devices 102, 107 or server computing device 142). Although some functions are Figure 1 106-A, 106-B, samplers 108-A, 108-B, and one or more of transformers 112-A and 112-B may be implemented in network-based authentication service 140, and one or more of database 118 and comparator 120 may be implemented in device 102 or 107.

[0032] Figure 2 A flow chart of a method 200 for applying a distance-preserving function to secure a biometric template according to some examples of the present disclosure is shown. At operation 220, a computing device may receive one or more data points representing a biometric characteristic of a user. For example, a biometric template generated by a sampler is applied to data captured by a scanning device. At operation 225, a computing device may determine one or more parameters used in a transformation function. As previously described, the parameters may be stored locally on the device or retrieved from a network-based authentication service. In other examples, the parameters are determined based on a secret (e.g., a password, a second biometric, etc.) input by a user, which is applied to a selection function for selecting the parameters.

[0033] At operation 230, one or more distance preserving functions are applied to the biometric data using the parameters determined from operation 225. For example, a number of one or more translations, rotations, and / or reflections may be applied to the data. In some examples, the parameters may be or include user-specific values, such as random numbers, user-specified values ​​(e.g., passwords), values ​​in a secure digital certificate, a second biometric template of the user, and the like. In other examples, the user-specific values ​​may be applied as a transformation to the biometric template prior to the transformation at operation 240 (e.g., the transformation at operation 240 is a second transformation). In some examples, the user-specific values ​​are not a representation of the user's biometric. If the biometric is compromised, the user may change the user-specific values, thereby changing the transformed biometric to prevent replay attacks.

[0034] At operation 240, the protected biometric template may be utilized. For example, by sending the protected biometric template to an authentication server of an authentication service to store it as an example. As another example, the protected biometric template may be utilized by sending the protected biometric template to an authentication server of an authentication service, which compares it to a stored example as part of an authentication attempt. In other examples, the protected biometric template may be utilized by a local computing device, as it may store the protected biometric template as an example or compare it to a stored example to determine if there is a match.

[0035] Figure 3 A flow chart of a method 300 of applying a distance preservation function to authenticate using a network-based authentication service according to some examples of the present disclosure is shown. Figure 3 yes Figure 2 A detailed embodiment of Figure 2 as part of an authentication attempt. At operation 350, the computing device may capture biometric data. At operation 360, the biometric data may be sampled to create a biometric template. At operation 365, the system may determine parameters of the distance-keeping function. The parameters may include the type of distance-keeping function, the angle or magnitude of the transformation, and the like. At operation 370, one or more distance-keeping functions are applied to the biometric template to produce a protected biometric template. At operation 380, the secure template is sent to a network-based authentication service as part of the challenge process, which includes a user identifier and a protected challenge template. In some examples, in addition to the transformation function, the secure biometric template may be additionally encrypted during transmission (e.g., using TLS) or during storage for an additional security layer. At operation 390, the computing device may receive an authentication result. In some examples, the result of the authentication is used to provide or deny access to one or more computing resources of the computing device or another computing device to the user. Example computing resources protected by authentication include access to one or more accounts, access to a computing device, unlocking a computing device, logging into an account of a computing device, obtaining access to one or more files, and the like.

[0036] Figure 4 4 shows a flow chart of a method 400 for authentication services according to some examples of the present disclosure. At operation 410, a message related to an authentication function is received. For example, from a user such as Figure 1The message may be received via one or more communication networks. Example network types may include one or more packet-based networks, circuit-switched networks, etc. Specific examples of communication networks include the Internet, a wide area network (WAN), a local area network (LAN), a plain old telephone system (POTS) network, etc. In other examples, the message may be executed on the user computing device itself. Figure 4 The method steps can therefore receive messages through inter-process communication technology, mailboxes, events, function calls, shared memory, etc.

[0037] The message may include one or more of a protected example template (e.g., such as protected example template 116), a protected challenge template (e.g., protected challenge template 130), a user identifier, a message type identifying the type of message, and the like. A determination may be made at operation 415 (e.g., using the message type) that evaluates whether the message is a configuration operation or an authentication attempt. Configuration operations include registration of a new user, changing a biometric example stored for the user, and the like. An authentication attempt is a request to authenticate a user against a stored example template.

[0038] If the message is a configuration message for registering an example biometric template or replacing an existing biometric template, then at operation 420, the system determines whether the user is authorized to continue. For example, whether the user is allowed to register with the authorization system, whether the user is authorized to replace his existing biometric example template, and so on. For example, the user can provide a username, password, biometric, user ID or other identifier. The user's credentials can be checked at operation 420 to ensure that they are valid. In some examples, a new account can be created at operation 420. At operation 425, if the user is authorized, the example template can be stored and can be linked to the user's account. At operation 430, a success message can be returned. If the user is not authorized, then at operation 435, the authentication system can return an error.

[0039] If at operation 415, the message is requesting user authentication, the system can retrieve a secure example biometric template at operation 445. For example, the system can locate a stored user profile for a user that matches the user identification provided in the request message received at operation 410. The secure example biometric template can be retrieved from local storage, from a network-based authentication service (e.g., in the following example: the example biometric template can be stored in a network-based authentication service, but can be compared on a local machine), etc. At operation 450, a check is made to determine whether a secure example was found. If not, at operation 440, the system can return failure. If a secure biometric example template is found, at operation 455, the secure biometric example template can be compared to the template (e.g., challenge template) provided in the request message received at operation 410. As noted, if the templates match or are within a threshold distance of each other, the system can determine that they match at operation 460, and send a success message at operation 470 to grant access to one or more computing devices. If the templates do not match, then at operation 440 the system may send a failure message.

[0040] Figure 5 A schematic diagram of a user computing device 505 and a network-based authentication service 540 is shown according to some examples of the present disclosure. Figure 5 The components shown may be implemented as hardware, software, or a combination of hardware and software. The components of network-based authentication service 540 may be implemented by one or more computing devices (e.g., server computing devices). As previously described, computing device 505 and network-based authentication service 540 may communicate using one or more communication networks (e.g., the Internet, WAN, LAN, etc.). Computing device 505 may be a Figure 1 The network-based authentication service 540 may be an example of a computing device 102 and / or 107. Figure 1 As previously described, some or all of the functionality of the computing device 505 may be implemented by the network-based authentication service 540, and some or all of the functionality of the network-based authentication service 540 may be implemented by the computing device 505.

[0041] The computing device 505 may include one or more biometric scanners 506, such as a fingerprint sensor, a camera (for facial recognition), an iris scanner, a microphone (for voiceprint), etc. The scanner 506 may be Figure 1 The scanner 506 may generate a digital representation of one or more biometric features of a user. For example, an image of a person's face, an image of an iris, an image of a fingerprint, etc. The sampler 508 may be from Figure 1The samplers 108-A and 108-B are examples of the samplers 108-A and 108-B, and can convert the digital representation of the scanned biometric output by the scanner 506 into a series of one or more points, such as a matrix or vector of values. For example, the sampler 508 can detect the location of the ridges of the fingerprint; the distance between the ridges, valleys and other features; the location of facial features; the distance between facial features for facial recognition (e.g., the distance between the nose and the mouth); the voice pattern; the pattern in the iris or retina; etc., to produce biometric data called a biometric template.

[0042] The templates may be transformed using a transformer 512, which may be an example of transformer 112-A and / or 112-B. For example, transformer 512 may apply one or more distance preserving transformations, such as translation, rotation, and reflection. The transformed template may be referred to as a protected template and stored in storage unit 537 or storage unit 585. Transformer 512 may utilize one or more function parameters that specify the distance preserving function to be applied and the magnitude and / or angle of change. Each point in the template may be transformed by the same function and have the same magnitude and / or angle of change. As previously described, the function parameters may be pre-selected or predetermined; based on a secret selection of the user, such as a password or another different biometric feature of the user or a different portion of the same biometric feature (e.g., another fingerprint or another portion of a fingerprint); as part of a digital certificate or encryption key associated with the user; and the like. In some examples, transformer 512 and the function parameters may be a matrix multiplication that multiplies the biometric template by a matrix representing one or more distance preserving functions.

[0043] The user interface 515 may provide one or more user interfaces to allow the user to input or present their biometrics and authenticate. The user interface 515 may also present one or more computer resources that are restricted from access by biometric authentication, i.e., at the time of authentication, the user interface 515 may present one or more user interfaces of one or more computer resources that were previously inaccessible to the user before authentication. The network interface 530 may provide one or more network interfaces and functions for communicating using a communication network. Examples include providing a communication protocol, such as a communication protocol described by the IEEE 802.11 standard, an Ethernet standard, an Internet Protocol (IP) standard, a Transmission Control Protocol (TCP) standard, etc. In addition, the network interface 530 may be configured to implement a protocol to communicate with a network-based authentication service via a defined protocol (e.g., a Representational State Transfer (REST) ​​protocol).

[0044] Authenticator 535 can combine user interface 515, scanner 506, sampler 508, transformer 512, storage unit 537 and network interface 530 to create a user interface, accept user input, and otherwise provide users with registration of biometric examples, use distance preservation functions to protect the security of biometric examples, attempt to use biometrics for authentication later, send biometric templates transformed using distance preservation functions to a network-based authentication service (for storage or comparison), or store the transformed biometric template locally and authenticate (compare) locally. In some examples, function parameters (e.g., parameter sets) can be stored in storage unit 537.

[0045] The web-based authentication service 540 may be Figure 1 An example of a network-based authentication service 140 of FIG. 50 is provided. The comparator 520 compares two protected biometric templates, such as a sample biometric template and a challenge biometric template, and determines whether they are close enough to constitute a match. For example, whether they match within a predetermined similarity (e.g., distance).

[0046] The authentication interface 560 can interface with the user computing device 505 and other computing devices to authenticate the user of the computing device 505. For example, a third-party computing device may seek to authenticate a user by using biometrics. The third-party computing device may contact the authentication interface 560 to authenticate the user. The authentication interface 560 then requests user authentication by sending an authentication request to the computing device 505. The computing device 505 then collects the biometrics, transforms the template, and sends it to the authentication interface 560. The authentication interface 560 then passes the received protected biometric template to the comparator 520. The authentication interface 560 then passes the result generated by the comparator 520 back to the third-party requester. In other examples, the protected computing resource may be on the computing device 505. For example, a user of the computing device 505 may attempt to access a protected resource on the computing device 505 (e.g., log in to the device, unlock the device, access certain files and / or directories, etc.). The computing device 505 may contact the authentication interface 560 of the network-based authentication service 540 to authenticate the user. The results of the authentication may be sent back to the computing device 505, which may allow the user (depending on the results) to access protected resources. A protected resource is any computer data (e.g., files, messages, programs), functionality, or access that is restricted to a specific user and that the user must authenticate to access.

[0047] In some examples, the network-based authentication service can include a transformer 575. For example, the function parameters can be stored in the network-based authentication service 540. In some examples, the computing device 505 sends an unprotected challenge template to the network-based authentication service, which then transforms it to compare with the protected template. In other examples, the distributor 580 can manage the distribution of the function parameters to one or more devices, such as the computing device 505.

[0048] The network interface 582 may provide one or more network interfaces and functions for communicating using a communication network. Examples include providing communication protocols, such as those described by the IEEE 802.11 standard, the Ethernet standard, the Internet Protocol (IP) standard, the Transmission Control Protocol (TCP) standard, etc. In addition, the network interface 582 may be configured to implement a protocol to communicate with the computing device 505 via a defined protocol (e.g., the Representational State Transfer (REST) ​​protocol). The storage unit 585 may store protected examples, function parameters, user identifiers and / or profiles, etc.

[0049] Although the disclosed embodiments focus on protecting biometrics, the disclosed use of distance preserving functions can be applicable to other types of information and data. For example, one or more distance preserving functions can be applied to other types of sensitive information described herein for biometric data, such as other credentials of a user (e.g., username and / or password), user health data (e.g., for government requirements), social security number, government identification number, financial information, transaction information, bank account information, etc. Information transformed by one or more distance preserving functions can be stored in a network-based storage unit and then accessed later without worrying about the information being stolen. As described above, any subsequent comparison of this information with other information can not only look for a direct match, but also allow for a certain tolerance for differences.

[0050] Other example uses may include transforming a document using a distance preserving function. The example document may later be compared to a challenge document (in the same manner as a biometric template) to see if they match or are similar. The document may be protected from exposure by a distance preserving function. Other examples may include transforming watermarks, cryptographic keys, etc.

[0051] Figure 6A block diagram of an example machine 600 is shown on which any one or more of the techniques (e.g., methods) discussed herein may be implemented. In alternative embodiments, the machine 600 may operate as a standalone device or may be connected (e.g., networked) to other machines. In a networked deployment, the machine 600 may operate as a server machine, a client machine, or both in a server-client network environment. In an example, the machine 600 may be used as a peer machine in a peer-to-peer (P2P) (or other distributed) network environment. The machine 600 may be a server, user device, personal computer (PC), tablet PC, set-top box (STB), personal digital assistant (PDA), mobile phone, smart phone, network appliance, network router, switch or bridge, or any machine capable of executing (sequentially or otherwise) instructions that specify actions to be performed by the machine. One or more machines 600 may implement the system 100, the network-based authentication service 540, the computing device 505, and be configured to perform Figure 2-Figure 4 Further, while a single machine is illustrated, the term “machine” shall also be taken to include any collection of machines that individually or jointly execute a set (or multiple sets) of instructions to perform any one or more of the methodologies discussed herein, such as cloud computing, Software as a Service (SaaS), and other computer cluster configurations.

[0052] As described herein, examples may include or may operate on: a logic unit, or a plurality of components, modules, or mechanisms ("modules"). A module is a tangible entity (e.g., hardware) that is capable of performing a specified operation and may be configured or arranged in a certain manner. In one example, a circuit may be arranged (e.g., intrinsically or relative to an external entity such as other circuits) as a module in a specified manner. In an example, a portion or the entirety of one or more computer systems (e.g., a separate client or server computer system), or one or more hardware processors may be configured by firmware or software (e.g., instructions, application portions, or applications) as a module that operates to perform a specified operation. In an example, the software may be located on a machine-readable medium. In an example, when executed by the underlying hardware of the module, the software causes the hardware to perform a specified operation.

[0053] Thus, it should be understood that the term "module" encompasses a tangible entity that is physically constructed, specifically configured (e.g., hardwired) or temporarily configured (e.g., programmed) to operate in a specified manner, or to perform part or all of any operations described herein. Considering examples in which modules are temporarily configured, each of these modules need not be instantiated at any one time. For example, where the modules include a general-purpose hardware processor configured using software, the general-purpose hardware processor can be configured as various different modules at different times. The software can configure the hardware processor accordingly, for example, so as to construct a particular module at one time and to constitute a different module at a different time.

[0054] The machine (e.g., computer system) 600 may include a hardware processor 602 (e.g., a central processing unit (CPU), a graphics processing unit (GPU), a hardware processor core, or any combination thereof), a main memory 604, and a static memory 606, some or all of which may communicate with each other via an interconnection link (e.g., a bus) 608. The machine 600 may also include a display unit 610, an alphanumeric input device 612 (e.g., a keyboard), and a user interface (UI) navigation device 614 (e.g., a mouse). In an example, the display unit 610, the input device 612, and the UI navigation device 614 may be a touch screen display. The machine 600 may also include a storage device (e.g., a drive unit) 616, a signal generating device 618 (e.g., a speaker), a network interface device 620, and one or more sensors 621 (such as a global positioning system (GPS) sensor, a compass, an accelerometer, or other sensors). The machine 600 may include an output controller 628, such as a serial (e.g., Universal Serial Bus (USB), parallel, or other wired or wireless (e.g., infrared (IR), near field communication (NFC), etc.) connection to communicate with or control one or more peripheral devices (e.g., a printer, a card reader, etc.).

[0055] The storage device 616 may include a machine-readable medium 622 on which is stored one or more sets of data structures or instructions 624 (e.g., software) embodying or used by any one or more of the techniques or functionality described herein. The instructions 624 may also reside, completely or at least partially, within the main memory 604, within the static memory 606, or within the hardware processor 602 during execution of the instructions by the machine 600. In one example, one or any combination of the hardware processor 602, the main memory 604, the static memory 606, or the storage device 616 may constitute a machine-readable medium.

[0056] Although machine-readable medium 622 is illustrated as a single medium, the term “machine-readable medium” may include a single medium or multiple media (eg, a centralized or distributed database, and / or associated caches and servers) configured to store one or more instructions 624 .

[0057] The term "machine-readable medium" may include any medium that is capable of storing, encoding, or carrying instructions for execution by the machine 600, and causing the machine 600 to perform any one or more of the techniques in the present disclosure, or capable of storing, encoding, or carrying data structures used by or associated with these instructions. Non-limiting examples of machine-readable media may include solid-state memory and optical and magnetic media. Specific examples of machine-readable media may include non-volatile memory (such as semiconductor memory devices (e.g., electrically programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM))), and flash memory devices, disks (such as internal hard disks and removable disks), magneto-optical disks, random access memory (RAM), solid-state drives (SSDs), and CD-ROM and DVD-ROM disks. In some examples, the machine-readable medium may include non-temporary machine-readable media. In some examples, the machine-readable medium may include non-temporary machine-readable media, such as non-temporary propagation signals.

[0058] The instructions 624 may also be sent or received over a communication network 626 using a transmission medium via the network interface device 620. The machine 600 may communicate with one or more other machines using any of a variety of transmission protocols, such as frame relay, Internet Protocol (IP), transmission control protocol (TCP), user datagram protocol (UDP), hypertext transfer protocol (e.g., HTTP), etc. Example communication networks may include a local area network (LAN), a wide area network (WAN), a packet data network (e.g., the Internet), a mobile telephone network (e.g., a cellular network), a plain old telephone (POTS) network, and a wireless data network (e.g., a wireless network known as a cellular network). The Institute of Electrical and Electronics Engineers (IEEE) 802.11 series of standards, known as IEEE 802.16 family of standards), IEEE 802.15.4 family of standards, Long Term Evolution (LTE) family of standards, Universal Mobile Telecommunications System (UMTS) family of standards, peer-to-peer (P2P) networks, and the like. In one example, the network interface device 620 may include one or more physical jacks (e.g., Ethernet, coaxial cable, or telephone jacks) or one or more antennas connected to the communication network 626. In one example, the network interface device 620 may include multiple antennas to communicate wirelessly using at least one of single-input multiple-output (SIMO), multiple-input multiple-output (MIMO), or multiple-input single-output (MISO) technology. In some examples, the network interface device 620 may use multi-user MIMO technology for wireless communication.

[0059] Additional Notes and Examples

[0060] Example 1 is a method for protecting the security of biometric data used in authentication of a user of a computing device, the method comprising: using one or more hardware processors: receiving a first set of data points representing biometric characteristics of the user; determining a set of function parameters for a distance-preserving transformation; transforming the received first set of data points into a second set of data points using the distance-preserving transformation and the set of function parameters; and invoking an authentication operation for the user by sending the second set of data points to a network-based authentication service over a communications network.

[0061] In Example 2, the subject matter of Example 1 includes, wherein the authentication operation is a registration operation, the registration operation causing the network-based authentication service to store the second set of data points in association with an identifier of the user.

[0062] In Example 3, the subject matter of Examples 1-2 includes, wherein the authentication operation is an authentication request, and wherein the method further includes: receiving a notification that the second set of data points matches a stored set of data points stored at the network-based authentication service; and based on the notification, providing the user with access to resources provided by the one or more hardware processors.

[0063] In Example 4, the subject matter of Examples 1-3 includes, wherein the authentication operation is an authentication request, and wherein the method further includes: receiving a notification that the second set of data points does not match a set of data points stored on the network-based authentication service; and based on the notification, denying access to resources provided by the one or more hardware processors.

[0064] In Example 5, the subject matter of Examples 1-4 includes, wherein the distance preserving transformation comprises one or more of: a rotation, a translation, or a reflection of the first set of data points.

[0065] In Example 6, the subject matter of Example 5 includes, wherein the set of function parameters includes one or more of: a rotation angle, a translation amplitude, or a number of reflections.

[0066] In Example 7, the subject matter of Example 6 includes, wherein the method further comprises: selecting the set of function parameters based on a third set of data points describing a digitized representation of a second biometric characteristic of the user.

[0067] In Example 8, the subject matter of Examples 6-7 includes, wherein the method further comprises: determining the set of function parameters based on a secret value corresponding to the user.

[0068] In Example 9, the subject matter of Example 8 includes, wherein the secret value does not correspond to a representation of a biometric characteristic of the user.

[0069] In Example 10, the subject matter of Examples 8-9 includes, wherein the secret value is contained in a user-specific digital certificate.

[0070] In Example 11, the subject matter of Examples 8-10 includes, wherein transforming the received first set of data points to the second set of data points comprises: transforming the received set of data points to the second set of data points using a user-specific value and the distance-preserving transformation.

[0071] In Example 12, the subject matter of Example 11 includes, wherein the method further includes: receiving an indication that the second set of data points has been compromised, and in response: selecting a second user-specific value; receiving a third set of data points describing a digitized representation of the biometric characteristic of the user; transforming the received third set of data points into a fourth set of data points using the distance-preserving transformation and the second user-specific value; and sending the fourth set of data points to the network-based authentication service via the communication network.

[0072] In Example 13, the subject matter of Examples 1-12 includes, wherein the biometric characteristic includes one of: fingerprint data, iris data, facial recognition data, voiceprint data, or physiological data.

[0073] Example 14 is a machine-readable medium comprising instructions for protecting the security of biometric data used in authentication of a user of a computing device, which when executed causes the machine to perform operations including: receiving a first set of data points representing biometric characteristics of the user; determining a set of function parameters for a distance-preserving transformation; transforming the received first set of data points into a second set of data points using the distance-preserving transformation and the set of function parameters; and invoking an authentication operation for the user by sending the second set of data points to a network-based authentication service over a communications network.

[0074] In Example 15, the subject matter of Example 14 includes, wherein the authentication operation is a registration operation, the registration operation causing the network-based authentication service to store the second set of data points in association with an identifier of the user.

[0075] In Example 16, the subject matter of Examples 14-15 includes, wherein the authentication operation is an authentication request, and wherein the operation further includes: receiving a notification that the second set of data points matches a stored set of data points stored at the network-based authentication service; and based on the notification, providing the user with access to resources provided by the one or more hardware processors.

[0076] In Example 17, the subject matter of Examples 14-16 includes, wherein the authentication operation is an authentication request, and wherein the operation further includes: receiving a notification that the second set of data points does not match a set of data points stored on the network-based authentication service; and based on the notification, denying access to resources provided by the one or more hardware processors.

[0077] In Example 18, the subject matter of Examples 14-17 includes, wherein the distance preserving transformation comprises one or more of: a rotation, a translation, or a reflection of the first set of data points.

[0078] In Example 19, the subject matter of Example 18 includes, wherein the set of function parameters includes one or more of: a rotation angle, a translation amplitude, or a number of reflections.

[0079] In Example 20, the subject matter of Example 19 includes, wherein the operations further include: selecting the set of function parameters based on a third set of data points describing a digitized representation of a second biometric characteristic of the user.

[0080] In Example 21, the subject matter of Examples 19-20 includes, wherein the operations further include determining the set of function parameters based on a secret value corresponding to the user.

[0081] In Example 22, the subject matter of Example 21 includes, wherein the secret value does not correspond to a representation of a biometric characteristic of the user.

[0082] In Example 23, the subject matter of Examples 21-22 includes, wherein the secret value is contained in a user-specific digital certificate.

[0083] In Example 24, the subject matter of Examples 21-23 includes, wherein the operation of transforming the received first set of data points into the second set of data points includes: transforming the received set of data points into the second set of data points using a user-specific value and the distance-preserving transformation.

[0084] In Example 25, the subject matter of Example 24 includes, wherein the operation further includes: receiving an indication that a second set of data points has been compromised, and in response: selecting a second user-specific value; receiving a third set of data points describing a digitized representation of the biometric characteristic of the user; transforming the received third set of data points into a fourth set of data points using the distance-preserving transformation and the second user-specific value; and sending the fourth set of data points to the network-based authentication service via the communication network.

[0085] In Example 26, the subject matter of Examples 14-25 includes, wherein the biometric characteristic includes one of: fingerprint data, iris data, facial recognition data, voiceprint data, or physiological data.

[0086] Example 27 is a computing device for protecting the security of biometric data used in authentication, the computing device comprising: a processor; a memory comprising instructions that, when executed by the processor, cause the processor to perform operations comprising: receiving a first set of data points representing biometric characteristics of the user; determining a set of function parameters for a distance-preserving transformation; transforming the received first set of data points into a second set of data points using the distance-preserving transformation and the set of function parameters; and invoking an authentication operation for the user by sending the second set of data points to a network-based authentication service over a communications network.

[0087] In Example 28, the subject matter of Example 27 includes, wherein the authentication operation is a registration operation, the registration operation causing the network-based authentication service to store the second set of data points in association with an identifier of the user.

[0088] In Example 29, the subject matter of Examples 27-28 includes, wherein the authentication operation is an authentication request, and wherein the operation further includes: receiving a notification that the second set of data points matches a stored set of data points stored at the network-based authentication service; and based on the notification, providing the user with access to resources provided by the one or more hardware processors.

[0089] In Example 30, the subject matter of Examples 27-29 includes, wherein the authentication operation is an authentication request, and wherein the operation further includes: receiving a notification that the second set of data points does not match a set of data points stored on the network-based authentication service; and based on the notification, denying access to resources provided by the one or more hardware processors.

[0090] In Example 31, the subject matter of Examples 27-30 includes, wherein the distance preserving transformation comprises one or more of: a rotation, a translation, or a reflection of the first set of data points.

[0091] In Example 32, the subject matter of Example 31 includes, wherein the set of function parameters includes one or more of: a rotation angle, a translation amplitude, or a number of reflections.

[0092] In Example 33, the subject matter of Example 32 includes, wherein the operations further include: selecting the set of function parameters based on a third set of data points describing a digitized representation of a second biometric characteristic of the user.

[0093] In Example 34, the subject matter of Examples 32-33 includes, wherein the operations further include determining the set of function parameters based on a secret value corresponding to the user.

[0094] In Example 35, the subject matter of Example 34 includes, wherein the secret value does not correspond to a representation of a biometric characteristic of the user.

[0095] In Example 36, the subject matter of Examples 34-35 includes, wherein the secret value is contained in a user-specific digital certificate.

[0096] In Example 37, the subject matter of Examples 34-36 includes, wherein the operation of transforming the received first set of data points into the second set of data points includes: transforming the received set of data points into the second set of data points using a user-specific value and the distance-preserving transformation.

[0097] In Example 38, the inventive subject matter of Example 37 includes, wherein the operation further includes: receiving an indication that a second set of data points has been compromised, and in response: selecting a second user-specific value; receiving a third set of data points describing a digitized representation of the biometric characteristic of the user; transforming the received third set of data points into a fourth set of data points using the distance-preserving transformation and the second user-specific value; and sending the fourth set of data points to the network-based authentication service via the communication network.

[0098] In Example 39, the subject matter of Examples 27-38 includes, wherein the biometric characteristic comprises one of: fingerprint data, iris data, facial recognition data, voiceprint data, or physiological data.

[0099] Example 40 is a device for protecting the security of biometric data used in authentication of a user, the device comprising: a unit for receiving a first set of data points representing biometric characteristics of the user; a unit for determining a set of function parameters for a distance-preserving transformation; a unit for transforming the received first set of data points into a second set of data points using the distance-preserving transformation and the set of function parameters; and a unit for invoking an authentication operation for the user by sending the second set of data points to a network-based authentication service over a communication network.

[0100] In Example 41, the subject matter of Example 40 includes, wherein the authentication operation is a registration operation, the registration operation causing the network-based authentication service to store the second set of data points in association with an identifier of the user.

[0101] In Example 42, the subject matter of Examples 40-41 includes, wherein the authentication operation is an authentication request, and wherein the device further includes: a unit for receiving a notification that the second set of data points matches a stored set of data points stored at the network-based authentication service; and a unit for providing the user with access to resources provided by the one or more hardware processors based on the notification.

[0102] In Example 43, the subject matter of Examples 40-42 includes, wherein the authentication operation is an authentication request, and wherein the device further includes: a unit for receiving the following notification: the second set of data points does not match the set of data points stored on the network-based authentication service; and a unit for denying access to resources provided by the one or more hardware processors based on the notification.

[0103] In Example 44, the subject matter of Examples 40-43 includes, wherein the distance preserving transformation comprises one or more of: a rotation, a translation, or a reflection of the first set of data points.

[0104] In Example 45, the subject matter of Example 44 includes, wherein the set of function parameters includes one or more of: a rotation angle, a translation amplitude, or a number of reflections.

[0105] In Example 46, the subject matter of Example 45 includes, wherein the device further comprises: a unit for selecting the set of function parameters based on a third set of data points describing a digitized representation of a second biometric characteristic of the user.

[0106] In Example 47, the subject matter of Examples 45-46 includes, wherein the device further comprises: means for determining the set of function parameters based on a secret value corresponding to the user.

[0107] In Example 48, the subject matter of Example 47 includes, wherein the secret value does not correspond to a representation of a biometric characteristic of the user.

[0108] In Example 49, the subject matter of Examples 47-48 includes, wherein the secret value is contained in a user-specific digital certificate.

[0109] In Example 50, the subject matter of Examples 47-49 includes, wherein the unit for transforming the received first set of data points into the second set of data points includes: a unit for transforming the received set of data points into the second set of data points using a user-specific value and the distance-preserving transformation.

[0110] In Example 51, the subject matter of Example 50 includes, wherein the device further includes: a unit for receiving the following indication: a second set of data points has been compromised, and in response: a unit for selecting a second user-specific value; a unit for receiving a third set of data points describing a digitized representation of the biometric characteristic of the user; a unit for transforming the received third set of data points into a fourth set of data points using the distance-preserving transformation and the second user-specific value; and a unit for sending the fourth set of data points to the network-based authentication service via the communication network.

[0111] In Example 52, the subject matter of Examples 40-51 includes, wherein the biometric characteristic includes one of: fingerprint data, iris data, facial recognition data, voiceprint data, or physiological data.

[0112] Example 53 is a method for protecting the security of sensitive data in a network-based service, the method comprising: using one or more hardware processors: receiving input data items via a network; determining a set of function parameters for a distance-preserving transformation; transforming the received input data items into output data items using the distance-preserving transformation and the set of function parameters; and storing the output data items in a storage device of the network-based service.

[0113] In Example 54, the subject matter of Example 53 includes, wherein the method further includes: receiving an authentication request including a third data item; determining that the third data item and the output data item match within a predetermined threshold; and granting the user access to the computing resource.

[0114] In Example 55, the subject matter of Examples 53-54 includes, wherein the method further includes: receiving an authentication request including a third data item; determining that the third data item and the output data item do not match within a predetermined threshold; and causing the user to be denied access to the computing resource.

[0115] In Example 56, the subject matter of Examples 53-55 includes, wherein the input data item comprises one of: an authentication certificate; an encryption key; or a watermark.

[0116] In Example 57, the subject matter of Examples 53-56 includes, wherein the distance preserving transformation comprises one or more of: a rotation, a translation, or a reflection of the first data item.

[0117] In Example 58, the subject matter of Example 57 includes, wherein the set of function parameters includes one or more of: a rotation angle, a translation amplitude, or a number of reflections.

[0118] In Example 59, the subject matter of Example 58 includes, wherein the method further comprises: determining the set of function parameters based on a secret value corresponding to the user.

[0119] In Example 60, the subject matter of Example 59 includes, wherein the secret value does not correspond to a representation of a biometric characteristic of the user.

[0120] In Example 61, the subject matter of Examples 59-60 includes, wherein the secret value is contained in a user-specific digital certificate.

[0121] In Example 62, the subject matter of Examples 59-61 includes, wherein the method further includes: receiving an indication that the output data item is accessed by an unauthorized party, and in response: selecting a second user-specific value; receiving a third data item; transforming the third data item into a fourth data item using the distance-preserving transformation and the second user-specific value; and replacing the output data item in the storage device of the network-based service with the third data item.

[0122] Example 63 is a secure machine-readable medium for protecting sensitive data in a network-based service, the machine-readable medium comprising instructions that, when executed by a machine, cause the machine to perform operations comprising: receiving an input data item over a network; determining a set of function parameters for a distance-preserving transformation; transforming the received input data item into an output data item using the distance-preserving transformation and the set of function parameters; and storing the output data item in a storage device of the network-based service.

[0123] In Example 64, the subject matter of Example 63 includes, wherein the operation further includes: receiving an authentication request including a third data item; determining that the third data item and the output data item match within a predetermined threshold; and causing the user to be granted access to the computing resource.

[0124] In Example 65, the subject matter of Examples 63-64 includes, wherein the operation further includes: receiving an authentication request including a third data item; determining that the third data item and the output data item do not match within a predetermined threshold; and causing the user to be denied access to the computing resource.

[0125] In Example 66, the subject matter of Examples 63-65 includes, wherein the input data item comprises one of: an authentication certificate; an encryption key; or a watermark.

[0126] In Example 67, the subject matter of Examples 63-66 includes, wherein the distance preserving transformation comprises one or more of: a rotation, a translation, or a reflection of the first data item.

[0127] In Example 68, the subject matter of Example 67 includes, wherein the set of function parameters includes one or more of: a rotation angle, a translation amplitude, or a number of reflections.

[0128] In Example 69, the subject matter of Example 68 includes, wherein the operation further comprises: determining the set of function parameters based on a secret value corresponding to the user.

[0129] In Example 70, the subject matter of Example 69 includes, wherein the secret value does not correspond to a representation of a biometric characteristic of the user.

[0130] In Example 71, the subject matter of Examples 69-70 includes, wherein the secret value is contained in a user-specific digital certificate.

[0131] In Example 72, the subject matter of Examples 69-71 includes, wherein the operation further includes: receiving an indication that the output data item is accessed by an unauthorized party, and in response: selecting a second user-specific value; receiving a third data item; transforming the third data item into a fourth data item using the distance-preserving transformation and the second user-specific value; and replacing the output data item in the storage device of the network-based service with the third data item.

[0132] Example 73 is a computing device for protecting the security of sensitive data in a network-based service, the computing device comprising: a processor; and a memory storing instructions that, when executed by the processor, cause the processor to perform operations including: receiving input data items over a network; determining a set of function parameters for a distance-preserving transformation; transforming the received input data items into output data items using the distance-preserving transformation and the set of function parameters; and storing the output data items in a storage device of the network-based service.

[0133] In Example 74, the subject matter of Example 73 includes, wherein the operation further includes: receiving an authentication request including a third data item; determining that the third data item and the output data item match within a predetermined threshold; and causing the user to be granted access to the computing resource.

[0134] In Example 75, the subject matter of Examples 73-74 includes, wherein the operation further includes: receiving an authentication request including a third data item; determining that the third data item and the output data item do not match within a predetermined threshold; and causing the user to be denied access to the computing resource.

[0135] In Example 76, the subject matter of Examples 73-75 includes, wherein the input data item comprises one of: an authentication certificate; an encryption key; or a watermark.

[0136] In Example 77, the subject matter of Examples 73-76 includes, wherein the distance preserving transformation comprises one or more of: a rotation, a translation, or a reflection of the first data item.

[0137] In Example 78, the subject matter of Example 77 includes, wherein the set of function parameters includes one or more of: a rotation angle, a translation amplitude, or a number of reflections.

[0138] In Example 79, the subject matter of Example 78 includes, wherein the operation further comprises: determining the set of function parameters based on a secret value corresponding to the user.

[0139] In Example 80, the subject matter of Example 79 includes, wherein the secret value does not correspond to a representation of a biometric characteristic of the user.

[0140] In Example 81, the subject matter of Examples 79-80 includes, wherein the secret value is contained in a user-specific digital certificate.

[0141] In Example 82, the subject matter of Examples 79-81 includes, wherein the operation further includes: receiving an indication that the output data item is accessed by an unauthorized party, and in response: selecting a second user-specific value; receiving a third data item; transforming the third data item into a fourth data item using the distance-preserving transformation and the second user-specific value; and replacing the output data item in the storage device of the network-based service with the third data item.

[0142] Example 83 is a device for protecting the security of sensitive data in a network-based service, the device comprising: a unit for receiving input data items via a network; a unit for determining a set of function parameters for a distance-preserving transformation; a unit for transforming the received input data items into output data items using the distance-preserving transformation and the set of function parameters; and a unit for storing the output data items in a storage device of the network-based service.

[0143] In Example 84, the subject matter of Example 83 includes, wherein the device further includes: a unit for receiving an authentication request including a third data item; a unit for determining that the third data item and the output data item match within a predetermined threshold; and a unit for granting a user access to a computing resource.

[0144] In Example 85, the subject matter of Examples 83-84 includes, wherein the device further includes: a unit for receiving an authentication request including a third data item; a unit for determining that the third data item and the output data item do not match within a predetermined threshold; and a unit for denying a user access to a computing resource.

[0145] In Example 86, the subject matter of Examples 83-85 includes, wherein the input data item comprises one of: an authentication certificate; an encryption key; or a watermark.

[0146] In Example 87, the subject matter of Examples 83-86 includes, wherein the distance preserving transformation comprises one or more of: a rotation, a translation, or a reflection of the first data item.

[0147] In Example 88, the subject matter of Example 87 includes, wherein the set of function parameters includes one or more of: a rotation angle, a translation amplitude, or a number of reflections.

[0148] In Example 89, the subject matter of Example 88 includes, wherein the device further comprises: a unit for determining the set of function parameters based on a secret value corresponding to a user.

[0149] In Example 90, the subject matter of Example 89 includes, wherein the secret value does not correspond to a representation of a biometric characteristic of the user.

[0150] In Example 91, the subject matter of Examples 89-90 includes, wherein the secret value is contained in a user-specific digital certificate.

[0151] In Example 92, the subject matter of Examples 89-91 includes, wherein the device further includes: a unit for receiving the following indication: the output data item is accessed by an unauthorized party, and in response: a unit for selecting a second user-specific value; a unit for receiving a third data item; a unit for transforming the third data item into a fourth data item using the distance-preserving transformation and the second user-specific value; and a unit for replacing the output data item in the storage device of the network-based service with the third data item.

[0152] Example 93 is at least one machine-readable medium comprising instructions that, when executed by a processing circuit, cause the processing circuit to perform operations to implement any one of Examples 1-92.

[0153] Example 94 is an apparatus comprising means for implementing any one of Examples 1-92.

[0154] Example 95 is a system for implementing any one of Examples 1-92.

[0155] Example 96 is a method for implementing any one of Examples 1-92.

Claims

1. A method for securing biometric data used in authentication of a user of a computing device, the method comprising: Use one or more hardware processors: receiving a first set of data points representing biometric characteristics of the user; determining a set of function parameters for a distance preserving transformation; transforming the received first set of data points into a second set of data points using the distance preserving transformation and the set of function parameters, the distance preserving transformation mapping the first set of data points to the second set of data points in a new metric space, wherein distances between data points of the first set of data points remain unchanged in the second set of data points; as well as An authentication operation is invoked for the user by sending the second set of data points over a communications network to a network-based authentication service, the authentication operation causing the second set of data points to be stored or causing the second set of data points to be compared with a stored value to produce an authentication result.

2. The method according to claim 1, wherein: The authentication operation is a registration operation that causes the network-based authentication service to store the second set of data points in association with an identifier of the user.

3. The method according to claim 1, wherein: The authentication operation is an authentication request, and wherein the method further comprises: receiving a notification that the second set of data points does not match a set of data points stored on the network-based authentication service; and Based on the notification, access to resources provided by the one or more hardware processors is denied.

4. The method according to claim 1, wherein: The distance preserving transformation comprises one or more of: a rotation, a translation or a reflection of the first set of data points.

5. The method according to claim 4, wherein: The function parameter set includes one or more of the following items: rotation angle, translation amplitude or reflection number.

6. The method according to claim 5, wherein: The method also includes determining the set of function parameters based on a secret value corresponding to the user.

7. The method according to claim 6, wherein: The secret value does not correspond to a representation of a biometric characteristic of the user.

8. The method according to claim 6, wherein: Transforming the received first set of data points into the second set of data points includes transforming the received set of data points into the second set of data points using the user-specific value and the distance-preserving transformation.

9. The method according to claim 8, wherein: The method further comprises: receiving an indication that the second set of data points is compromised, and in response, selecting a value specific to a second user; receiving a third set of data points describing a digitized representation of the biometric characteristic of the user; transforming the received third set of data points into a fourth set of data points using the distance preserving transform and the second user-specific value; and The fourth set of data points is sent to the network-based authentication service over the communications network.

10. A computing device for securing biometric data used in authentication, the computing device comprising: processor; a memory comprising instructions that, when executed by the processor, cause the processor to perform operations comprising: receiving a first set of data points representing biometric characteristics of a user; determining a set of function parameters for a distance preserving transformation; transforming the received first set of data points into a second set of data points using the distance preserving transformation and the set of function parameters, the distance preserving transformation mapping the first set of data points to the second set of data points in a new metric space, wherein distances between data points of the first set of data points remain unchanged in the second set of data points; as well as An authentication operation is invoked for the user by sending the second set of data points over a communications network to a network-based authentication service, the authentication operation causing the second set of data points to be stored or causing the second set of data points to be compared with a stored value to produce an authentication result.

11. The computing device of claim 10, wherein: The authentication operation is a registration operation that causes the network-based authentication service to store the second set of data points in association with an identifier of the user.

12. The computing device of claim 10, wherein: The authentication operation is an authentication request, and wherein the operation further comprises: receiving notification that the second set of data points matches a stored set of data points stored at the network-based authentication service; and Based on the notification, the user is provided access to resources provided by the processor.

13. The computing device of claim 10, wherein: The distance preserving transformation comprises one or more of: a rotation, a translation or a reflection of the first set of data points.

14. The computing device of claim 13, wherein: The function parameter set includes one or more of the following items: rotation angle, translation amplitude or reflection number.

15. The computing device of claim 10, wherein: The biometric characteristic includes one of the following: fingerprint data, iris data, facial recognition data, voiceprint data or physiological data.

Images