Privacy-preserving biometric authentication

Abstract

A system for authenticating a subject as an individual using biometric data, biometric data of the individual having been previously obtained. A second transducer has a digital electronic signal output characterizing a biometric of the subject; a second computing facility receives the digital electronic signal; a server array; and a third computing facility. These components implement a process including the following operations: generating shards from the digital electronic signal and distributing the generated shards to the server array; the server array receiving and storing the generated shards; performing a data exchange process using a subset of the generated shards to form information related to authentication of the subject; and sending the formed information to the third computing facility to cause the third computing facility to generate an output value indicating whether the subject is authenticated as the individual. Related login systems are also provided.

Description

[0001] Related applications

[0002] This patent application claims the benefit of U.S. Provisional Patent Application No. 63 / 058,330, filed July 29, 2020, and U.S. Provisional Patent Application No. 62 / 945,590, filed December 9, 2019. Each of these applications is incorporated herein by reference in its entirety. Technical Field

[0003] This invention relates to biometric authentication, and more specifically, to privacy-preserving biometric authentication. Background Technology

[0004] Biometric authentication offers powerful functionality in today's digital world: it allows people to securely authenticate themselves using biometrics without having to remember complex passwords or carry hardware tokens. During login or registration, an individual's biometrics are captured and stored, either as a biometric template or a digital signature. (A biometric template can be created from biometric data, for example, by using algorithms involving feature extraction or by using machine learning or computer vision algorithms.) Then, during subsequent authentication, the subject's biometrics are captured and compared or matched against the stored biometrics or template. However, this approach introduces problematic security and privacy issues. For example, in traditional biometric matching, the system must have access to the template in plaintext to run the matching algorithm—making it easy for attackers to steal the template or compromise the database to obtain the user's biometric data or other confidential information, similar to how an attacker could compromise a password database. The damage is even more severe with biometrics because users cannot reset their biometrics. Fingerprints cannot be reset like passwords. Biometrics are either stored centrally or locally. When biometrics are stored in one or more centralized databases, those databases become honeypots for hackers. There are other drawbacks to storing biometrics locally, such as on individual users' devices (e.g., iPhones). For example, these drawbacks include the fact that if a user loses her device, she will no longer be able to authenticate because the biometrics she used to log in were stored on her lost device—therefore, no stored biometrics are available for matching.

[0005] Current "multi-party computation" (MPC) techniques, when applied to biometrics, still require storing biometric templates from login on a server. During authentication, MPC is used to compare the subject's biometric template on the client with a template on the server, where both the server and client perform MPC to calculate a match score between the two templates. While this technique avoids the exchange of biometric templates between the parties (as occurs in classic biometric authentication), it does not protect privacy, for example, because both the server and client learn the match score. Existing methods using MPC are too inefficient to scale to millions of users. For example, some methods require excessive computation (e.g., on the order of several seconds per user per authentication), while others require excessive communication (sometimes exchanging >10MB per user per authentication through tens or even hundreds of rounds), and still others have weak security models (e.g., insecure with one or more active malicious servers). Many such methods require the server to store the biometric template in plaintext, as is done in traditional biometric authentication. One approach is to shard the data between the client and server. This prevents a single point of failure at the server, but it requires the same client device to be used for future authentications, as one or more shards stored on the client device are needed for future authentications. Therefore, this approach has the limitations of locally stored biometric authentication, because the loss of the client device means the loss of credentials and authentication capabilities. Summary of the Invention

[0006] This application describes a privacy-preserving method for authenticating users, which significantly improves upon existing technologies.

[0007] According to one embodiment of the present invention, a method is provided for authenticating a subject as an individual using biometric data, the biometric data of which has been previously obtained using a first converter. The method utilizes computer processing including the following operations: generating slices based on digital electronic signals provided as the output of a second converter, these signals characterizing the subject's biometrics. The computer processing further includes the following operations: distributing the generated slices to a server array, such that the server array is capable of storing the generated slices and performing data exchange processing using a subset of the generated slices to form information related to the authentication of the subject. The computer processing further includes the following operations: processing the information formed by the server array to generate an output value indicating whether the subject has been authenticated as the individual.

[0008] Optionally, the computer processing is performed by a computing entity configured to restrict information sharing relative to a set of information items selected from a group consisting of the output value, the digital electronic signal, the individual's biometric data, the subject's biometrics, the generated slices, and combinations thereof. Optionally, the computer processing further includes encoding the digital electronic signal such that the generated slices are also encoded. Alternatively or additionally, the encoding operation includes using a neural network. Alternatively or additionally, the encoding operation includes representing the digital electronic signal as a set of vectors in a metric space. Alternatively or additionally, performing the data exchange processing using the subset of the generated slices to form information related to the subject's authentication includes calculating a set of distances in the metric space.

[0009] Optionally, the data exchange processing includes performing the multi-party computation under the condition that none of the servers in the server array have obtained an intermediate value from the multi-party computation. Optionally, a selected group of the server array generates new shards based on the generated shards. Optionally, the shards can be revoked by a revocation process including the data exchange processing. Alternatively or additionally, after the shard is revoked, the generation of new shards does not require the individual to be re-engaged with the first converter. Alternatively or additionally, the revocation process is configured in a manner that there is no communication between the server array and other computing entities. Alternatively or additionally, the revocation process includes performing the data exchange processing using a subset of the subset of the generated shards from a subset of the server array. Alternatively or additionally, the data exchange processing involves communication between selected groups of servers from the server array. Alternatively or additionally, performing the data exchange processing includes: each server individually processing its generated individual shards together with its generated subject shards to generate a new set of shards that constitutes the output value. Alternatively or additionally, the data exchange process includes: causing the server array to perform a multi-party computation algorithm to determine a blind value; causing the server array to compute a corresponding shard and return the computed shard along with the value of a previously computed message authentication code to a computation entity; and causing the computation entity to use the shard data to determine whether the subject is certified as the individual and to evaluate the message authentication code.

[0010] Optionally, the operation of the server array receiving and storing the generated shards includes: receiving and storing the message authentication code of the shard, and the data exchange processing includes: using the message authentication code to confirm that the output value indicating whether the subject is authenticated as the individual is itself genuine. Optionally, the operation of the server array receiving and storing the generated shards includes: receiving and storing shards distributed across the server array having the generated shards. Alternatively or additionally, the operation of the server array receiving and storing the generated shards includes: receiving and storing the message authentication code of the Beaver triple. Alternatively or additionally, the operation of the server array receiving and storing the generated shards includes: receiving and storing shards corresponding to the message authentication code key.

[0011] Optionally, the operation of the server array receiving and storing the generated fragments includes: receiving and storing fragments of random values. Optionally, the operation of the server array receiving and storing the generated fragments includes: receiving and storing fragments of functions that facilitate authentication processing. Optionally, the operation of the server array receiving and storing the generated fragments includes: extracting a confidence subset of the subject's biometric value set from the digital electronic signal. Optionally, the operation of the server array receiving and storing the value set to enable efficient subsequent fragment generation includes: receiving and storing items selected from a group consisting of Beaver triples, authentication sharing, message authentication code fragments, random fragments, other fragments, and combinations thereof.

[0012] According to another embodiment of the present invention, a system is provided for authenticating a subject as an individual using biometric data, wherein the biometric data of the individual has been previously obtained using a first converter coupled to a first computing facility. The system has a computing component comprising: a second converter having a digital electronic signal output characterizing the biometrics of the subject; a second computing facility coupled to the second converter and configured to receive the digital electronic signal from the second converter; and a server array and a third computing facility. The second computing facility, the server array, the third computing facility, and a computer-readable medium encoded with instructions establish computer processing when the instructions are executed by the aforementioned computing component. The computer processing includes the following operations: the second computing facility generates fragments based on the digital electronic signal and distributes the generated fragments to the server array; the computer processing further includes the following operations: the server array receives and stores the generated fragments; and the computer processing further includes the following operations: a subset of the server array performs data exchange processing using a subset of the generated fragments to form information related to the authentication of the subject. The computer processing further includes the following operation: the subset of the server array sends the formed information to a third computing facility, wherein the formed information is configured to cause the third computing facility to generate an output value indicating whether the subject is certified as the individual.

[0013] Optionally, the computer processing is performed under conditions where the computing unit is configured to restrict information sharing relative to information items selected from the group consisting of the output value, the digital electronic signal, the individual's biometric data, the subject's biometrics, and the generated segments. Optionally, the computer processing is performed under conditions where the computing unit is configured to restrict information sharing relative to multiple information items selected from the group consisting of the output value, the digital electronic signal, the individual's biometric data, the subject's biometrics, and the generated segments.

[0014] Optionally, the operation of the second computing facility generating fragments based on the digital electronic signal and distributing the generated fragments to the server array further includes: encoding the digital electronic signal such that the generated fragments are also encoded. Alternatively, the operation of encoding the digital electronic signal includes: using a neural network to implement the encoding. Alternatively, the operation of encoding the digital electronic signal includes: representing the digital electronic signal as a set of vectors in a metric space. Alternatively, the operation of performing the data exchange processing using the subset of the generated fragments to form information related to the authentication of the subject includes: calculating a set of distances in the metric space. Optionally, the operation of the data exchange processing includes: performing the multi-party computation under the condition that none of the servers in the server array have obtained an intermediate value of the multi-party computation. Optionally, a selected group of the server array generates new fragments based on the generated fragments.

[0015] Optionally, the shards can be revoked by a revocation process including the data exchange process. Alternatively or additionally, after the shard is revoked, the generation of new shards does not require the individual to be re-engaged with the first converter. Alternatively or additionally, the revocation process does not require communication between the computing facility and the server array. Alternatively or additionally, the revocation process includes performing the data exchange process using a subset of the subset of the generated shards from a subset of the server array. Alternatively or additionally, the data exchange process involves communication between selected groups of servers from the server array. Alternatively or additionally, performing the data exchange process includes: each server individually processing its generated individual shards along with its generated subject shards to generate a new set of shards that constitutes the output value.

[0016] Optionally, the operation of the server array receiving and storing the generated shards includes: receiving and storing the message authentication code of the shard, and the data exchange processing includes: using the message authentication code to confirm that the output value indicating whether the subject is authenticated as the individual is itself genuine. Alternatively, the operation of the server array receiving and storing the generated shards includes: receiving and storing shards distributed across the server array having the generated shards. Alternatively, the operation of the server array receiving and storing the generated shards includes: receiving and storing the message authentication code of the Beaver triple. Alternatively, the operation of the server array receiving and storing the generated shards includes: receiving and storing shards corresponding to the message authentication code key.

[0017] Optionally, the operation of the server array receiving and storing the generated shards includes: receiving and storing shards of random values. Optionally, the operation of the server array receiving and storing the generated shards includes: receiving and storing shards of functions that facilitate authentication processing. Alternatively or additionally, the operation of the server array receiving and storing the generated shards includes: extracting a confidence subset of the subject's biometric value set from the digital electronic signal. Alternatively or additionally, the data exchange processing includes: causing the server array to perform a multi-party computation algorithm to determine a blind value; causing the server array to compute the corresponding shard and return the computed shard along with the previously computed message authentication code value to the second computing facility; causing the second computing facility to use the shard data to determine whether the subject is authenticated as the individual and to evaluate the message authentication code. Alternatively or additionally, the operation of the server array receiving and storing a set of values ​​to enable efficient subsequent shard generation includes: receiving and storing items selected from a group consisting of Beaver triples, authentication sharing, message authentication code shards, random shards, other shards, and combinations thereof.

[0018] According to one embodiment of the present invention, a system is provided for securely logging in an individual's biometric data for the purpose of subsequently authenticating a subject as the individual. The system includes components including a first converter having a digital electronic signal output characterizing the individual's biometrics. The components also include a first computing facility coupled to the first converter, configured to receive the digital electronic signal from the first converter. The components further include a server array and a second computing facility. The first computing facility, the server array, the second computing facility, and a computer-readable medium encoded with instructions establish computer processing when the instructions are executed by the aforementioned computing components. The computer processing includes the operation of generating an original fragment based on the digital electronic signal. The computer processing further includes the operation of distributing the generated original fragment across the server array. The computer processing further includes the operation of causing the server array to store the generated original fragment. The computer processing further includes the operation of storing the generated original fragment under conditions that the generated original fragment is revocable.

[0019] Optionally, the first computing facility, the server array, and the second computing facility are configured to implement computer processing that further includes generating new shards based on the original shards. Alternatively or additionally, the operation of generating new shards does not require communication between the first computing facility and the server array. Optionally, in the computer processing implemented by the first computing facility, the server array, and the second computing facility, the operation of distributing the generated original shards across the server array further includes: distributing the generated original shards across the server array along with auxiliary information selected from a group consisting of Beaver triples, functional secret shares, and combinations thereof, such auxiliary information being usable for subsequent authentication of the subject; and storing the auxiliary information in association with the generated original shards on the server array.

[0020] According to one embodiment of the present invention, a system is provided for securely logging in an individual's biometric data for the purpose of subsequently authenticating a subject as the individual. The system includes a computing unit comprising a first converter having a digital electronic signal output characterizing the individual's biometrics. The computing unit further includes a first computing facility coupled to the first converter, configured to receive the digital electronic signal from the first converter. The computing unit also includes a server array and a second computing facility. The first computing facility, the server array, the second computing facility, and a computer-readable medium encoded with instructions establish computer processing when the instructions are executed by the aforementioned computing unit. The computer processing includes the following operations: generating an initial fragment based on the digital electronic signal; distributing the generated initial fragment across the server array; causing the server array to store the generated initial fragment; and generating a new fragment based on the initial fragment.

[0021] Optionally, the operation of generating new shards does not require communication between the first computing facility and the server array. Attached Figure Description

[0022] The features of the foregoing embodiments will be more readily understood by referring to the following detailed description with reference to the accompanying drawings, in which:

[0023] Figure 1A This is a block diagram of a computer system for performing login and authentication according to an embodiment of the present invention.

[0024] Figure 1B This is a block diagram illustrating another computer system for performing login and authentication according to an embodiment of the present invention.

[0025] Figure 1C and Figure 1D This is a block diagram illustrating communication paths used for login and authentication in a computer system using n servers, according to an embodiment of the present invention.

[0026] Figure 2 This is a flowchart illustrating how a first biometric computer system encrypts fragments distributed to a server during the login process, according to an embodiment of the present invention.

[0027] Figure 3 It is based on the combination Figure 2 The described process is a flowchart illustrating the authentication logic when the fragments are encrypted.

[0028] Figure 4 This is a logical flowchart of the login process according to an embodiment of the present invention.

[0029] Figure 5 This is a logical flowchart of the authentication process according to relevant embodiments of the present invention.

[0030] Figure 6 This is a logic flowchart of the authentication process according to another related embodiment of the present invention. Detailed Implementation

[0031] Definitions. As used in this specification and the appended claims, the following terms shall have the meanings indicated unless the context requires otherwise:

[0032] A set must have at least one member.

[0033] A subset is a collection that includes the whole.

[0034] A "server array" is a combination of multiple servers.

[0035] When an information item is processed by a given component and that given component is prevented from sharing information with at least one other component of the system, the computing component's system is configured to have "restricted information sharing" with respect to that information item. For the purposes of this definition, a server array is considered a single component.

[0036] "Computer processing" refers to the execution of the described functions within a computer system using computer hardware (such as processors, field-programmable gate arrays, or other electronic combinational logic units or similar devices), which may operate under the control of software or firmware, or any combination of these, or outside the control of any of the foregoing. All or part of the described functions may be performed by active or passive electronic components, such as transistors or resistors. When using the term "computer processing," the operation of a schedulable entity or computer program or a portion thereof is not necessarily required, although in some embodiments, computer processing may be implemented by the operation of such a schedulable entity or computer program or a portion thereof. Furthermore, unless the context otherwise requires, "processing" may be implemented using more than one processor or more than one (single-processor or multi-processor) computer.

[0037] An “individual” is a living or non-living object with a unique identity, and can be a human or other biological entity.

[0038] "Subject" is a living or non-living object that claims to have a unique identity as a particular individual.

[0039] "Biometrics" are measurable characteristics or combinations of characteristics of different individuals or groups of different individuals that can be used to determine the unique identity of an individual or group. Some non-limiting examples of such measurable organic characteristics are: an individual's iris pattern, the periorbital region of the face, retinal vascular patterns, fingerprints, genetic patterns or DNA fingerprints, voiceprints, typing speed or rhythm, blood flow patterns, brain structure or electronic patterns, behavioral signals (such as hand movements), continuous biometrics based on expertise, and gait. When individuals are different silicon wafers with transistors, examples of measurable inorganic characteristics are the random variations in transistor gate delay caused by the processes used to manufacture different silicon wafers; such "silicon biometrics" can be detected using a ring oscillator, as is known in the art.

[0040] A "biometric value" is a categorization of a portion of a biometric measurement based on the attributes being measured. For example, if the biometric is an iris imprint and the measurement involves imaging the iris as an array of pixels, the relevant portion of the measurement is a single pixel in the image, and the relevant attribute could be the brightness or color of the pixel to be classified. A complete biometric measurement can include many biometric values.

[0041] The "confidence score of a biometric value," or simply "confidence score," is a numerical value that indicates the relative confidence that the corresponding biometric value has been correctly categorized.

[0042] A “confidence subset” of biometric data is a set of biometric values ​​selected based on their respective confidence values, that is, (a) large enough to uniquely identify an individual within a given large number of identifiable individuals, and (b) small enough to be repeatedly obtained in the measurement results of the corresponding biometric under different conditions.

[0043] A “converter” is any device that outputs an electrical signal that encodes a biometric representation into a set of measured biometric values. If the output of such a device is not directly digital, the term “converter” also includes any device used to transform the output into a digital form.

[0044] "Computing facilities" refers to electronic systems that include a computing processor and memory storing instructions that can be executed by the computing processor. For example, computing facilities can be found in desktop computers, smartphones, tablet computers, wearable devices, smartwatches, and similar electronic devices. Computing facilities can also be found in embedded computing systems that perform dedicated computing, such as point-of-sale machines, ATMs, physical access barriers, video kiosks, and similar electronic devices.

[0045] When a value is transformed into individual components, it is "pieced," where each individual component, viewed individually, does not reveal any information about the value, but when combined, it does reveal the value. For example, x can be pieced arithmetically into [x]1, [x]2, as follows:

[0046] [x]1=r mod p

[0047] [x]2=xr mod p

[0048] Where r is a random integer and p is a large prime number. We can see that x = [x]₁ + [x]₂, but [x]₁ and [x]₂ are each random (because r is random). This sharding method (i.e., arithmetic sharding) produces only one of several sharding types, such as Shamir sharding-polynomial interpolation, bitwise XOR sharding, linear sharding, function sharing, etc.

[0049] The processes listed as including "encoding and extracting slices" can be performed in any order, i.e., in a first order where encoding precedes slice extraction, or in a second order where slice extraction precedes encoding.

[0050] As illustrated in this article, a "shard" is not necessarily a secret. Depending on the context, a shard may or may not be a secret.

[0051] 1. Convert biometric data

[0052] Embodiments of the present invention provide computer systems and methods for converting biometric data into a form that protects its privacy while allowing it to be used indirectly for purposes including authentication. These embodiments are discussed below.

[0053] Figure 1A This is a block diagram of a computer system for performing login and authentication according to an embodiment of the present invention. Figure 1A The diagram illustrates an individual (user) 103, a subject (user) 106, and at least two servers 101 and 102 constituting a server array. Individual 103 uses a mobile phone with software, referred to as client 104 (in this case, the software is written in Javascript), which runs on a web browser, which in turn runs on the individual's mobile phone. Figure 1A In this implementation, client 104 can access the camera on the mobile phone to take photos of an individual's face. Client 104 interacts with user 103 and other entities representing user 103.

[0054] Subject (user') 106 used different devices (client' 107), such as different mobile phones, laptops, kiosks, etc. The device also ran client software.

[0055] exist Figure 1A In this implementation, server 1, shown as item 101, is implemented in Go and deployed using Kubernetes on a Google Cloud Platform (e.g., in the central United States). Server 101 has a Postgres database stored in coded shards used in the processing. In addition to running a collection of programs with application programming interfaces (APIs) for communicating with server 2 (shown as item 102), the collection of programs running on server 101 also has APIs for communicating with client 104. These APIs for communicating with client 104 include, for example, APIs for login, authentication, and signature.

[0056] exist Figure 1A In this implementation, server 2, shown as item 102, is implemented in Python and deployed on Amazon AWS (e.g., in Eastern Europe). In this implementation, server 102 has a MySQL database storing coded shards used in the processing. Server 102 has an API similar to that of server 101, except that it is written in Python on the server side.

[0057] exist Figure 1A In the implementation of this method, the following series of processes are carried out.

[0058] First, a login process is initiated (either by individual 103 or by another party). In this process, client 104 requests individual 103 to take a photo of the individual's face, and individual 103 takes such a photo. Liveness detection is used on the image of the individual's face in the photo.

[0059] Next, in the login process, client 104 uses the captured individual facial image to create a login segment and sends the login segment to servers 101 and 102 that store the login segments.

[0060] After logging in, an authentication process is initiated (either by subject 106 or by another party). During the authentication process, subject client 107 requests subject 106 to take a photo of the subject's face, and subject 106 takes such a photo.

[0061] Next, in the authentication process, the subject client 107 uses the captured subject facial image to create an authentication segment and sends the authentication segment to the servers 101 and 102 that store the authentication segments.

[0062] During the data exchange process of the authentication process, servers 101 and 102 communicate with each other regarding the stored fragments to form information related to the subject's authentication, and each server 101, 102 sends the communication results to the subject client 107. Upon receiving the communication results, the subject client 107 can determine whether the subject 106 has been successfully authenticated as individual 103. The subject client can determine whether the subject 106 has been successfully authenticated without the subject 106 being aware of any information about the logged-in individual 103.

[0063] Figure 1A The implementation method is privacy-preserving, for example, because neither server 101 nor 102 knows whether subject 106 has been successfully authenticated as individual 103; neither server 101 nor 102 nor subject client 107 can access the individual's biometric template (i.e., the image of the individual's face); and neither server 101 nor 102 can access the subject's biometric template (i.e., the subject's facial image).

[0064] Figure 1AThe implementation is also revocable, for example, because the shards stored by servers 101 and 102 are revocable. If a malicious subject 106 compromises subject client 107 and all servers except one, this implementation prevents the malicious subject 106 from accessing information related to individual 103. In the event of such compromise, in this implementation, individual 103's credentials (which may include shards on servers 101 and 102) can be revoked and new credentials can be issued for individual 103. In some implementations, new shards can be issued without individual involvement. Therefore, if an external attacker is able to compromise all servers except one, the attacker remains unaware of individual 103, and individual 103's credentials can be revoked and new credentials issued without involving individual 103.

[0065] exist Figure 1A In one implementation, five shard sets are generated during the login process. Servers 101 and 102 each receive one of the five shard sets. During each authentication process, one of the shard sets is destroyed. In this implementation, when authentication is successful, a new shard set is generated and distributed using steps similar to those in the login process.

[0066] This implementation may optionally include processing for situations where one or more servers in the server array fail, are busy, offline, or otherwise unavailable. Exemplary processing may include, for example, creating redundancy by creating multiple copies of each server. Another exemplary processing may include performing sharding using a technique such as Shamir sharding, where only a certain threshold number of shards is needed, such as n out of m shards. In such processing, authentication can be performed even if one or more sharded servers do not participate in the authentication process. If one or more servers in the server array become unavailable, a subset of the servers in the array can be used to perform login and authentication operations. The determination of the subset of servers performing such operations may be based on a combination of one or more conditions, such as: online status, availability, breach conditions, capability, location, privileged status, and security groups.

[0067] Figure 1AThis implementation also addresses the problem of catastrophic credential loss (e.g., this could include a subject losing their password or token and requiring an account reset). Account reset processes can be costly, such as because they involve expensive cost centers, uncompleted transactions by the user, etc. Current account reset processes do not protect privacy, for example, because they may have a central database of user information by default and use knowledge-based authentication (KBA), which could involve asking the user questions about their favorite sports team or the car they own to reset the user's account. This implementation addresses catastrophic credential loss, for example, because account access does not require remembering a password or possessing a token, thus avoiding the need for a reset due to a lost password or token.

[0068] In one implementation, liveness detection is used to ensure that the biometrics are performed on a real person. In one implementation, liveness detection includes illuminating the face from different angles while taking a facial photograph. In another implementation, a trained neural network is used to detect differences between a photograph of a real person and a screen photograph or photograph. In one implementation, an infrared camera is used in conjunction with an optical camera. In one implementation, sensors detect a range of conditions, such as breathing, pulse, and depth between fingerprint ridges. In one implementation, an individual must participate in liveness detection, such as by turning their head, saying a phrase, or clicking a button. In one implementation, a liveness indicator is part of a digital electronic signal. In another implementation, a liveness indicator is contained within a slice.

[0069] In some implementations, revocation processing does not require the creation of new fragments. For example, regulations including the General Data Protection Regulation (GDPR) include the right to forget or the right of an individual to erase their personal data. The ability to execute revocation in some implementations enables the right to forget, even in cases where the server is compromised and fragments are damaged.

[0070] In some implementations, the revocation process renders one or more fragments useless for future authentication. In one implementation, if the client and all servers except one are compromised, the attacker is unaware, and the individual's credentials can be revoked and new credentials issued. In one implementation, a fragment is a credential. In one implementation, if a fragment is revealed (e.g., through corruption or other damage), the fragment can be revoked and redistributed. In one implementation, a credential is a subset of fragments. In one implementation, a credential is an encoded version of biometric data. In one implementation, a credential is a vector generated by a neural network. In one implementation, a credential is a biometric template. In one implementation, issuing new credentials does not require an individual user. In one implementation, Figure 1AThe system is configured to require individual users to issue new credentials. In another implementation, individual users need to issue replacement shards. In one implementation, unused shards are referred to as cancelled.

[0071] In one implementation, the server array consists of five servers, each with a unique shard, and one of the servers is corrupted. In one implementation, it is not necessary to involve all five servers to undo the corrupted shard. Several example methods for undoing a corrupted shard exist, as shown below (not an exhaustive list).

[0072] In one example, a subset of five servers in the array (e.g., three) can result in the generation of new shards. These three new shards work alongside the original shards from the remaining two servers. The usefulness of the three original shards from the three servers in the subset for authentication terminates from the authentication process onward. For example, if one of the three original shards is corrupted, that corrupted shard is no longer useful in determining the success of future authentication attempts, and the system's security state reverts to the state it was in before the corrupted server.

[0073] In another example, three servers in a subset generate three new shards, terminating the usefulness of the remaining two original shards from the other two servers in the five-server array.

[0074] In another example, one server in the array deletes its shard, an action that renders all remaining shards held by the other servers in the array useless.

[0075] In the realm of sharding, the situation is that the corruption of one or more (but not every) shards does not compromise an individual's biometrics. In the prior art, corrupted shards are persistent security vulnerabilities; that is, they retain their usefulness for authentication processing. Therefore, the security model weakens with each corrupted shard. However, in embodiments of the present invention, the ability to rescind (revoke corrupted shards) allows for the restoration of a secure state because the usefulness of the corrupted shards can be terminated.

[0076] Consider the following scenario: a biometric feature has been fragmented into five fragments, and the biometric feature will be compromised if three of the five fragments are corrupted. In the prior art, if one fragment is corrupted, only two more fragments need to be corrupted to compromise the biometric feature. However, in embodiments of the present invention, the reversibility capability allows for restoration to a secure state (i.e., three fragments must be corrupted to compromise the biometric feature) because the usefulness of the corrupted fragments can be terminated. Various implementations uniquely allow fragments to be corrupted without causing a persistent breach of system security. The reversibility capability limits the time frame within which an attacker can attempt to use corrupted fragments, thereby reducing the attack surface. Because the reversal process can be performed by the server without client intervention, reversal can be performed very efficiently.

[0077] Figure 1B This is a block diagram illustrating another computer system performing login and authentication according to an embodiment of the present invention. Figure 1B The system relies on party 140 to authenticate users (individual 133, subject 135). The system of this exemplary embodiment includes:

[0078] In one implementation, the dependent party (RP) 140 is an enterprise such as a pharmacy or bank that wishes to authenticate its users in a way that is compliant with HIPAA, GDPR, and / or other regulations, ensuring privacy and preventing user damage and breaches of trust if user credentials are compromised; and providing a seamless user experience, such as compliant with the enterprise's passwordless, self-governing identity, digital identity transformation, non-custodial, decentralized, and compliance initiatives. The enterprise owns a website, online marketplace, or digital payment gateway. In one implementation, the website is primarily written in Javascript, and the RP has a MongoDB or other key-value store that stores a mapping from usernames to user public keys for public-private signature key pairs.

[0079] The client software (written in Javascript) runs on a web browser, which in turn executes on the user's mobile phone. This software can access the vehicle's camera to take a picture of the user's face. An instance of the software (client 134) interacts with the individual 133 logged into the system and other entities representing individual 133. An instance of the software (client 136) interacts with a subject 135 claiming to be an individual and other entities representing subject 135. When individual client 134 provides biometrics of the individual logging in for later authentication purposes, we sometimes refer to individual client 134 as the first "computing facility."

[0080] The Badge service 130 encodes data from users (individual 133 and subject 135). The Badge service 130 also uses the obtained biometric root private key to perform encryption operations. In one implementation, service 130 is written in C++ and is self-hosted by the badge service. In one implementation, each client 134, 136 performs the functions of the Badge service. In another implementation, the Badge service 130 is hosted by a server. In another implementation, each client 134, 136 connects to the Badge service 130. In another implementation, the Badge service 130 is included within clients 134, 136. In another implementation, the Badge service 130 is not included within clients 134, 136. In one implementation, clients 134, 136 are the front-end user interface and the Badge service 130 is the back-end. In one implementation, the Badge service 130 performs the encoding and distribution of login and authentication-related information. In one implementation, clients 134, 136 and service 130 are integrated with existing clients such as Windows Hello or Touch ID, and servers 111, 112, 115, 121, 122, and 125 are hosted in Azure, AWS, or other cloud platforms.

[0081] Figure 1B The system comprises a cluster of replicas of server software corresponding to servers 1A, 111, 1B, ... In one implementation, the server software is implemented in Go and deployed on the Google Cloud Platform using Kubernetes, featuring a shared Postgres database whose storage may be based on user-coded shares of biometrics and private keys. In addition to running a set of programs with APIs for communicating with other servers, each server also runs a set of programs with APIs for communicating with clients. In one implementation, these APIs include a secret share of encoded biometrics and a root private key for logging in an individual, as well as APIs for performing authentication processes that include these shares and the secret share of encoded biometrics of the subject.

[0082] Figure 1B The system also includes another cluster of replicas of the server software corresponding to servers 2A 121, 2B 122, ... In this implementation, the server software is implemented in Python and deployed in Microsoft Azure. The cluster may include replicas of the Python version of the server software and has a shared MySQL database, the storage of which may be based on user-encoded biometrics and private keys. It provides an API similar to that of the cluster of servers 1A 111, 1B, ... except that it is written in Python on the server side.

[0083] Gateway 115 is a load balancer (which can be written in Go) that routes traffic between different clients and different replicas in a way that minimizes the maximum load on the replicas. Additionally, in this implementation, the protocol used for load balancing requires the replicas of server 1A 111 to find the exact replica of server 2A 121 that is communicating with the same client 134. Gateway 115 provides the functionality to enable server 1A 111 to connect to the correct replica of server 2A 121. (In one implementation, the mapping is dynamic and depends on the load balancer. For example, server 1A 111 may be dynamically mapped to server 2A 121.)

[0084] Gateway 2 125 is a load balancer (like cluster 2), and its implementation is similar to that of Gateway 1 115, except that it is written in Python.

[0085] exist Figure 1B In this implementation, the dependent party 140 uses a series of login processes implemented as follows to authenticate the subject user 135:

[0086] Dependent 140 requires individual 133 to register or create an account.

[0087] Individual 133 clicks the "Login" option on individual client 134, where individual client 134 serves as the primary computing facility. Individual client 134 requests the individual to take a selfie, and the individual takes such a selfie.

[0088] Next, the badge service 130 and the individual client 134 establish a secure encrypted session.

[0089] The badge service 130 communicates securely with the individual client 134 using a secure encrypted session. The badge service 130 encodes data associated with captured images of the individual's face to generate biometric data, which is fed into a deep learning neural network through output vectors.

[0090] Badge service 130 uses vectors to generate fragments.

[0091] Badge service 130 distributes the generated fragments to servers 111, 112, 121, and 122. In a secure encrypted session, individual client 134 receives the root private key and obtains an ECDSA (Elliptic Curve Digital Signature Algorithm) public and private key pair for signing. In one implementation, it is not necessary to store the ECDSA public or private key, as they can be retrieved when needed. In one implementation, individual client 134 obtains separate key pairs for use by different dependents and applications. In one implementation, some key pairs are used for data encryption. In one implementation, individual client 134 sends the ECDSA public key to dependent party 140. Dependent party 140 stores the public key, or stores it in a public key database using a credential authority or registry. In one implementation, badge service 130 includes a credential authority, registry, and / or public key database. In one implementation, dependent party 140 stores the public key and reports success to individual client 134. Individual client 134 indicates successful login to the individual.

[0092] In this implementation, a fragment may include one or more items from the following list of possible components. Any item in this list may appear multiple times.

[0093] 1. Arithmetic sharding of biometric data;

[0094] 2. MAC codes for arithmetic fragmentation of biometric data;

[0095] 3. Beaver triples;

[0096] 4. MAC code of Beaver triples;

[0097] 5. Arithmetic slices of random values ​​(e.g., alpha, r);

[0098] 6. MAC code of arithmetic fragmentation of random values;

[0099] 7. Commitments for arithmetic partitions of random values;

[0100] 8. Arithmetic fragmentation of the MAC key (referred to as MAC key 'D'); and

[0101] 9. Function secret sharing.

[0102] In this implementation, the Beaver triple is an arithmetic slice of {x,y,x*y} for randomly selected x and y. In some implementations, encoding includes encoding the above content into the generated slice.

[0103] In one implementation, the MAC code is considered part of the share itself. An “authenticated arithmetic share” is a tuple of the share and its MAC code. For example, for a shard of “a”, the corresponding MAC code is a shard of (a*D), where “D” is the MAC key. In this implementation, a shard may include one or more of the following:

[0104] 1. Arithmetic sharding of certified biometric data;

[0105] 2. Certified Beaver triples;

[0106] 3. Arithmetic slicing of the certified random value alpha;

[0107] 4. Arithmetic fragmentation of MAC keys; and

[0108] 5. Function secret sharing.

[0109] In one implementation, a commitment value can be used to check whether a committed value has been modified. For example, a commitment to a shard of r is used to check whether a shard of r has been modified. In one implementation, the commitment is a hash.

[0110] In one implementation, the subject's authentication includes receiving and storing one or more of the following by a second computing facility:

[0111] --Arithmetic partitioning of random value r

[0112] The MAC address of the arithmetic slice with `-r`, and

[0113] --r is a commitment to arithmetic slices.

[0114] In one implementation, a fragment of r is received from a server array. Other implementations include:

[0115] The second computing facility uses the commitments of r's arithmetic shards to confirm that none of the servers in the array are active maliciously or otherwise corrupted, causing r's shards to be modified; and

[0116] The second computing facility generates r based on the fragments of r.

[0117] In one implementation, authentication includes:

[0118] The second computing facility generates blind slices based on the subject's digital electronic signals and the slices of r; and

[0119] The second computing facility broadcasts blind shards to the server array.

[0120] In another implementation, authentication includes: enabling the server array to possess fragments of the subject's digital electronic signals.

[0121] In one implementation, authentication includes: a server array generating slices of the subject's digital electronic signal and associated MAC using blind slicing and r-slicing.

[0122] In one implementation, the above processing reveals to the server array whether any server in the array is active and malicious, for example, whether it has modified any shards, by using the MAC codes of the shards. In another implementation, if a server is detected to be active and malicious, security processing or breach of contract legal processing is performed. For example, if a third party's server is compromised, resulting in the modification of shards, appropriate processing and legal or indemnifying action may be initiated to address the dispute.

[0123] Alternatively or additionally, in another implementation, authentication includes:

[0124] The second computing facility receives data exchange information from the server array; and

[0125] The second computing facility used data exchange information to confirm that a subset of the server array was not malicious.

[0126] In another implementation, if the server is found to be malicious, security measures are taken.

[0127] Alternatively or additionally, in another implementation, authentication includes:

[0128] Generating and distributing added value, such as commitments or hashes of fragments of the subject's digital electronic signals; and

[0129] The server array receives and stores the generated fragments and additional values.

[0130] In one implementation, the above process reveals to the server array whether any server in the server array is active and malicious by using fragmented MAC codes.

[0131] In one implementation of a system where the dependent party 140 authenticates the subject 135 who claims to be user 133, the authentication process is implemented as follows:

[0132] Subject 135 attempts to log in to the dependent application and requests to log in to Subject Client 136, in which Subject Client 136 acts as a second computing facility for authentication purposes.

[0133] Subject client 136 (e.g., running on the subject's device) sends a user authentication request to dependent party 140, which uses what we call a third computing facility.

[0134] The dependent party 140 returns a challenge to the subject client 136, which includes a request to sign the message using the ECDSA private key.

[0135] Subject client 136 requests a selfie of subject 135's face.

[0136] Subject 135 took this selfie of her face.

[0137] Subject client 136 and badge service 130 establish a secure encrypted communication channel.

[0138] The badge service uses 130 encoding to generate fragments.

[0139] Badge service 130 distributes shard subsets to multiple servers 111, 112, 121, and 122.

[0140] Subsets of servers 111, 112, 121, and 122 perform data exchange processing.

[0141] A subset of the array subsets of servers 111, 112, 121, and 122 sends information to badge service 130.

[0142] Badge Service 130 uses this information to regain the root private key.

[0143] The badge service 130 communicates with the subject client 136 over a secure encrypted channel in a manner that enables the subject client 136 to regain the ECDSA private key.

[0144] Subject client 136 uses the ECDSA private key to sign the message.

[0145] Subject client 136 sends the signed message to dependent party 140.

[0146] Dependant 140 uses the ECDSA public key (which was previously stored for access by Dependant 140) to verify the signature.

[0147] If the signature is valid, then the relying party 140 successfully authenticates the subject 135 as individual 133. In one implementation, the relying party 140 authorizes the subject client 136 to access the application.

[0148] The certification results were reported to subject 135.

[0149] Once authenticated as individual 133, subject 135 accesses the dependent party's application. In one implementation, subject 135 views her account balance. In another implementation, subject 135 views the results of her medical tests. In yet another implementation, subject 135 decrypts messages, payment wallets, or other data. In yet another implementation, subject 135 uses a digital signature to sign documents or other data. In one implementation, subject 135 signs transactions, for example, to be accepted and recorded by a distributed ledger, blockchain, or transaction processing stack.

[0150] In some implementations, the output value is a key if the subject is authenticated as an individual, and the output value is all zeros if the subject is not authenticated as an individual. In one such implementation, a third computing facility uses the output value / key to obtain an ECDSA private key. Furthermore, the third computing facility uses the ECDSA private key to perform signature-based authentication to authenticate with a fourth computing facility. In such an implementation, the third computing facility receives a token from the fourth computing facility that enables access to the application. In another implementation, encoding includes processing biometric data to generate a biometric template. In one implementation, the deep learning neural network is provided by another entity (such as a biometric provider). In another implementation, the biometric data is processed using a feature extraction and / or registration algorithm on the output biometric template. In another implementation, facial biometric data is fed through a facial training neural network that outputs a first vector, and speech biometric data is fed through a speech training neural network that outputs a second vector, and the two vectors are combined, for example, using a tensor product, to generate a biometric template.

[0151] Some embodiments of the present invention can uniquely utilize multiple biometric inputs. For example, if the various biometric inputs are fed through a machine learning model and have outputs in a metric space, these embodiments can generate slices based on these biometric inputs. In one embodiment, badge service 130 uses machine learning to generate vectors, which are then used as inputs to authentication processing. The use of machine learning is applicable to multiple biometric and non-biometric inputs, and also to multiple vectors. In one embodiment, these techniques are utilized during slice generation based on digital electronic signals.

[0152] In one implementation, the digital electronic signal is a video comprising a human facial image and voice. The facial image is processed by its own neural network, and the voice by its own neural network. Each neural network will generate a vector upon login (i.e., what we call the "login vector") and another vector upon authentication (what we call the "authentication vector"), such as a facial vector and a voice vector. These two vectors are merged (with or without additional information) to create an input vector. For example, the facial vector and voice vector can be combined with a PIN code to create a merged vector. As another example, the additional information may include a set of metadata indicating the type of biometric input from which the vector was obtained. In one implementation, a computing facility acquires the input vector and uses it to generate slices. In this way, slices can be generated based on vectors of multiple biometrics. In another implementation, there are two digital electronic signals, one for the face and one for the voice. In one implementation, generation includes obtaining an output in a metric space, which is created using a neural network whose input includes components of the digital electronic signal. The output in the metric space may include vectors. Biometric data may be represented as one or more vectors in the metric space. In one implementation, a neural network or deep learning model is used to generate vectors. According to various embodiments of the invention, authentication processing configured to protect the privacy of biometric data includes calculating a distance (the distance between the authentication vector and the login vector) in a metric space and comparing the calculated distance with a threshold.

[0153] The aforementioned neural network can achieve a given performance in terms of false acceptance rate (FAR) and false rejection rate (FRR). Some embodiments of the present invention provide a method for performing privacy-preserving authentication without degrading FAR and FRR performance under a given threshold.

[0154] In this way, these implementations provide a uniform approach to using any biometric modality—the aforementioned deep learning methods can be used for facial authentication, voice authentication, behavioral authentication, and more traditional biometric modalities such as fingerprints, irises, retina, and palm prints. Some implementations feature architectures capable of uniformly supporting biometric modalities not yet invented. This architecture can also incorporate factors such as PINs, tokens, patterns, and passwords to uniformly support these features.

[0155] Among the various authentication modes described in this application:

[0156] Individuals can log in using one or more modalities (such as face, voice, fingerprint, periocular face, PIN, password, SSID, token, etc.);

[0157] - Then a subset of these modalities can be used for authentication;

[0158] - and can log in to additional modalities over time;

[0159] - And (as described in the following paragraphs) some of these modes can be corrupted without damaging the system.

[0160] For example, fingerprint biometrics may be compromised in events unrelated to the techniques described herein (such as when a fingerprint template stored in a database elsewhere is corrupted, but such corruption in conventional techniques would not compromise the system according to embodiments of the invention). In another example, if the underlying private key is corrupted, the corrupted key can be revoked according to embodiments of the invention. As another example, when it is determined that a password should no longer be used, the password can be removed as a valid authentication modality. In some embodiments, this determination is made by the user, and in others, it may be made by an organization such as a bank or government agency, or automatically once a set of conditions has been established to justify the determination.

[0161] In some implementations, the nature of the proposed use of information governs the selection of the level of security risk associated with such use and thus governs the authentication factors required to achieve such use. For example, in one scenario, only facial recognition is required to view an individual's bank balance, while in another scenario, to perform transactions involving a higher level of security risk, both facial and voice recognition are required. In yet another scenario, for example, involving changes to an individual's address, in addition to biometric requirements, a secret such as the user's PIN may be required. Other examples include organizations selecting which input factors or combinations are needed, for example, based on user convenience relative to the application or transaction the user expects to access, or in another example, based on security policies.

[0162] In some implementations, one or more individual secondary keys are obtained for each factor or modality used for individual login. A subset of the secondary key set may be sufficient to authenticate the subject as an individual. Upon login, a master key associated with each secondary key can be generated. The master key can be obtained from the secondary keys. In some implementations, all secondary keys are required to regenerate the master key. In some implementations, the master key functions as a master key.

[0163] In some implementations, corruption of the secondary key does not corrupt any other keys. The secondary key can be revoked. In some implementations, the master key can be updated so that it is no longer associated with the revoked secondary key. For example, the master key can be updated so that it no longer contains the revoked secondary key.

[0164] In some implementations, the secondary key and the primary key can be ECDSA or RSA keys and can be used for standard cryptographic operations such as signing and encryption. In one implementation, the primary key is an ECDSA key that includes the secondary key. In one implementation, Diffie Helman processing is used to combine the secondary key to generate the primary key. In some implementations, generating the key includes generating a secret and obtaining a private / public key pair from it, such as an ECDSA key pair and other key pairs known in public key infrastructures.

[0165] In one implementation, the set of secondary keys re-acquired during authentication is a subset of the master key, and the server accepts proof of membership for the set if it is determined that the subset is sufficient for authentication. In one implementation, which subset is sufficient is determined at login. In one implementation, the threshold for determining which subset is sufficient can be dynamically set by the organization (e.g., it does not need to remain static from login). Furthermore, the threshold can be as low as a single partial modality or as high as all modalities, depending on the organization's preferences, such as for user settings and security.

[0166] In some implementations, there are one or more subkeys for each factor or modality. For example, for a given user, there may be subkeys for each portion of the fingerprint on each finger of each hand. In another example, all ten fingerprints and both palms of the user have one subkey. In yet another example, for a given user, there are separate subkeys for each type of facial scan (such as visual, infrared (IR), three-dimensional (3-D) scans, etc.). In one example, there are separate subkeys for facial scans of the user under various conditions (such as low light, wearing glasses, wearing a mask, wearing a hood, outdoors, on a mobile phone, using a wearable camera, having a beard, etc.).

[0167] In some implementations of the secondary key and master key, a secondary key is generated during authentication. In some of these implementations, the secondary key may be associated with the user's master key as follows:

[0168] x and y are subsecret keys; and

[0169] If the master secret key is x*y and the public key is g^{x*y}, then g^y can be used to calculate g^{x*y} and verify its equality with the master public key to verify that the secondary key x with the associated public key g^x is part of the master secret key.

[0170] This allows proof that the obtained key is a member of the key used by the individual during login—even if the subject did not use all modalities during authentication. In some implementations, this also allows for the revocation of a specific key: if x is corrupted, all subkeys including x can be revoked. In these implementations, corruption or revocation of x does not reveal information about other keys (e.g., y) and does not affect the functionality of other keys.

[0171] In some implementations, the subkey can be extracted individually from the corresponding modality of the subkey, and these keys can be combined incrementally. For example, a facial subkey and a PIN subkey can be extracted. These two keys can be used for login authentication processing, for example. Then, in order to perform progressive authentication processing, the service can also request the extraction of a voice key. In this implementation, the voice key can be extracted and combined with the previously extracted facial key and PIN key to obtain a key for progressive authentication processing.

[0172] Figure 1B The shard distribution triggered in this implementation is based on a combination of one or more conditions, including: online status, availability, corruption conditions, energy, location, privileged status, decentralization, load balancing, history, performance, scheduling algorithm, or security group. For example, if multiple servers 111, 112 in the cluster are corrupted, other servers in the cluster may not receive distributions. For example, gateway 115 or gateway 125 can select which servers in the cluster are used for load balancing. For example, badge service 130 or clients 134, 136 can indicate preferences for which servers receive distributions. For example, multiple servers may receive one or more shards that another server also received. In another example, no server receives the same shard as another server received.

[0173] Such "triggering distribution" itself does not require a specific distribution pattern and can employ a range of distribution patterns depending on the context of the relevant computer processing. In one distribution pattern, all servers receive the same information, which may or may not be public. In another scenario, the information may be "blind," as the terminology used herein suggests. In yet another pattern, different servers receive different information, which may or may not overlap and is generally not public information. Various distribution methods can be employed. For example, in one scenario, the distribution method might involve providing a server with additional information to allow it to interpret the information previously passed to it.

[0174] In one implementation, during a secure, encrypted session between clients 134 and 136 and badge service 130, clients 134 and 136 receive a root private key and obtain an RSA public and private key pair for signing. In another implementation, badge service 130 obtains the key pair and publishes the public key to a public key directory, which, in some implementations, is accessed by certain dependents and applications. In one implementation, neither the RSA public nor private key needs to be stored, as they can be retrieved when needed. In one implementation, clients 134 and 136 obtain separate key pairs for use by different dependents and applications. In one implementation, some key pairs are used for data encryption. In this way, the human is the root of trust (rather than a hardware or physical root of trust or a software root of trust, which may be lost or compromised). The human root of trust can retrieve key pairs as needed for authentication, signing, encryption, or other functions for dependents, services, and applications.

[0175] In some implementations... Figure 1B The system comprises more than two server clusters. In this implementation, the change... Figure 1B The system architecture is configured such that badge service 130 connects to an additional server cluster. In one implementation, the server or server cluster has point-to-point connections with each other server or cluster. In another implementation, there will be a series of broadcasts between the servers to execute the MPC protocol.

[0176] In implementations, the system transmits the subject's authentication information to the dependent party (sometimes referred to herein as "RP") in different ways. In one implementation, upon login, the dependent party communicates with the individual client (e.g., Figure 1B (As depicted). To this end, the client (after logging in) sends information to the dependent party that links the badge account to the dependent party's account. This can be implemented, for example, using the standard OAuth protocol. In another implementation, the dependent party communicates with the badge service, which acts as a credential authority (CA) and registers its root credentials with the dependent party. The badge service can then send a signed message that the client has been authenticated with, which can be verified by the dependent party. In yet another implementation, the dependent party has no communication other than with the secondary client. In this case, a third-party CA (e.g., COMODO) issues credentials to the badge service, which uses these credentials to sign authentication messages. The dependent party verifies these signed authentication messages using a protocol (e.g., standard Transport Layer Security (TLS)).

[0177] 1.1 Data Encoding

[0178] In some implementations, user U has a biometric template T, which can be represented by a set of features, and there exists a subset of points corresponding to the entropy of the template. In one implementation, the features are elements of the same universe, and this universe must be finite and have a total ordering. In some implementations, this total ordering must be U and U. I It is known that the authentication factors can be constant or vary depending on one or more authentication factors, such as PIN, password, ear canal features, or biometric data. To illustrate the conditions of these implementations differently, there exists a subset of points representing the randomness of the biometric data. We call this subset P of points entropy points. In one implementation, T is encoded into an encoding template E using an encoding algorithm. T And using algorithm f on a given encoding template E T Second template T I Entropy point P I Authentication is performed under the condition that T I By user U I Generate. That is, if user U I If U is the same, then f(E) T ,P I ) = 1, otherwise f(E) T ,P I ) = 0. Note that this means the function is symmetric, because U is symmetric if and only if U is also symmetric with U. I When they are the same, f(E) T I,P)=1.

[0179] An example of this biometric template and encoding scheme is representing a two-dimensional facial or fingerprint template as a list of (x, y) coordinates of features associated with the template. The encoding and entropy points are precisely the list of (x, y) coordinates, and the corresponding f will check whether each entropy point in a large portion of the entropy points of the second template has a corresponding point in the first template, which is within a small Euclidean distance. The encoding and f can be chosen to improve performance.

[0180] 1.2 Login and Authentication Communication

[0181] In some implementations, login (also known as registration) is performed between an honest individual and multiple servers. The purpose of login is to enable the individual to authenticate themselves later. After an individual logs in, authentication is performed between the logged-in individual and multiple servers.

[0182] Figure 1C and Figure 1DThis is a block diagram illustrating communication paths used for login and authentication in a computer system using n servers, according to an embodiment of the present invention. Figure 1C During login, individual user (U)18 logs into the system by sending her sharded data to various servers 11, 12, ..., 15. Figure 1D In the authentication process, the subject user' (U t )19 attempted to authenticate herself as user (U)18 by communicating with servers 11, 12, ..., 15. In Figure 1C and Figure 1D In this implementation, servers 11, 12, ..., 15 must also communicate with each other.

[0183] In one implementation, we assume that at least one of servers 11, 12, ..., 15 is honest, meaning that at least one server will correctly follow the authentication protocol in this implementation and will not reveal any private values ​​within its private settings. If at least one server is honest, the following objectives can be achieved:

[0184] Correctness. If the subject is an individual and both the server and the subject follow the protocol without deviating from it, then the server believes the subject is an individual.

[0185] Robustness. If the subject is not an individual and at least one server is honest, the honest server will not believe the subject is an individual, and authentication will fail.

[0186] Zero-knowledge acquisition. For example, if at least one server is honest, then no server should learn the biometric data of an individual or subject. Furthermore, even if the subject is malicious in the scenario, neither the subject nor any server will learn any information about the individual's biometric template during the authentication protocol.

[0187] Zero-knowledge is related to privacy protection. In some implementations, even if only one server out of all servers is actively malicious, then:

[0188] The output value is not disclosed to computing facilities or multiple servers;

[0189] It does not disclose individual biometric data or subject biometric data (digital electronic signals characterizing subject biometrics) to the server; and

[0190] The server does not obtain intermediate values ​​from multi-party computations.

[0191] 2.3 Introduction to MPC

[0192] There are many different forms of multi-party computation (MPC), including methods that perform computations on "sharded" values. A "sharded" value is a value x shared across two or more servers. Individual shards do not reveal any information about x; it is only revealed when they are combined. For example, x can be arithmetically sharded into [x]1, [x]2, as follows:

[0193] [x]1=r mod p

[0194] [x]2=xr mod p

[0195] Where r is a random integer and p is a large prime number. We can see that x = [x]1 + [x]2, but [x]1 and [x]2 are random (because r is random).

[0196] Here we describe a method for sharding data (arithmetic sharding). Many other methods exist for sharding data. Secret sharding can also be used (e.g., Shamir sharding – polynomial interpolation, bitwise XOR sharding, linear sharding, etc.).

[0197] MPC allows complex operations to be performed on these sharded values, including addition, multiplication, and integer comparisons. These operations occur entirely on the sharded values ​​to generate shards of computation results. The server then exposes these output shards to learn the computation results together. In this way, the server set learns only the output of the computation, not the input or any intermediate values.

[0198] While MPC is general-purpose and powerful, it is also expensive and therefore impractical for many applications. For example, in the sharding protocol described above, some operations are more expensive than others. Specifically, the individual multiplication and comparison operations are costly. These operations typically require a separate offline "setup" phase, which involves significant computation and communication.

[0199] The setup phase is so expensive (in terms of computation and communication) that it makes most MPCs impractical for most applications. Even the online phase (which occurs after the setup phase) can be impractical because each multiplication and comparison operation requires information exchange between all participating servers. Due to network latency and other factors, this processing can be time-consuming (approximately 200ms-500ms).

[0200] Finally, many approaches to addressing these shortcomings sacrifice security. That is, if all servers honestly adhere to the protocols, many protocols will only protect user data. Often, this security model is too weak for practical applications.

[0201] The sharding process described above shards values. Function secret sharing is a mechanism that shards functions rather than values. Functionally, they work similarly to the sharding described above. The key difference is that instead of sharding values ​​(x) and jointly computing a known shared function (f), they shard the function (f) and compute it against known shared values ​​(x).

[0202] 2.0 Security Subset Selection

[0203] According to an embodiment of the present invention, a fragmentation subset protocol is formed and used. The fragmentation subset protocol comprises two phases: setup (corresponding to what we sometimes call the "login" part) and selection (corresponding to at least what we sometimes call the "authentication" part). The setup phase occurs on server S. i (At least one of the servers is honest) is executed between a trusted third party U. The selection phase is performed between the same server and another third party U that may or may not be trusted. I This is performed between [the two processes]. The high-level goal of sharding subsets is to allow the trusted party U to "submit" some messages to the server during the setup phase. Later, during authentication, the protocol should allow U I Select a fixed-size subset of messages f, without learning the content of the messages, and then give the server S... a We should learn the content of subsets Instead of learning the index of the selected message Φ, at the end of the protocol, one of the servers will have access to a subset of the plaintext messages submitted by U, but the selection of which specific messages form that subset remains hidden. To formally specify the protocol, let M′ = {msg′} j} is a given server S a The set of messages possessed at the end of the protocol, if Then S a Output 1, otherwise it will abort. As discussed in this article, in conjunction with more general authentication, sharding subsets have three objectives: correctness, robustness, and zero-knowledge.

[0204] Correctness: If all participants are honest, the protocol will not abort, and given server S... a Output 1 with probability 1. Furthermore, if S a and U I If all parties are honest and the agreement is not terminated, then use Φ to precisely select M. I .

[0205] Robustness: If S a It is honest, and if Then no matter how other servers and U try to deceive, the protocol will terminate with an overwhelming probability.

[0206] Zero-knowledge: As long as one server remains honest, no server should learn anything about Φ. Furthermore, given server S... a It is honest, {S i} i≠a and U I You shouldn't learn anything about underlying plaintext messages.

[0207] 3.0 Login and Authentication Agreement

[0208] We now describe how individual U securely stores its biometric template on a server, and subject U I This can be verified later. Parts of this specification extend the concepts disclosed in PCT Publication WO2017 / 083732, filed November 11, 2016, which is incorporated herein by reference in its entirety.

[0209] Figure 4 This is a logical flowchart of the login process according to an embodiment of the present invention. During login, in process 41, the first biometric computer system generates biometric data for individual U, and in process 42, the generated biometric data is encoded and extracted into segments. (The encoded biometric data corresponds to template E) T This conforms to Section 1.1. The encoded biometric data is presented in the form of n shards, where n is the number of servers. In process 43, the first biometric computer system distributes the n shards across the n servers. In a further related implementation, additional (optional) processing is performed by the first biometric computer system. Specifically, in process 44, the first biometric computer system performs the offline phase of the MPC protocol later used for authentication. In process 45, the first biometric computer system then sends the computed custom output to each server for use in MPC. (Recall from Section 1.1 that for authentication, MPC uses an algorithm corresponding to f.)

[0210] Figure 6 This is a logic flowchart of the authentication process according to another related embodiment of the present invention. During authentication, in process 61, the second biometric computer system generates the subject's biometric data. Then, in process 62, the second biometric computer system encodes the subject's biometric data and extracts it into slices. The biometric data thus encoded constitutes an entropy point P. I (First mentioned in Section 1.1 above). In process 63, the second biometric computer distributes n shards across n servers. In process 64, each server in the server retrieves data from memory during the offline phase of MPC ( Figure 4 Processes 44 and 45 in the middle are based on the MPC parameters pre-calculated by U. In process 65, the server calculates f(E)T ,P I (without needing to learn about E) T and P I Any content. In one implementation, the function "f" is a biometric matching function. In one implementation, the computation produces slices of output value O. In one implementation, the slices of O are returned to the subject, who then reconstructs these slices to recover O. In one implementation, if the final output O is 1, the subject is certified as an individual. Otherwise, the subject is not certified as an individual.

[0211] In another implementation, the server can recover O without returning any fragments to the user. In one implementation, if the final output O is 1, the subject is certified as an individual. Otherwise, the subject is not certified as an individual.

[0212] In another implementation, O can be arbitrarily selected as any value upon login. In one implementation, O can be selected as the secret key (or a fragment of the secret key, if more than one factor is being used).

[0213] In another embodiment, a second biometric computer enables a server to calculate the MAC codes of segments of the subject. These MAC codes are used to determine the server's calculation of f(E). T ,P I The MAC code is used during the process of reconstructing O. It is returned along with a fragment of O. The subject then checks this MAC code before reconstructing O to determine if the server has correctly computed f(E). T ,P I And they did not learn about P. I Any content.

[0214] In another implementation, the server uses protocols including SPDZ and / or function secret sharing to compute f(E). T ,P I ).

[0215] In another embodiment, a second biometric computer initiates the generation of biometric data purportedly belonging to an individual, fragments the subject's biometric data, and distributes the fragments across multiple servers. Fragment distribution causes the servers to calculate MAC codes for the subject's fragments, and each server performs a multi-party computation algorithm to determine a blind match score for the subject's fragmented biometric data relative to the individual's corresponding fragmented data. Each server uses the blind match score to calculate a corresponding function share and returns the calculated function share along with the previously calculated MAC code value to the second biometric computer. The second biometric computer uses the function share data to determine if a match has been determined and evaluates the MAC code to confirm the authenticity of the function share data.

[0216] In process 66, each server in the server group is programmed to accept or reject independently. In one implementation, the programming is done in such a way that the server is unaware of whether it has been accepted or rejected. Furthermore, it is unaware of whether any of the other servers have accepted or rejected. In one implementation, it is impossible to determine from a fragment of output values ​​from a given server whether the output value indicates that the subject has been authenticated as an individual. Authentication process 68 is successful if and only if a sufficiently large subset of servers accepts in process 66.

[0217] The following are two examples where, in some implementations, not all servers accept 66.

[0218] In the first example, not all servers are accepted based on redundancy. In one implementation, more than one server receives the same fragment during login / authentication. In this case, more than one server will produce the same output fragment. In one implementation, authentication requires only one instance of each output fragment. If two servers that receive the same fragment produce different output fragments (e.g., because one server is malicious or faulty), and a subset of the output fragments results in successful authentication, then the subject is successfully authenticated as an individual. In one implementation, if the output confirming the authentication can be recovered, the subject is successfully authenticated as an individual.

[0219] Alternatively, in another implementation: Server 1 receives login fragment 1 and authentication fragment 1. Server 2 receives login fragment 1 and authentication fragment 2. Server 3 receives login fragment 2 and authentication fragment 1. Server 4 receives login fragment 2 and authentication fragment 2. Authentication can be performed using only servers 1 and 4. Alternatively, authentication can be performed using only servers 2 and 3. If servers 1 and 4 or servers 2 and 3 confirm the authentication, the subject is authenticated as an individual.

[0220] In the second example, some sharding methods (such as Shamir sharding) result in a situation where only a certain number of shards are needed to recreate the secret (in this case, the output value) -- n out of m shards are sufficient.

[0221] The exemplary methods described in Examples 1 and 2 above may be chosen for reasons including sometimes server downtime, becoming unavailable, malfunction, offline, or the server may be malicious.

[0222] In one implementation, each server connected to a given gateway receives the same shard. In such an implementation, during a given authentication attempt, each gateway selects one server connected to it to participate in the data exchange process (so that one server from each gateway participates). In the event of authentication failure, authentication can be retried based on certain conditions or automatically. During this retry, each gateway can (e.g., based on internal scheduling or load balancing algorithms) select a server different from the one used in the previous attempt. In this way, the array of servers participating in the first authentication attempt can be a different subset of servers than the one participating in the second authentication attempt. This mitigates the possibility of single points of failure within the server array or subset of servers.

[0223] Now let's combine Figure 4 Another implementation method is described. Figure 4 This is a logical flowchart of the login process according to an embodiment of the present invention. During login, in process 41, the first biometric computer system generates biometric data for individual U, and in process 42, the generated biometric data is encoded and extracted into segments. (The encoded biometric data corresponds to template E) T This conforms to Section 1.1. The encoded biometric data appears across n shards, where n is the number of servers. In process 43, the first biometric computer system distributes the n shards across the n servers. In a further related implementation, additional (optional) processing is performed by the first biometric computer system. Specifically, in process 44, the first biometric computer system performs the offline phase of the MPC protocol later used for authentication. In process 45, the first biometric computer system then sends the computed custom output to each server for use in MPC. (Recall from Section 1.1 that for authentication, MPC uses an algorithm corresponding to f.)

[0224] In some embodiments of the invention, in (e.g., just combined) Figure 4 (As described) The fragments distributed to the server during the login process are encrypted. Figure 2This is a flowchart illustrating how a first biometric computer system implements such encryption according to an embodiment of the present invention. In process 21, the first biometric computer obtains the encryption key of server a. In process 22, the first biometric computer system fragments each message into n-1 fragments for each server other than server a. In process 23, the first biometric computer system encrypts the fragments for each server i (other than server a) using the encryption key of server i (which the first biometric computer obtains from server i). There are now n-1 encrypted fragments. Next, in process 24, the first biometric computer system generates a random symmetric key k. In process 25, the first biometric computer system also encrypts the n-1 encrypted fragments using the symmetric key k. In process 26, the first biometric computer system sends its corresponding double-encrypted fragment to each of the n-1 servers i. (Please remember that each fragment used for server i was initially encrypted using the key obtained from server i.) In process 27, the key k itself is fragmented into n fragments, and in process 28, the first biometric computer system sends the fragments of key k to the respective servers.

[0225] Figure 3 It is based on the combination just now Figure 2 The described flowchart illustrates the authentication logic in the case of encrypting fragments. In process 31, the second biometric computer system downloads data from the server... Figure 2 In processes 26 and 28, the first biometric computer system distributes double-encrypted fragments and fragments of k. In process 32, the second biometric computer system reconstructs k. In process 33, the second biometric computer system uses the reconstructed k to decrypt one layer of the fragment. However, the fragments on each server i (except server a) are still encrypted with the encryption key of server i. In process 34, the second biometric computer system selects a subset of these encrypted fragments, and in process 35, sends this subset to server a for decryption to recover the biometric U from server a. I The encoding enables server a to evaluate the existence of a match.

[0226] Figure 5 This is a logical flowchart of the authentication process according to a relevant embodiment of the present invention. During authentication, in process 51, the second biometric computer system generates user U... I The biometric data. Then, in processing 52, the second biometric computer system will... I The biometric data is encoded and extracted into slices. This encoded biometric data constitutes an entropy point P. I(First mentioned in Section 1.1 above). In processing 53, the server and the second biometric computer system perform a subset protocol selection step (combined with the above). Figure 3 (described) to select the corresponding P I A subset of the encrypted fragments. At this point, each server possesses P. I Point sharing and E T Sharing. In processing 54, each server in the server retrieves data from memory during the offline phase of MPC. Figure 4 Processes 44 and 45 in the middle are based on the MPC parameters pre-calculated by U. In process 55, the server and the second biometric computer system jointly calculate f(E) T ,P I ) without learning about E T and P I Any content. In one implementation, the function "f" is a biometric matching function. If the final output is 1, then U I =U. Otherwise, U I ≠ U. In process 56, each server in the server pool is programmed to accept or reject individually. Authentication in process 58 succeeds if and only if all servers accept in process 56. Otherwise, subject U... I The authentication was rejected in process 57.

[0227] This authentication process has the potential for use in multiple fields. Those skilled in the art will recognize that this technology can be used in many applications, including authentication. Applicable industries include finance and banking, government and defense, healthcare and medical, retail, consumer authentication, enterprise, identity, and more.

[0228] Furthermore, while the above implementations disclose the yes / no authentication result, other implementations include obtaining the key by, for example, sharding the key across multiple servers, and then (after successful authentication) each server sending its shard to U. I Therefore, after successful authentication, U I The secret key can be reconstructed for use in additional cryptographic operations.

[0229] Additional examples of authentication used in some embodiments of the present invention include: authenticating users to a server (e.g., obtaining SSH keys, client SSL credentials and keys, enterprise 802.11 credentials and keys, OAuth tokens, one-time passwords, etc.).

[0230] Please note that these items can also be linked together (for example, an OAUTH token can be used to obtain subsequent credentials / keys).

[0231] Furthermore, some embodiments of the present invention can be used to authenticate the authentication server itself. For example, an authenticated user can use various servers to update his / her authentication data, user details, authorization policies, etc.

[0232] 4.0 Example Encoding Scheme and Authentication Algorithm

[0233] We can now place the above parts in an example implementation that provides fingerprint authentication and achieves the security advantages described in Section 2. In this example implementation, we will use fingerprint biometric data encoded as described below and use the SPDZ multi-party computation protocol for the comparison phase. This example implementation is discussed below.

[0234] 4.1 Fingerprint biometrics and representation

[0235] Fingerprints are a common biometric modality widely deployed in commercial applications today. Many fingerprint recognition algorithms represent fingerprints using the extracted fingerprint minutiae (the locations where fingerprint ridges split or end) and their angles. Comparing two fingerprints then requires determining how close the sets of fingerprint minutiae are to each other. One method for performing this matching is to utilize "Minutia Cylinder Code" (MCC). This method maps the space of fingerprint minutiae around a point into a three-dimensional quantized data structure (x-coordinate, y-coordinate, θ-angle).

[0236] The presence of a fingerprint feature point at a specific location with a specific angle assigns a 1 to the associated point in the data structure. The absence of a fingerprint corresponds to a 0. To compare with the fingerprint, the dot product of the two fingerprint feature points' cylindrical codes is required, and it is determined whether this dot product is greater than a threshold T.

[0237] E T ·E T I>T

[0238] Where E T It is the MCC code of template T, E T I is template T I The MCC encoding.

[0239] If choosing the entropy subset (Sometimes in this paper, the "entropy subset" is referred to as the "confidence subset") as the set of fingerprint feature points with the highest confidence and highest discriminative power (see Section 2). Similarly, P can be considered as the set of fingerprint feature points with the highest confidence and discriminative power. I Encode it as MCC and represent the matching function f as the same dot product.

[0240] If from P I If the MCC is represented entirely by 1s and 0s, then we can see E T With PI The dot product of the encoding is simply E T Sum of subsets. Subset operations are performed using the protocols in Section 3, and summation / thresholding operations are performed using MPC (as described below).

[0241] Before proceeding, please note that the above MCC representation can be enhanced using one or more of the following methods.

[0242] Use fingerprint feature point features (e.g., fingerprint feature point type, fingerprint feature point neighborhood, ridge descriptor) to describe fingerprint feature points more accurately.

[0243] Non-binary encoding is used to smooth out noise by encoding a "score" for each fingerprint feature point. Specifically, the closer the location is to the fingerprint feature point, the higher the score, and the farther away from the fingerprint feature point, the lower the score.

[0244] Depending on the model and sensor parameters used, fingerprints can be represented using either unaligned or globally aligned representations.

[0245] Use non-fingerprint feature points (e.g., ridge descriptors) to replace or supplement fingerprint feature points.

[0246] Finally, it's important to note that other biometrics can also be used as input, and multiple biometrics can be combined in a single login or authentication process.

[0247] The "norm" of a vector space can be represented in various forms, including Hamming distance, Hamming distance of a subset, l_p distance (for any p), 1_p distance of a subset, cosine similarity, etc. In one implementation, the concept of similarity between two vectors is embedded as the dot product between the two vectors.

[0248] 4.2 Overview of SPDZ Multi-Party Calculation

[0249] Recall the discussion of Multi-Party Computation (MPC) in Section 2. The MPC component of our authentication protocol is responsible for performing the comparison algorithm. Specifically, as mentioned above, a simple way to do this is to compute a threshold subset sum. That is, given a value x across n server shards... i Given a set of values, for a given threshold T, we need to calculate:

[0250]

[0251] SPDZ is a protocol that performs computations on fragmented data (as described in Section 2). It has all the security requirements we need. Therefore, as described in Section 3, an appropriate fragment can be selected as input to the MPC protocol using a subset protocol, and then the SPDZ protocol can be used to calculate the sum and the threshold.

[0252] The threshold operation in the calculation is an integer comparison, which is very expensive in SPDZ (requiring several seconds of computation and a setup phase that transfers >50MB of data per comparison). This cost immediately makes the protocol impractical.

[0253] However, a method has been identified that avoids most of these costs by utilizing the login step. During login, the original user U is trusted by all servers by definition. Therefore, U can generate all offline stage data on behalf of all servers, a process that (for technical reasons) eliminates the associated computational and communication complexities.

[0254] In implementations using different MPC methods (e.g., variations of SPDZ, etc.), this pre-generated data can vary. [For example, see...] I., Keller, M., Larraia, E., Pastro, V., Scholl, P. and Smart, NPP practically covertly secure MPC for dishonest majorit-or: breaking the SPDZ limits. In European Symposium on Research in Computer Security (2013), Springer, pp. 1-18.] These may vary further depending on the actual functions computed by the MPC protocol.

[0255] Therefore, the SPDZ online protocol can be run efficiently (the computational cost is negligible and the amount of data exchanged between servers is very small).

[0256] 5.0 Overview of Exemplary Implementations

[0257] In one implementation, the final overall process is the login process (e.g., Figure 4 (as shown) and certification process (such as) Figure 6 The combination shown is as follows.

[0258] User U's biometric data is scanned, and an encoding of her individual biometric data is generated via a component we will refer to as the "first biometric computer." The first biometric computer uses this encoding to generate fragments of her biometric data, as well as additional information that helps execute the MPC protocol but is unrelated to U's biometric data. The fragments and other data are distributed to a server for use during the online authentication phase.

[0259] In the subsequent authentication process, the subject to be authenticated (and claiming to be an individual) (user U) IHer biometric data is scanned, and this biometric data and associated coded templates are generated via a component we will call the "second biometric computer system." Once this happens, U I This will generate fragments of her biometric data and distribute those fragments to the server.

[0260] Finally, the server independently runs an online MPC protocol (e.g., SPDZ, FSS) using the offline data generated during login to compute a biometric matching function. At this point, each server has a fragment with output O, which is returned to U. I The U I Determine if the authentication was successful.

[0261] In another implementation, the final overall process is the login process (e.g., Figure 4 (as shown) and certification process (such as) Figure 5 (as shown in the figure) combination.

[0262] User U's biometric data is scanned, and an encoding of this individual biometric data is generated via a component we will refer to as the "first biometric computer." The first biometric computer uses this encoding to generate encrypted fragments of her biometric data, along with additional information that aids in the execution of the MPC protocol but is unrelated to U's biometric data. These encrypted fragments and other data are then distributed to a server for use during the online authentication phase.

[0263] In the subsequent authentication process, the subject to be authenticated (and claiming to be an individual) (user U) I Her biometric data is scanned, and a confidence subset of this biometric data and associated coding templates are generated via a component we will call the "second biometric computer system." Once this occurs, U I The server will then run a subset selection protocol, through which each server is provided with a different set of decryption fragments of the encoding template, but is not provided with information that allows the server to determine the location of the decryption fragments itself.

[0264] Finally, the servers independently run an online MPC protocol (e.g., SPDZ) using the offline data generated during login to compute a biometric matching function. At this point, each server has independently determined a biometric match. If all servers accept the match, then U is considered a valid match. I It has been certified. Otherwise, U I Unverified.

[0265] The embodiments of the present invention are more efficient than previous multi-party computation methods. For example, by (1) treating logged-in users as generally trusted individuals in a set of mutually distrustful servers, and (2) using a secure subset selection algorithm, the expensive offline phases of interactive MPC protocols (such as computing multiplicative triples) can be eliminated. By simplifying the authentication protocol to a dot product, the number of rounds of the online phase can be reduced to an acceptable number (e.g., ~5 rounds, which may depend on accuracy).

[0266] In one implementation, if certain conditions are met, one or more servers enforce rate limiting or account locking. These conditions will be familiar to those skilled in the art. For example, the conditions may include: too many incorrect authentication attempts, authentication attempts originating from a specific location, authentication attempts at a specific time (e.g., a time or date on a day indicating a high-risk user or unusual behavior), authentication attempts with different identity assurance requirements, authentication attempts with factors indicating a specific risk level, etc. In one implementation, after the conditions are met, security processing is implemented. For example, security processing may include: blocking further authentication attempts for a period of time; notifying the user, server, or organization of suspicious behavior; and / or increasing the requirements for subsequent authentication, etc.

[0267] 6.0 Additional Exemplary Implementations

[0268] In another exemplary implementation, a user can present multiple biometric modalities, which are combined to form a single encoded template and / or confidence subset.

[0269] In another implementation, a user can present multiple biometric modalities, each of which is encoded and authenticated as described herein. Each biometric modality generates a separate output value O. These output values ​​are combined to determine whether the subject has been authenticated as an individual.

[0270] In another implementation, these output values ​​are combined to form a secret key.

[0271] In another implementation, f(E) can be calculated according to two (or more) thresholds by having U perform an offline phase. T ,P I And send the individual sets and their fragments within these sets to log in to the same biometric fragment according to two (or more) separate thresholds. During authentication, select the desired threshold, and call the function to calculate f(E) according to the desired threshold. T ,P IThe relevant auxiliary data is used in the authentication protocol. In one implementation, authentication is performed at a lower threshold, which may result in a better user experience and a lower false rejection rate (FRR) but a higher false acceptance rate (FAR). The subject can access lower-risk functions, such as viewing her account balance on a mobile banking app on her mobile phone. To allow her access to certain functions or authorize higher-risk transactions (such as high-value transactions), she needs to be authenticated at a higher threshold. In some implementations, higher levels of authentication require additional factors, biometrics, or input.

[0272] In another implementation, the fragmented and auxiliary data are statically encrypted by one or more servers. This achieves layered security.

[0273] In another exemplary implementation, during the login phase, an individual scans his / her fingerprint and enters his / her PIN code on the device.

[0274] A first biometric computer system, trusted by the individual, determines a confidence subset of the biometric input data. This confidence subset is characterized as an ordered list or matrix of location and unique biometric elements, or, for example, fingerprint feature points. Each element is fragmented by the first biometric computer system into n fragments, where n is greater than 1. No fragment may even represent only a portion of the biometric data. In some implementations, if an attacker obtains all fragments except one of the n fragments, the attacker still cannot recover any biometric information—all n fragments would be required. In another implementation, a threshold number of fragments is sufficient to recover the biometric information.

[0275] In some implementations, the first biometric computer system applies a sorting scheme to obscure location information. In some implementations, the sorting scheme is partially based on authentication input, such as a PIN or fingerprint. In one implementation, the same sorting scheme is applied to all the fragment sets sent to the server. The first biometric computer system generates n fragment sets. The first biometric computer system also generates n unique and corresponding sets of noisy data that will be used during the authentication phase.

[0276] In one implementation, n is 2. A first set of fragments is encrypted using key A. A second set of fragments is encrypted using key B. A first biometric computer system sends a dataset to server 1 comprising: (a) the set of fragments encrypted using key A, (b) key B, and (c) a set of noisy data. Similarly, the first biometric computer system sends a different dataset to server 2 comprising: (a) the set of fragments encrypted using key B, (b) key A, and (c) a set of noisy data. It should be noted that server 1 holds key B for encrypting the fragments held by server 2, and server 2 holds key A for encrypting the fragments held by server 1, such that neither server can decrypt its fragments using the key it holds. This is an example of a novel method for distributing fragments and keys to different servers.

[0277] In one implementation, the information sent by the processor is authenticated and / or signed. During the authentication phase, the subject claiming to be an individual scans his fingerprint and enters his PIN code on a second device. A second biometric computer system coupled to the second device determines a confidence subset of the biometric input data. In one implementation, the second biometric computer system applies a sorting scheme to the confidence subset. (In another implementation, the second biometric computer system instead applies the reverse of the sorting scheme to the encrypted set of fragments.)

[0278] Server 1 sends a set of fragments encrypted using key A to the second biometric computer system. Server 2 sends a set of fragments encrypted using key B to the second biometric computer system. In one embodiment, the information sent by the servers is authenticated. The information can be sent via a secure channel.

[0279] Using confidence subsets, the second biometric computer system selects new subsets of each encrypted fragment set from the encrypted fragment set.

[0280] In one implementation, a sorting scheme (which may or may not be the same sorting scheme previously used) is applied to the new subset. In another implementation, the position is not included in the new subset. The second biometric computer system sends the new subset encrypted using key A to server 2. The second biometric computer system sends the new subset encrypted using key B to server 1.

[0281] In one implementation, information sent by a second biometric computer system is authenticated and / or signed. Server 1 decrypts a new subset of fragments encrypted with key B. Server 2 decrypts a new subset of fragments encrypted with key A. Both servers now have unencrypted sets of fragments representing a confident subset of the biometrics of a subject claiming to be an individual. However, since location information is not included or is unknown, even corruption of the unencrypted fragments will not compromise the biometric information.

[0282] In one implementation, server 1 and server 2 communicate with each other without sharing unencrypted shards. A noisy dataset is used to make this secure communication more efficient, including by improving efficiency, requiring less computation, and by needing to exchange less data between server 1 and server 2. This novel approach enables secure communication between two or more servers in a highly efficient manner by utilizing auxiliary data (e.g., a noisy dataset) provided by a trusted party upon login; in some implementations, the trusted party is the login user or processor.

[0283] Once the calculations are complete, servers 1 and 2 are able to determine (or have already determined) whether a subject has been authenticated as an individual. In one implementation, this determination is based on a combination of slices, which reveals whether a confidence subset of the subject is sufficient to select a sufficient number of unique biometric fingerprint features from the subject's dataset without requiring non-transient storage of the subject's dataset. What constitutes "sufficient" may depend on adjustable thresholds, for example, to reduce the false rejection rate (FRR) or false acceptance rate (FAR).

[0284] References

[0285] 1.Beaver, D.Efficient multiparty protocols using circuitrandomization.In Annual International Cryptology Conference(1991), Springer, pp.420–432.

[0286] 2.Ignatenko, T., and Willems, FMInformation leakage in fuzzycommitment schemes. IEEE Transactions on Information Forensics and Security 5, 2 (2010), 337–348.

[0287] 4. Micali, S., and Rogaway, P. Secure computation. In Annual International Cryptology Conference (1991), Springer, pp. 392–404.

[0288] 5. Shamir, A. How to share a secret. Communications of the ACM 22, 11 (1979), 612–613.

[0289] 6. Stoianov, A., Kevenaar, T., and Van der Veen, M. Security issues of biometric encryption. In Proceedings of Toronto International Conference on Science and Technology for Humanity (2009), pp. 34–39.

[0290] 7.Uludag,U.,Pankanti,S.,and Jain,AKFuzzy vault for fingerprints.InInternational Conference on Audio-and Video-Based Biometric Person Authenti-cation(2005),Springer,pp.310–319.

[0291] 8.Yao,AC-C.Protocols for secure computations.In FOCS(1982),vol.82,pp.160–164.

[0292] The embodiments of the present invention described above are merely exemplary; many variations and modifications will be apparent to those skilled in the art. All such variations and modifications are intended to fall within the scope of the invention as defined by any of the appended claims.

Claims

1. A method for authenticating a subject as an individual using biometric data, wherein the biometric data of the individual has been previously obtained using a first converter connected to a first computing facility, the method utilizing computer processing including the following operations: Under the following conditions: (i) the first computing facility has generated a login shard based on the individual's biometric data; (ii) multi-party computation (MPC) information has been calculated for subsequent use in multi-party computation; (iii) Regarding both the login shard and the MPC information, the first computing facility has distributed the login shard and the MPC information to a first plurality of servers in the server array: An authentication fragment is generated based on a digital electronic signal, which is provided as the output of a second converter connected to a second computing facility. This digital electronic signal characterizes the subject's biometrics. The authentication fragment is distributed to a second or more servers in the server array; Perform data exchange processing including multi-party computation, which involves communication between subsets of servers in the array and also involves subsets of login shards, subsets of authentication shards, and subsets of MPC information to form authentication-related information for the subject, wherein the MPC information has been configured to facilitate the multi-party computation; as well as The information related to the authentication of the subject is processed to generate an output value indicating whether the subject has been authenticated as the individual.

2. The method according to claim 1, wherein, The computer processing is performed by a computing entity configured to restrict information sharing relative to a set of information items selected from the group consisting of: the output value, the digital electronic signal, the individual's biometric data, the subject's biometrics, the generated slices, and combinations thereof.

3. The method according to claim 1, wherein the computer processing further comprises: encoding the digital electronic signal so that the generated fragments are also encoded.

4. The method according to claim 3, wherein, Encoding operations include the use of neural networks.

5. The method according to claim 3, wherein, The encoding operation includes representing the digital electronic signal as a set of vectors in a metric space.

6. The method according to claim 5, wherein, The operation of performing the data exchange process using the subset of the generated fragments to form information related to the authentication of the subject includes: calculating a set of distances in the metric space.

7. The method according to claim 1, wherein, The data exchange processing operation includes performing the multi-party computation under the condition that none of the servers in the server array have obtained the intermediate value of the multi-party computation.

8. The method according to claim 1, wherein, The selected group of the server array generates new shards based on the generated shards.

9. The method according to claim 1, wherein, Fragments can be revoked by the revocation process that includes the data exchange process.

10. The method according to claim 9, wherein, After the fragment is revoked, the generation of a new fragment does not require the individual to be re-engaged with the first converter.

11. The method according to claim 9, wherein, The revocation process is configured to operate in a manner that prevents communication between the server array and other computing entities.

12. The method according to claim 9, wherein, The revocation process includes performing the data exchange process using a subset of the subset of the generated shards from a subset of the server array.

13. The method according to claim 12, wherein, The data exchange process involves communication between selected groups of servers from the server array.

14. The method according to claim 12, wherein, The data exchange processing includes: each server individually processing the individual fragments generated by that server along with the subject fragments generated by that server to generate a new set of fragments, which constitutes the output value.

15. The method according to claim 1, wherein, The operation of the server array receiving and storing the generated fragments includes: receiving and storing the message authentication code of the fragment, and the data exchange process includes: using the message authentication code to confirm that the output value indicating whether the subject is certified as the individual is itself genuine.

16. The method according to claim 1, wherein, The operation of the server array receiving and storing the generated shards includes: receiving and storing shards distributed across Beaver triples having the generated shards by the server array.

17. The method according to claim 16, wherein, The operation of the server array receiving and storing the generated shards includes: receiving and storing the message authentication code of the Beaver triple.

18. The method according to claim 17, wherein, The operation of the server array receiving and storing the generated fragments includes: receiving and storing fragments corresponding to message authentication code keys.

19. The method according to claim 1, wherein, The operation of the server array receiving and storing the generated shards includes: receiving and storing shards with random values.

20. The method according to claim 1, wherein, The operation of the server array receiving and storing the generated fragments includes: receiving and storing fragments of functions that facilitate authentication processing.

21. The method according to claim 1, wherein, The operation of the server array receiving and storing the generated fragments includes: extracting a confidence subset of the subject's biometric value set from the digital electronic signal.

22. The method according to claim 1, wherein, The server array receives and stores a set of values ​​to enable efficient subsequent generation of shards. This operation includes receiving and storing items selected from a group consisting of Beaver triples, authentication shares, message authentication code shards, random shards, other shards, and combinations thereof.

23. The method according to claim 17, wherein, The data exchange process includes: having the server array execute a multi-party computation algorithm to determine a blind value; having the server array calculate the corresponding shard and return the calculated shard along with the previously calculated message authentication code value to the computation entity; and having the computation entity use the shard data to determine whether the subject is certified as the individual and evaluate the message authentication code.

24. A system for authenticating a subject as an individual using biometric data, wherein the biometric data of the individual has been previously obtained using a first converter coupled to a first computing facility, the system having a computing component comprising: A second converter, the second converter having a digital electronic signal output that characterizes the biometrics of the subject; A second computing facility is connected to the second converter and is configured to receive the digital electronic signal from the second converter. Server array; as well as Third computing facility; The second computing facility, the server array, the third computing facility, and the computer-readable medium encoded with instructions establish computer processing when the instructions are executed by the aforementioned computing components, the computer processing including the following operations: Under the following conditions: (i) the first computing facility has generated a login shard based on the individual's biometric data; (ii) Multi-party computation (MPC) information has been calculated for subsequent use in multi-party computation; (iii) Regarding both the login shard and the MPC information, the first computing facility has distributed the login shard and the MPC information to a first plurality of servers in the server array: The second computing facility generates an authentication fragment based on the digital electronic signal and distributes the authentication fragment to a second plurality of servers in the server array; The authentication fragment is received and stored by the second plurality of servers in the server array; A subset of the server array performs data exchange processing including multi-party computation, the multi-party computation involving communication between subsets of servers in the array and also involving subsets of the login shard, subsets of the authentication shard, and subsets of the MPC information, to form authentication-related information for the subject, wherein the MPC information has been configured to facilitate the multi-party computation; and The subset of the server array sends the authentication-related information of the subject to a third computing facility, wherein the formed information is configured to cause the third computing facility to generate an output value indicating whether the subject has been authenticated as the individual.

25. The system for authenticating a subject as an individual using biometric data according to claim 24, wherein, The computer processing is performed under conditions where the computing unit is configured to restrict information sharing relative to a set of information items selected from the group consisting of: the output value, the digital electronic signal, the individual's biometric data, the subject's biometrics, and the generated slices.

26. The system for authenticating a subject as an individual using biometric data according to claim 24, wherein, The operation of the second computing facility generating fragments based on the digital electronic signals and distributing the generated fragments to the server array further includes: encoding the digital electronic signals so that the generated fragments are also encoded.

27. The system for authenticating a subject as an individual using biometric data according to claim 26, wherein, The operation of encoding the digital electronic signal includes: using a neural network to implement the encoding.

28. The system for authenticating a subject as an individual using biometric data according to claim 26, wherein, The operation of encoding the digital electronic signal includes: representing the digital electronic signal as a set of vectors in a metric space.

29. The system for authenticating a subject as an individual using biometric data according to claim 28, wherein, The operation of performing the data exchange process using the subset of the generated fragments to form information related to the authentication of the subject includes: calculating a set of distances in the metric space.

30. The system for authenticating a subject as an individual using biometric data according to claim 24, wherein, The data exchange processing operation includes performing the multi-party computation under the condition that none of the servers in the server array have obtained the intermediate value of the multi-party computation.

31. The system for authenticating a subject as an individual using biometric data according to claim 24, wherein, The selected group of the server array generates new shards based on the generated shards.

32. The system for authenticating a subject as an individual using biometric data according to claim 24, wherein, Fragments can be revoked by the revocation process that includes the data exchange process.

33. The system for authenticating a subject as an individual using biometric data according to claim 32, wherein, After the fragment is revoked, the generation of a new fragment does not require the individual to be re-engaged with the first converter.

34. The system for authenticating a subject as an individual using biometric data according to claim 32, wherein, The revocation process does not require communication between the computing facility and the server array.

35. The system for authenticating a subject as an individual using biometric data according to claim 32, wherein, The revocation process includes performing the data exchange process using a subset of the subset of the generated shards from a subset of the server array.

36. The system for authenticating a subject as an individual using biometric data according to claim 24, wherein, The data exchange process involves communication between selected groups of servers from the server array.

37. The system for authenticating a subject as an individual using biometric data according to claim 24, wherein, The data exchange processing includes: each server individually processing the individual fragments generated by that server along with the subject fragments generated by that server to generate a new set of fragments, which constitutes the output value.

38. The system for authenticating a subject as an individual using biometric data according to claim 24, wherein, The operation of the server array receiving and storing the generated fragments includes: receiving and storing the message authentication code of the fragment, and the data exchange process includes: using the message authentication code to confirm that the output value indicating whether the subject is certified as the individual is itself genuine.

39. The system for authenticating a subject as an individual using biometric data according to claim 24, wherein, The operation of the server array receiving and storing the generated shards includes: receiving and storing shards distributed across Beaver triples having the generated shards by the server array.

40. The system for authenticating a subject as an individual using biometric data according to claim 39, wherein, The operation of the server array receiving and storing the generated shards includes: receiving and storing the message authentication code of the Beaver triple.

41. The system for authenticating a subject as an individual using biometric data according to claim 24, wherein, The operation of the server array receiving and storing the generated fragments includes: receiving and storing fragments corresponding to message authentication code keys.

42. The system for authenticating a subject as an individual using biometric data according to claim 24, wherein, The operation of the server array receiving and storing the generated shards includes: receiving and storing shards with random values.

43. The system for authenticating a subject as an individual using biometric data according to claim 24, wherein, The operation of the server array receiving and storing the generated fragments includes: receiving and storing fragments of functions that facilitate authentication processing.

44. The system for authenticating a subject as an individual using biometric data according to claim 24, wherein, The operation of the server array receiving and storing the generated fragments includes: extracting a confidence subset of the subject's biometric value set from the digital electronic signal.

45. The system for authenticating a subject as an individual using biometric data according to claim 24, wherein, The server array receives and stores a set of values ​​to enable efficient subsequent generation of shards. This operation includes receiving and storing items selected from a group consisting of Beaver triples, authentication shares, message authentication code shards, random shards, other shards, and combinations thereof.

46. ​​The system for authenticating a subject as an individual using biometric data according to claim 38, wherein, The data exchange process includes: causing the server array to perform a multi-party computation algorithm to determine a blind value; causing the server array to calculate the corresponding shard and return the calculated shard along with the previously calculated message authentication code value to the second computing facility; and causing the second computing facility to use the shard data to determine whether the subject is certified as the individual and to evaluate the message authentication code.

Images