Optimized private biometric matching

Abstract

A homomorphic encryption scheme, such as Paillier encryption and a bit packing process, allows biometric matching at the terminal without exposing the biometric template stored on the user device. Since such encryption schemes are data intensive, the bit packing process is able to reduce the data sent and processed, so that the biometric matching process can be completed in near real-time. The speed of this optimized process makes this technology applicable to many real-world processes, such as access control and transaction processing.

Description

[0001] Cross-referencing related applications

[0002] This application claims priority to U.S. Patent Application No. 16 / 664,530, filed October 25, 2019, the disclosure of which is incorporated herein by reference. Background Technology

[0003] The background description provided herein is intended to generally present the context of this disclosure. The work of the currently attributed inventors to the extent described in this background section, and various aspects of this specification that are not otherwise prior art at the time of filing, are neither expressly nor implicitly acknowledged as prior art to this disclosure.

[0004] Biometrics have been used for some time as an authentication mechanism between devices or between devices and individuals. However, templates of personal biometric data may be shared and subsequently stored by devices outside of an individual's control. If one or more biometric templates are corrupted by this third-party device, the individual may have no way to recover their data because they cannot generate new fingerprints, facial scans, iris images, etc. Summary of the Invention

[0005] In this embodiment, the biometric verification device can use homomorphic encryption to compare a biometric template with a biometric scan to determine if a match exists, without actually disclosing the biometric template to a third-party device. Furthermore, the homomorphic process allows the terminal to send current biometric scan data to itself without revealing scan information. To optimize the encryption process, an item packaging process can significantly reduce computational overhead during the verification phase. Attached Figure Description

[0006] For illustrative purposes only, the figures depict preferred embodiments. Those skilled in the art will readily recognize from the following discussion that alternative embodiments of the structures and methods shown herein may be employed without departing from the principles described herein.

[0007] Figure 1 This is a system diagram illustrating elements for private biometric matching according to this disclosure;

[0008] Figure 2 This is a jump diagram illustrating the first technology used for private biometric matching;

[0009] Figure 3 It is shown Figure 2 The diagram shows a modified jump chart of the technology shown;

[0010] Figure 4 This is a jump diagram illustrating another technique for private biometric matching; and

[0011] Figure 5 It is shown Figure 4 Another aspect of the technology is the jump chart. Detailed Implementation

[0012] A terminal may want to verify that a person is associated with a specific device such as a smartphone. For example, a point-of-sale (POS) device, such as at a retailer, may be able to process transactions using an unseen smartphone. That is, the POS may be able to complete a transaction with a smartphone using Wi-Fi or Bluetooth, and the smartphone may use the same protocol as when presenting the smartphone to the POS via Near Field Communication (NFC) by tapping it against the POS. However, the POS will first need to determine that the nearby smartphone has the correct credentials corresponding to the current purchase and the buyer.

[0013] The POS can send a request to a nearby smartphone for a biometric template of the corresponding user's image. The POS can also capture an image of the user participating in the current transaction. Once the POS detects a match between a smartphone with the user's biometric template and the newly captured image, the transaction can proceed using the normal payment process. In other words, in an exemplary embodiment, the smartphone can use the POS to establish a secure channel, and transaction data can be transmitted and signed via the smartphone's payment application along with the Personal Account (PAN) or token data associated with the user's payment card. This information can then be transmitted through the POS to the retailer's acquiring bank for approval and processing.

[0014] However, in this process, the POS should not simply be able to request biometric templates from every nearby smartphone in order to match images with the correct user. This would expose the biometric data of every nearby smartphone user, including those devices / users who were not involved in the transaction in any way. Instead, a user's image or biometric template should not be shared with every nearby smartphone so that the user's information is not unnecessarily disseminated. The techniques used to achieve this are discussed below. In this example, because the payment is made through separate purchase transactions using different credentials, the smartphone attempts to mislead the POS into believing that it is someone else, posing little or no threat. This type of identification could be considered passive.

[0015] In similar processes across different transaction types, such as receiving cash at an ATM, deliberately attempting to deceive the ATM's identification process could lead to fraudulent fund receipt. In such cases, proactive identification can be used to further authenticate the user. This involves the user providing a template copy signed by an authority and including the user's identity information, rather than simply matching a biometric template. In this scenario, the approval process establishes not only a relationship between the user and their smartphone but also a pre-existing relationship between the user and their identity with the authority.

[0016] Homomorphic encryption algorithms, such as Paillier encryption, can be used. The basic premise is that operations performed on encrypted data have the same result as operations performed on unencrypted data. As discussed in more detail below, this allows verification operations to be performed on encrypted data so that the biometric template never leaves the smartphone during the matching process on the terminal.

[0017] While the advantages of this process are obvious, homomorphic cryptographic algorithms such as Paillier may require significant computation at certain stages. For example, key generation and data encryption can be so time-consuming that including these steps in normal encrypted transactions such as purchases may be prohibitive. The following description discloses a method to address these drawbacks. Furthermore, homomorphic algorithms applied to biometrics can generate sufficiently large datasets, adversely affecting transmission time between user devices and terminals (e.g., POS or ATMs). The embodiment of data packing described below reduces the amount of data required for transmission by a factor of 8, but other reduction factors are possible. Bit masking of unnecessary items also helps reduce the likelihood of data leakage during data reduction.

[0018] In embodiments using this technology, the matching process takes approximately 300 milliseconds, the initial communication payload is 55 megabytes of data, and the payload for each subsequent communication is approximately 1 megabyte.

[0019] Figure 1 An exemplary system 100 supporting a homomorphic matching process is shown. Terminal 102 may be a POS device, such as a cash register, ATM, or any other device to which biometric authentication is useful, including access control, record keeping, or other personal transactions. Terminal 102 may include a processor 104, a biometric capture device 112, an encryption module 114, and a wireless interface 116 coupled to memory 106 via a data bus 105. Memory 106 may include an operating system and utilities 108 for booting up and basic operation of terminal 102, including communications and user interfaces, as known. Transaction processing module 110 may handle interactions between the purchaser and / or payment instrument, barcode scanner or card acceptor, host system, and acquirer.

[0020] Homomorphic module 114 may include encryption routines for encryption and decryption, and routines for generating templates based on biometric data received from biometric capture device 112. This data may include facial images, fingerprint scans, iris scans, retinal scans, palm contour data, voiceprints, etc. More specific functions associated with homomorphic module 114 are discussed below. Wireless interface 116 may include a Wi-Fi module, Bluetooth module, or any wireless connectivity hardware and associated protocols that allow relatively high-speed data communication between terminal 102 and external entities.

[0021] System 100 may also include, or be coupled to, multiple mobile devices, such as smartphones 118a, 118b, 118c, and 118d. Mobile devices may also include laptops, tablets, wearable devices, or other electronic devices capable of storing data and enabling bidirectional communication.

[0022] During operation, user 120 can approach terminal 102 to complete the transaction. Terminal 102 may want to determine which nearby (if any) smartphone 118 is associated with the user. (Using...) Figure 2-5 It discusses several different scenarios of this process.

[0023] Turning Figure 2 The diagram illustrates an interaction 200 involving only the identification device, i.e., a passive transaction. At step 201, user device 118a can generate an asymmetric key pair pk,sk (public key and secret key). This operation can only be performed once, at any time before the transaction. Biometric features x can be collected and stored as a series of data x1-x. n Also known as a biometric template, or more simply a template. A template can be encrypted as a set of values, represented as [[x n The collection, generation, and encryption of biometric data can only be completed once before its use. Since key generation, template generation, and encryption are the most computationally intensive steps associated with using Paillier (homomorphic) encryption, these data can be pre-computed once while the device is inactive, thus saving time during transactions.

[0024] At step 202, at the start of a potential transaction, terminal 102 may collect biometric measurements of user 120, such as an image, and generate a template y using the raw data. Because terminal 102 may have fewer limitations than mobile devices, including access to power and a larger processor, template generation via a neural network can be performed almost in real time. In other embodiments, terminal 102 and mobile devices may begin this initial step before the transaction is initiated, for example, when the user enters a store. Step 202 may then proceed: requesting template matching from surrounding mobile devices 118a, 118b, 118c, 118d. Although the subsequent process can be repeated for each mobile device, for clarity and simplicity, only a single response is described below.

[0025] In response to the request, at step 204, the smartphone's public key and encryption template can be sent to terminal 102. At block 206, terminal 102 can multiply each item of the encryption template with the corresponding item of the local template. As discussed more below, Paillier encryption or other additive homomorphic encryption schemes are characterized in that an operation performed on encrypted data produces the same result as the same operation performed on unencrypted data.

[0026] At this point, the terminal has no information about the user's biometric template, only the information that it exists. If terminal 102 returns a result matrix z, which is the inner product of x and y, to device 118a, then device 118a might be able to determine the template obtained at the terminal. To avoid leaking this information to device 118a, terminal 102 can add a random number B to the operation result. After adding the random value, device 118a cannot discover any information about the template from terminal 102.

[0027] At step 208, the encrypted value z, including the added value B, is sent from terminal 102 to device 118a. At step 210, device 118a can decrypt z to reveal the plaintext value z. The decryption process is much more efficient than the encryption process, so device 118a can perform decryption much faster than expected transaction processing time. Furthermore, the data transmitted at step 208 (and below at step 212) is significantly less than the initial transmission at box 204. This helps to speed up the process.

[0028] At step 212, this value can be returned to terminal 102. The inner product of x and y can be obtained by subtracting the value B from z. If this inner product is less than a threshold, or sufficiently close to the value 1 in the case of a cosine similarity match, then a match is confirmed. As discussed above, this passive technique is available because biometric matching is not actually used to complete the transaction. The match only confirms that the payment credentials on device 118a are available for payment. If device 118a takes steps to mislead or deceive terminal 102 into believing it is someone else, the result will simply be that device 118a may complete the payment transaction for goods or services ultimately acquired by another user. In other words, in this scenario, there is no incentive to deceive.

[0029] Although Figure 2 The size of the data sent in an instance can be managed, but Figure 3 Packaging techniques for reducing the data size by up to eight times, at least initially, are illustrated. While larger and smaller size reductions are possible, eight times provides an optimized balance between processing time and data transmission time for current system configurations. At step 221, similar to the previous example, device 118a collects biometric data and generates a key pair. In this case, the template can only be encrypted once every eight values. In various embodiments, the number of skips can be a function of the encryption level (key size). This is discussed more below.

[0030] Therefore, in this example, the new encryption vector [[x' j ]]comparable Figure 2 The encrypted value of the instance is eight times smaller. At step 224, in response to the request following the template generation at step 222, the value can be sent to the terminal. At step 226, terminal 102 will execute item (y). i ,……,y i+7 Similar grouping to produce y' j At step 228, the corresponding groups are multiplied, and the resulting value is sent back to device 118a.

[0031] At step 230, a random value group r = (r0, ..., r7) can be generated and added to the decrypted value to prevent overflow, as discussed in more detail below. At step 232, the decrypted group z' and the value r' = r0 + ... + r7 can be returned to the terminal. At step 234, the value p is the difference between z' and B, and the inner product is the sum of the terms minus r'.

[0032] Figure 4Process 240 illustrates a scenario where user / device 118a might be highly motivated to deceive terminal 102, for example, when withdrawing money from an ATM. In this case, device 118a can register an encryption template with an authoritative institution such as a financial institution to bind the encryption template, authoritative key, and user 120's identity to a signature object σ. After step 242, steps 243 and 244 are as described above. Step 246 not only performs operations and adds value B to the local template and the received encryption template, but also multiplies the result of the operations with a second random value A.

[0033] As described above, at step 248, the value z is sent to device 118a. At step 250, the value z is decrypted using the private key sk, and this value is returned to terminal 102 at step 252. At step 254, the value B is subtracted from z, and the result is divided by A to determine the inner product value.

[0034] Figure 5 Show Figure 3 Process 240 illustrates the effect of device 118a attempting to deceive terminal 102 into believing a matching value A exists. At step 250, device 118a may attempt to add (or subtract) the value e to the resulting decrypted value, causing terminal 102 to draw an incorrect conclusion about the value. However, the value of A can be chosen such that any attempt to change the value z will result in the returned z+e term being multiplied by A. -1 The time will be much higher than the threshold t due to the large plaintext space. The use of modulus mathematics ensures that any attempt to change the return value can still be detected even if the terminal 102 does not know the value of e.

[0035] Once the matching is complete, for example in Figure 4 This allows the user identifier to be extracted from the encrypted token using an authoritative public key. This effectively creates a two-factor authentication mechanism: the first is a biometric match, and the second is ownership of the token / object σ.

[0036] The encryption and padding process is described in detail below.

[0037] 1 Introduction

[0038] Our goal is to enable cardholders' mobile phones to store their biometric data / template r and securely allow untrusted payment terminals to determine whether their biometric measurements match template v. For various reasons, this must be done without displaying v to the terminal or revealing the measurement to the mobile phone. The communication channel is Bluetooth or Wi-Fi. The current protocol implementation achieves this in approximately 0.3 seconds, requiring 55MB of communication for each comparison, and 1MB for each subsequent comparison.

[0039] 1.1 Biological characteristics

[0040] The field of biometric authentication has been well explored in certain use cases. For facial and fingerprint biometrics, many of the most effective methods follow a similar framework built on machine learning and neural networks. Given a number of original biometric measurements (e.g., a face photograph or fingerprint scan), a neural network can be trained to "embed" new biometric measurements into a vector space. This allows for easy comparison of two embedding values ​​to determine if they come from the same source, i.e., people. Specifically, we will consider the "comparison" function as the embedding of a cosine similarity function. The function outputs a value in [-1, 1] that is similar to... The angle between two vectors in the set is proportional. That is, two embeddings are considered a match when they have a small angle between them. More precisely, for a threshold t∈(0,1], we assume that two embeddings are considered a match if the following condition is met. Matched:

[0041]

[0042]

[0043] Taken together, let's assume NeuralNet is a trained neural network with output embeddings. We can say that the two measurements m1 and m2 are matched if the following conditions are met:

[0044] t <CosineSim(NeuralNet(m1),NeuralNet(m2))

[0045] In the remainder of this article, we will These embeddings are called biometric templates.

[0046] 1.2 Settings

[0047] Broadly speaking, our goal is to allow users to authenticate terminals (such as Visa card terminals, ATMs) using their biometric data. From a purely functional perspective, we want the terminal to acquire user / customer measurements (e.g., photos) m*, and then learn whether there exists a pre-registered measurement muser matching that user, i.e., learn the user, so that...

[0048] t <CosineSim(NeuralNet(m * ),NeuralNet(m user ))

[0049] A simple solution to this problem is to maintain a meter containing measurements for each user. user A large database. When the terminal acquires the customer's measurement m *At that time, the terminal will m * It is sent to the central server, where a match m exists. user The calculation is performed in real time. One problem is that, due to the large number of users, all m... user With m * Comparisons can be expensive. Secondly, the threshold t must be very strict to ensure m... user It is unique. This could lead to a poor user experience due to the increased likelihood of rejecting valid customer measurements (photos). Finally, Visa does not want to maintain a database of user biometric data because of privacy concerns and the risk of data leakage during security breaches. For example, a rogue terminal could simply start querying the central server database to see if a random / possible template v exists, along with a matching user ID (if it exists).

[0050] 1.3 Homomorphic Encryption

[0051] Our solution relies on a technique called (additive) homomorphic encryption. Classical encryption allows entities to sample a random key k and then encrypt the data as c = Enc. k (m). We also use the symbol express Encryption is performed based on a given key. Homomorphic encryption extends this concept to allow encryption with... The entity "adds" ciphertext to obtain the ciphertext of the base value added together. That is,

[0052]

[0053] The ability to add two ciphertexts implies that the encryption scheme is additively homomorphic. The computation of m1 + m2 is performed as a modulo operation on some integer p. Instances of such schemes are called Paillier encryption. Additively homomorphic encryption also has the ability to change the ciphertext by repeatedly performing the addition. The property of multiplying by plaintext m2. That is,

[0054]

[0055] Some encryption methods are multiplicative homomorphic, meaning that ciphertext can be multiplied together. That is,

[0056]

[0057] For example, ElGamal encryption is multiplicative homomorphic. If a scheme is both additive and multiplicative homomorphic, it is called a fully homomorphic encryption scheme.

[0058] Unless otherwise stated, the protocol described herein only needs to be additive homomorphic. Therefore, fully homomorphic encryption schemes are also compatible with our protocol.

[0059] 2 Overview

[0060] This solution takes a different approach, allowing users to store their biometric data on their own phones. user The advantage of this method is that there are no single points of failure in the entire data collection process. Furthermore, storing biometric data only on the phone complies with existing FIDO standards. Intrusion into the central server or even the phone itself will not reveal the biometric data of all users.

[0061] Several entities are considered for consideration in this application. These include entities with their own mobile devices and pre-registered biometric measurements. user The user is running a banking application that will execute the following protocol. A central server will assist with authentication but will never store mere biometric data. Finally, the user will interact with a terminal. This terminal can communicate with both parties and trusts the server to be honest. Once set up, the terminal does not need to communicate with the server to authenticate the user. The terminal is equipped with a biometric reader (such as a fingerprint reader or camera).

[0062] The overall process of the agreement is as follows: Figure 1 As described in the documentation, during the registration phase, the user encrypts their biometric data and sends it to the server. The biometric data is then bound to the user's identity using an cryptographic method (e.g., a signature) to generate a payment / identity token. This token is returned to the user and is valid only for that user, and only for biometric payments made using this precisely encrypted template.

[0063] During the comparison phase, the terminal will establish a channel with nearby devices / users (e.g., via Bluetooth or Wi-Fi) and run a comparison protocol with each device / user. The terminal has one (or more) measurements and aims to identify which users have registered matching biometrics. Each user will do so by sending their token σ to the terminal. user and encrypted templates Let's begin.

[0064] When the terminal acquires measurement At that time, it first calculates the template v i =NeuralNer(m i ), and normalize it to v′ i =v i / ‖v i ‖2. Next, we obtain CosineSim(u,v) i )=∑ j u′ j v′ i,j Using additive homomorphic encryption, the terminal can transmit CosineSim(u,v) to... i The encryption calculation is as follows: This encryption can then be sent to the user for decryption. However, this will reveal the result to the user, not the terminal. This is done by having the terminal decrypt the result once with a random value r. i Mask the results To correct this, the user decrypts and sends xi back, allowing the terminal to compute CosineSim(u,v). i )=x i +r i .

[0065] Compared to the "standard" approach to solving this problem, this protocol offers several significant improvements. Firstly, this protocol is designed for fixed user templates and will be measured against the server. The comparison process has been optimized. Specifically, the user only sends l smaller results for computation. Large vectors This significantly improves the efficiency of the protocol in the intended use cases.

[0066] For example, when users walk into a store, their devices can send... To the terminal. This will include most of the communication between the device and the terminal, for example, 55KB. Due to It's a vector of approximately n = 512 elements, so the message is quite large. Subsequently, when the terminal acquires measurements... At that time, they can calculate the ratio A single element that is n times smaller And send it to the user device. This not only allows the terminal to be reused... This reduces overall communication and also reduces the need to send data before measurements are acquired. This results in latency. In practice using Paillier encryption, sending... Currently, approximately 55KB of communication is required, and and x i The combined total requires less than 1KB.

[0067] The second advantage of this method is that users only generate an encryption once during the registration phase. This is particularly concerning given Paillier's relatively low encryption efficiency, but high computational and decryption efficiency. For example, encrypting u′...

[0068]

[0069] Figure 1: Overview of the Bask protocol.

[0070] It might take several seconds, while the rest of the protocol takes much less than a second. Therefore, if the user has to perform a new encryption for u′ for each measurement, then the use of Paillier encryption could be very inefficient / power-intensive for the practicality of this application.

[0071] Compared to measuring With all registered measurements m user By comparing with a central database, one advantage of this approach is that the terminal can significantly narrow its search scope, searching only for measurements from nearby users. For example, there might be 20 nearby users, while the total number of users could be 100 million or more. This allows us to set a more lenient threshold t and reduce the probability of rejecting a pair of matching measurements.

[0072] 3 batch processing and Paillier encryption

[0073] We now introduce a new Paillier encryption optimization that reduces the communication overhead of the bask protocol by approximately 4 to 8 times. Paillier is a cryptographically plaintext-spaced encryption... The additive homomorphism is defined by p and q, where p and q are large prime numbers. The typical size of p and q is 1024 bits, meaning a Paillier ciphertext can contain 2048 bits of plaintext data. The security level would then be similar to RSA with a 2048-bit key. In biometric applications, we must define the vector u = (u1, ..., u...). n Encryption is performed on each u. The standard method for doing this is to encrypt each u. i Encrypt separately to obtain A ciphertext However, this is very wasteful, because each element u′ i Typically, a maximum of 32 bits can be used to represent this, while the ciphertext size is large enough to hold 2048 bits. Due to security restrictions, the size of Paillier ciphertext cannot be reduced.

[0074] 3.1 Encoding

[0075] For a long time, people have known a method called packing, which can encode multiple values ​​into ciphertext. The concept is to put multiple elements into a single ciphertext, with zeros padding between them. For example, u1, ... The packaging can be calculated as Where d is the number of padding bits between each element. Given two such packed values ​​u * v * Add them to get

[0076]

[0077] That is, add each element in an encoded format. Here, we use... One padding bit to ensure that if u i +v i Generate the carry bit, i.e., u i +v i If the value is ≥2m, then the carry will be stored in the fill bit. In this case, That's sufficient. More generally, this method works as long as no position needs to be represented by more than m′ = m + d bits.

[0078] When a single value With the encoded vector v * This encoding also comes into play during multiplication. Specifically,

[0079]

[0080] We reiterate our request Large enough to ensure xv i This can be represented as m′ = m + d. In this case, d = m is sufficient. However, multiplying two vectors by their components (Hadamard product) does not work in this format. For example, if n = 2, then...

[0081] v * u * =2 0m′ v1u1+2 1m′ (v1u2+v2u1)+2 2m′ v2u2

[0082] Despite the lack of expected 2 0m′ v1u1+2 m′ v2u2, but it can be observed that the values ​​of interest (v1u1, v2u2) are stored in the result, only v2u2 is located in a different position than the input. We call this the "level 2" position. It is easy to verify that for any

[0083] v * u * =v1u1+2 m′ (…)+2 2m′ (…)+…+2 (2n-2)m′ v n u n

[0084] v1u1 and u n u n It can be restored, but other items (...) will be handled by u. i and v j It consists of various intersections between them. Now we present a new encoding strategy that allows us to encode from different positions v * u* Restore all result items v i u i Assume n = 3, then u 1, …,u n Encoded as

[0085] u * =u1+2 m′ u2+2 3m′ u3

[0086] It should be noted that, 2 2m′ The position is set to zero. If these encodings are used, v * u * Multiply, then we get

[0087] v1u1+2 m′ (v1u2+v2u1)+2 2m′ v2u2+2 3m′ (v1u3+v32u1)+

[0088] 2 4m′ (v2u3+v3u2)+2 5m′ (0)+2 6m′ v3u3.

[0089] The "level 2" positions here are 0, 2, and 6, meaning each v... i u i The first bit starts at bit indices 0, 2m', and 6m'. Then the general concept is extended to any value of n. Specifically, given a suitable encoding for a vector with n-1 elements, it can be achieved by using 2... nim′ u n Add to the existing encoding to perform encoding of n elements, where n′ is the smallest integer, so that the previous element is not encoded at position n′, and the introduced new cross term does not conflict with the previous output position. For example, if n = 3, then n′ = 3 instead of 2 (the next available input position), because the output position of v2u2 would be obscured by the cross term (v1u3 + v3 + u1). Define the I index of these values ​​such that...

[0090] u * =∑ i 2 m′I[i] u i

[0091] It's encoding.

[0092] For this encoding strategy, we must also ensure that d is large enough so that the overflow of any cross term will not exceed m′ = m + d bits.

[0093] 3.2 Shading

[0094] One problem with encoding strategies is that if we reveal v to one side * u * Then they will learn the values ​​of {v1u1|i∈[n]} and all other positions. For example, when n=2, they will learn v * u * This would also reveal v1u2+v2u1, which is undesirable. This problem can be overcome by adding an extra random value to each position. When encoding the vector, we now make each slot the size of m′+λ bits, i.e.

[0095]

[0096] And when we decrypt / display v * u * At that time, we are now showing

[0097]

[0098] Conversely, r i yes The unified value in Index the positions using the intersection items we want to hide. To ensure that r is added i The term will not damage other positions; we require the intersection term and r. i The addition between them will not overflow the m′+λ bits at the stated position. Remember, we guarantee that m′ is large enough to accommodate the cross terms. Therefore, the overflow probability is r. i The probability that the first λ bits are all one. The probability of this happening is 2. -λ It can be reduced arbitrarily to make the overall error probability acceptable.

[0099] 3.3 Signed Value

[0100] It also supports signed values. This is achieved by using two's complement encoding of the value. Given an m-bit signed value, it is encoded into a two's complement 2m-bit number. 1 The requirement of this extension is to ensure that the first 2m bits of the product after multiplying two of these values ​​are correct. A security consequence of this approach is that we must extend the masking method described above to hide the first 2m bits of the 4m-bit product. If these bits are not masked, then when the product is displayed, the decrypted result can distinguish between two positive and two negative values, which will produce the same logical value: the product of negative numbers will have at least one 1 in the first 2m bits, while the other will not.

[0101] In any case, these first 2m positions can be masked through a simple extension of the masking techniques described above.

[0102] 3.4 Inner Product

[0103] So far, we have only discussed calculating component-wise multiplication. However, we need to calculate the inner product.

[0104] The ideal scenario at a higher level is as follows, where each ciphertext encodes 8 values:

[0105] 1. Each side calculates several codes.

[0106] (a)

[0107] (b)

[0108] 2. User encryption And send them to the terminal.

[0109] 3. Terminal computing And send it to the user.

[0110] 4. User decryption And calculate Where r* is a random value The encoding at "Level 2" is where m′ is the number of "unmasked" bits at each position. The user sends s* and...

[0111] 5. The terminal calculates x* = s* - B, decodes it into x1, ..., x8, and calculates...

[0112] Extreme care must be taken here to ensure that sufficient padding is placed between each value to prevent overflow. This can be done by calculating the maximum value at any given position.

[0113] As an optimization, if it is known prior that the inner product will not exceed a certain given value, then fewer padding bits may be needed. This is the case for cosine similarity, where the inner product can be at most 1 (multiplied by a scaling factor), and each product u i v i It can also be at most 1. This observation can be used to demonstrate that log₂n requires fewer padding bits. This is consistent with the only constraint that u i v i The case where the value is at most 1 provides a contrast, which means that the inner product can be as large as n.

[0114] Fully homomorphic encryption (FHE) can be used in a similar manner to Paillier encryption. In fact, it is more computationally efficient, but requires additional communication overhead. This additional overhead can be minimized through careful optimization. One advantage of FHE is that it can be used to provide stronger guarantees for users' encrypted templates. The format is correct. Further investigation is needed.

[0115] The technical effect of the current concept is that even if the matching process occurs on the terminal device that the user requested authentication on, the user's biometric template will only be owned by the user. This is a technical solution to a technical problem: protecting the integrity of personal biometric data from harm when used with external and unknown devices. Similarly, this process ensures that the terminal device capturing personal biometric data does not leak the data to other devices when attempting to discover the correct device to interact with.

[0116] Furthermore, the disclosed bit packing process overcomes the previous carry bit problem, significantly reducing the amount of data transmitted between devices and thus significantly improving speed.

[0117] The system and method disclosed herein are beneficial to both users and merchants. Biometric matching can occur and complete a transaction with minimal interaction with user 120, eliminating the need for the user to even remove his or her device 118a from their wallet or pocket. This simplifies interaction and reduces the inconvenience and threat associated with removing device 118a from a wallet or pocket. More importantly, biometric matching occurs without requiring terminal 102 or any other server to temporarily process the user's biometric template. The information is stored solely on the user's device 118a. Terminal 102 could collect biometric data directly from the user during a transaction, but the template would be of little value without a method to register the information. Typically, merchants do not wish to be liable for such user data in the event of a breach of contract and would systematically discard such information after a transaction.

[0118] For illustrative purposes only, the figures depict preferred embodiments. Those skilled in the art will readily recognize from the accompanying discussion that alternative embodiments of the structures and methods shown herein can be used without departing from the principles described herein.

[0119] Upon reading this disclosure, those skilled in the art will understand, through the principles disclosed herein, additional alternative structural and functional designs for the systems and methods described herein. Therefore, while specific embodiments and applications have been shown and described, it should be understood that the disclosed embodiments are not limited to the precise constructions and components disclosed herein. Various modifications, alterations, and variations may be made to the arrangement, operation, and details of the systems and methods disclosed herein without departing from the spirit and scope defined by any of the appended claims, as will be apparent to those skilled in the art.

Claims

1. A computer-implemented method for authenticating a user's account to a second device using a first device, the method comprising: Receive ciphertext and the public key from a public / private key pair from the first device, wherein the ciphertext is created by the following operation: The user's first biometric measurement is obtained using one or more sensors of the first device; The first biometric measurement is sent to a neural network to compute a first biometric value vector to be included in the user's first biometric template; Multiple packaged values ​​are added to the first biometric template to create a packaged biometric template; as well as The packaged biometric template is encrypted using homomorphic encryption to create the ciphertext; The user's second biometric measurement is obtained using one or more sensors of the second device; The cosine similarity function is used to calculate the encrypted similarity metric to compare the ciphertext with a second biometric template that includes the second biometric measurement; An encrypted code is calculated by adding a masking value to the encrypted similarity metric to create a masked similarity metric, and the masked similarity metric is encrypted using homomorphic encryption via the public key. The encrypted code is sent to the first device, wherein the first device uses the private key in the public / private key pair to decrypt the encrypted code and generate decrypted code; Receive the decryption code from the first device; The comparison metric is calculated by subtracting the masking value from the decrypted code; The comparison metric is compared with a threshold. as well as Access to the resource is provided when the comparison metric is less than the threshold.

2. The method according to claim 1, wherein the first biometric measurement is a facial image of the user.

3. The method according to claim 1, wherein the ciphertext is stored in the memory of the first device.

4. The method of claim 1, wherein the second biometric measurement is a facial image of the user.

5. The method according to claim 1, wherein the second biometric template comprises a second biometric value vector.

6. The method of claim 5, wherein preparing the second biometric template comprises: The user's second biometric measurement is sent to a neural network to calculate the second biometric value vector.

7. The method of claim 1, wherein the plurality of packaged values ​​comprises eight values.

8. The method of claim 1, wherein the ciphertext is transmitted to the second device via a communication network.

9. The method of claim 8, wherein the communication network is a Wi-Fi network or a Bluetooth-enabled network.

10. A computer-implemented method for authenticating a user to a second device using a first device, the method comprising: Receive ciphertext and the public key from a public / private key pair from a first device, wherein the ciphertext is created by encrypting a first biometric template using homomorphic encryption; The user's second biometric measurement is obtained using one or more sensors of the second device; The cosine similarity function is used to calculate the encrypted similarity metric to compare the ciphertext with a second biometric template that includes the second biometric measurement; The encryption code is calculated using the following steps: Multiply the encrypted similarity measure by the first masking value to create a first masked similarity measure; Add the second occlusion value to the first occlusion similarity measure to create a second occlusion similarity measure; as well as The second masked similarity measure is encrypted using homomorphic encryption via the public key; The encrypted code is sent to the first device, wherein the first device uses the private key in the public / private key pair to decrypt the encrypted code and generate decrypted code; Receive the decryption code from the first device; The comparison metric is calculated by subtracting the second masking value from the decryption code to create a result and dividing the result by the first masking value. The comparison metric is compared with a threshold. as well as Access to the resource is provided when the comparison metric is less than the threshold.

11. The method of claim 10, wherein the first biometric template comprises a first biometric value vector.

12. The method of claim 11, wherein a first biometric measurement of the user is obtained using one or more sensors of the first device to obtain the first biometric value vector, wherein the first biometric measurement of the user is sent to a neural network to compute the first biometric value vector.

13. The method of claim 12, wherein the first biometric measurement is a facial image of the user.

14. The method of claim 10, wherein the ciphertext is stored in the memory of the first device.

15. The method of claim 10, wherein the second biometric measurement is a facial image of the user.

16. The method of claim 10, wherein the second biometric template comprises a second biometric value vector.

17. The method of claim 10, wherein the ciphertext is transmitted to the second device via a communication network.

18. The method of claim 17, wherein the communication network is a Wi-Fi network or a Bluetooth-enabled network.

19. The method of claim 18, wherein the first masking value is a 2000-digit number.

Images