A two-factor authentication and key agreement method suitable for low-entropy biometrics

Abstract

The application provides a two-factor authentication and key agreement method suitable for low-entropy biometrics, in the registration stage, a user sends a password and a biometric feature to a server; the server selects two secret values, uses a secret sharing algorithm to divide the secret values into multiple sub-secrets respectively, generates a sub-secret derived element based on the user password and the sub-secret, and stores the sub-secret derived element in an authentication file together with a random element. In the authentication and key agreement stage, the user sends the password to the server after blinding, the server processes the blinded password and returns it to the user, so that the user generates a password-related element without revealing the password information; the user uses a newly collected biometric feature to execute an oblivious transfer protocol with the server, obtains a randomized sub-secret derived element without revealing the biometric feature information, and constructs a secret derived element; the user calculates a randomized secret element based on the secret derived element and the password-related element, and derives a session key shared with the server from the secret element.

Description

TECHNICAL FIELD

[0001] The present application belongs to the technical field of information security, and particularly relates to a two-factor authentication and key agreement method suitable for low-entropy biological features. BACKGROUND

[0002] The development of information technology enables users to conveniently access various services, such as online shopping, electronic payment and remote education. In order to achieve secure service access, it is essential to authenticate user identity and guarantee the confidentiality of communication content. The former ensures that the service provider only provides services for legitimate users, and the latter can protect sensitive or contain personal information of users. Authentication and key agreement protocol (AKE) is a cryptographic primitive that can simultaneously achieve user identity authentication and communication confidentiality guarantee. Users can authenticate their identity to the server through specific authentication factors, and negotiate a shared session key with the service provider to establish a secure channel. Authentication factors can be mainly divided into three categories: passwords, biometrics and hardware tokens. In actual use, each type of authentication factor has some shortcomings. For example, attackers can steal user passwords by observing the process of user inputting passwords; biometrics can be cloned and are difficult to revoke or replace; and hardware tokens will lead to unreliable authentication and key agreement if lost. Therefore, AKE based on a single authentication factor cannot provide sufficient security guarantee.

[0003] In order to enhance the security of AKE, the most commonly used method at present is to combine multiple authentication factors together. In the research on multi-factor AKE, biometrics are usually used as one of the authentication factors. Due to the uniqueness and privacy of biometrics, protection of biometric data is needed. However, it is not feasible to directly use traditional data protection techniques such as password hashing or encryption. Biometrics are inherently affected by environmental factors, which will result in two biometrics collected at different times not being exactly the same, so that biometrics cannot be matched in the form of hash or encryption. In order to solve this problem, most existing multi-factor AKE schemes use fuzzy extractors. This technology is constructed based on error-correcting codes, which can derive a constant random string from a noisy biometric for authentication and key agreement. Given a biometric w, the fuzzy extractor extracts a random string R and generates auxiliary data, which contains auxiliary information for error correction. For a newly extracted biometric w', as long as w' is close enough to w, R can be regenerated from the auxiliary data and w'. Therefore, the random string R can be processed like a password, such as hash storage and matching in the form of hash. In the above way, these multi-factor AKE schemes achieve fault tolerance and privacy protection of biometrics.

[0004] However, these fuzzy-extractor-based multi-factor AKE schemes all have a strong assumption that the entropy of the biometric is larger than the amount of errors to be tolerated (this assumption can also be interpreted as the rate of the entropy of the biometric is larger than the error rate, since the rate of the entropy of a biometric is equal to the entropy divided by the length of the biometric and the error rate is equal to the amount of errors divided by the length). More specifically, the helper information stored in the helper data will cause an entropy loss of the biometric. In order to achieve the reconstruction of the random string with errors, the entropy loss needs to be larger than the amount of errors. From this requirement and the fact that the entropy loss of a biometric cannot exceed its total entropy, the above assumption can be derived. This assumption makes these multi-factor AKE schemes unable to be deployed in the low-entropy-rate (i.e., the rate of the entropy is lower than the error rate) biometric scenarios. However, in the real world, low-entropy-rate biometrics are ubiquitous. Iris is the most typical low-entropy-rate biometric, which is estimated to have 249 bits of entropy out of 2048 bits, which is far lower than its amount of errors (about 400 bits).

[0005] To solve this problem, a feasible approach is to replace the fuzzy extractor with a technique that can achieve the matching of low-entropy-rate biometrics in a way that is both error-tolerant and privacy-preserving. Recently, Erwig et al. proposed a biometric-based AKE scheme named faPAKE in Fuzzy asymmetric password-authenticated key exchange, which satisfies the above conditions. In the enrollment phase, the server used by the service provider selects a unique secret value for each user's biometric. The secret value is divided into n sub-secrets by a secret sharing algorithm, where n represents the bit length of the biometric. Subsequently, the server stores these sub-secrets and n random numbers in the authentication file. The position of each sub-secret is determined by the corresponding bit of the biometric. In the authentication and key agreement, the user retrieves the sub-secrets (possibly with errors) using a newly captured biometric. This retrieval is accomplished by the user and the server executing an oblivious transfer protocol (OT), which enables the user to obtain the sub-secrets without revealing any information about the biometric. If the user obtains a sufficient number of sub-secrets, the secret value can be reconstructed. The reconstruction of the secret value means that the biometric is close enough to the biometric in the enrollment phase. faPAKE removes the restriction on the rate of the biometric's entropy, so it provides a feasible approach for designing multi-factor AKE suitable for low-entropy-rate biometrics. The present invention proposes a password and biometric-based two-factor authentication and key agreement method by using the matching technique for low-entropy-rate biometrics in faPAKE, which can effectively remove the restriction on the rate of the biometric's entropy in existing fuzzy-extractor-based multi-factor AKE schemes. This method provides a secure and convenient way for the user to authenticate his identity to the server and to agree on a shared session key. SUMMARY

[0006] The problem to be solved by the present application is how to remove the limitation of the existing multi-factor AKE scheme based on the fuzzy extractor on the entropy rate of biometric features, and construct a multi-factor AKE suitable for low-entropy-rate biometric feature scenes.

[0007] The technical method adopted by the present application to solve the above problems is a two-factor authentication and key agreement method suitable for low-entropy-rate biometric features, characterized by using a matching technology suitable for low-entropy-rate biometric features, specifically including the following steps:

[0008] Initialization phase: system initialization according to security parameters, determine the public parameters of the system.

[0009] Registration phase:

[0010] 1) The user selects a password and collects biometric features;

[0011] 2) The user sends the password and biometric features to the server;

[0012] 3) The server selects two secret values k and v, calculates the secret element K using k and the element P according to the user's biometric features;

[0013] 4) The server uses a secret sharing algorithm to divide the two secret values k and v into multiple sub-secrets respectively;

[0014] 5) The server calculates sub-secret derived elements based on the sub-secrets and the password, and stores them together with random elements, where the position of the sub-secret derived elements is determined by the user's biometric features;

[0015] 6) The server stores the sub-secret derived elements, random elements, element P, secret element K and secret value v in the authentication file File, and deletes other values.

[0016] Authentication and key agreement phase:

[0017] 1) The user inputs the password and collects biometric features;

[0018] 2) The user sends the blinded password to the server;

[0019] 3) The server retrieves the authentication file File, selects a random number to randomize the secret element, the sub-secret derived element and the random element, and uses the random number and the secret value v to process the received blinded password;

[0020] 4) The server encrypts the element P and the randomized sub-secret derived element and random element using the randomized secret element, and sends the ciphertext and the processed blinded password to the user;

[0021] 5) The user de-blinds the processed blinded password to obtain the password-related element without revealing the password information;

[0022] 6) The user uses the biometric feature to perform a secure oblivious transfer protocol with the server to obtain a randomized sub-secret derived element without revealing any biometric information;

[0023] 7) The server derives a session key from the randomized secret element;

[0024] 8) The user constructs a secret derived element based on the randomized sub-secret derived element;

[0025] 9) The user computes the randomized secret element using the secret derived element and the password-related element, decrypts the ciphertext sent by the server to obtain the element P and the randomized sub-secret derived element and the random element;

[0026] 10) The user verifies the correctness of the element P and the randomized sub-secret derived element and the random element, and if the verification is passed, derives a session key from the randomized secret element; otherwise, terminates the protocol.

[0027] The present application proposes a two-factor authentication and key agreement method suitable for low-entropy biometric features, which enables users to securely authenticate their identities using passwords and biometric features, and to agree on a shared session key with the server to establish a secure channel; the method is constructed based on a matching technology suitable for low-entropy biometric features, which not only realizes two-factor security, but also can be applied to iris and other low-entropy biometric feature scenarios; in addition, the method does not require users to carry hardware tokens and other devices dedicated to authentication, thereby reducing the burden of device management for users and providing a convenient authentication and key agreement method.

[0028] The present application has the following advantages:

[0029] 1) A two-factor authentication and key agreement method suitable for iris and other low-entropy biometric features is constructed based on passwords and biometric features;

[0030] 2) Users do not need to carry hardware tokens and other devices dedicated to authentication, and can safely and conveniently access services. DETAILED DESCRIPTION

[0031] (I) Initialization phase

[0032] Determine the system public parameter set according to the security parameters where q is a prime number, G is a cyclic group of order q, g is a generator of G, is a finite field, n is the bit length of the biometric feature, t is the threshold of the secret sharing algorithm, 0 < t ≤ n, r is a positive integer satisfying t ≤ r ≤ n, PRG is a pseudo-random number generator, H: {0,1} *→G is a collision-resistant hash function, OT is a secure stealth transmission protocol, and Enc / Dec is a secure symmetric encryption / decryption algorithm.

[0033] (II) Registration Stage

[0034] 1) User Choose the password pw and use the sensor to collect your own biometrics b;

[0035] 2) User Executing the Transport Layer Security (TLS) protocol sends the password pw and biometric data b to the server.

[0036] 3) Server Randomly select two secret values Calculate element P = g b and the secret element K=g k ;

[0037] 4) Server The two secret values ​​are divided into multiple sub-secrets using a secret-sharing algorithm: randomly selected... The polynomial of degree t-1 is f′(x) = v + a1x + ... + a t-1 x t-1 and g′(x)=k+d1x+…+d t-1 x t-1 , a1,…,a t-1 and d1,…,d t-1 The coefficients are the polynomials, and then the n polynomial values ​​k are calculated. i =f′(i) and v i =g′(i) are sub-secrets of the secret values ​​k and v respectively, where the polynomial independent variable i = 1, 2, ..., n;

[0038] 5) Server Based on sub-secret k i v i And password pw compute sub-secret derived element and random elements Where i = 1, 2, ..., n, b i The i-th bit of biometric characteristic b is represented by ⊕, where r represents the XOR operation. i for The random number selected from the list;

[0039] 6) Server File = ({(a 0,i ,a 1,i{ (a 0,i , a 1,i )|i∈[n]} are the sub-secret derived elements and random elements.

[0040] (Three) Authentication and Key Agreement Phase

[0041] 1) User inputs password pw′ and collects his own biometric feature b′ using a sensor;

[0042] 2) User selects random number k′ Blinds password pw′ to get blinded password B = H(pw′) r and sends it to server

[0043] 3) After receiving the blinded password B sent by user , server retrieves the corresponding authentication file File = ({{(a 0,i , a 1,i )|i∈[n]}, P, K, v) and deletes other values, where [n] represents the set {1, 2, …, n} Randomizes secret element K, sub-secret derived elements and random elements to get randomized secret element K′ = K k′ , randomized sub-secret derived elements and random elements Then uses random number k′ and secret value v to process blinded password B to get processed blinded password D = B vk′ ;

[0044] 4) Server uses randomized secret element K′ to encrypt A and P to get ciphertext C = Enc K′ (A, P), and then sends ciphertext C and processed blinded password D to user

[0045] 5) After receiving the message, user de-blinds D to get password related elements where r -1 is the inverse of r in ;

[0046] 6) Server and user perform n times oblivious transfer protocol OT, where is the sender of OT, is the receiver of OT, and the inputs are and {b′ i|i∈[n]}, where b′ i This represents the i-th bit of biometric characteristic b′; after the protocol ends, Obtain the randomized sub-secret derived element

[0047] 7) Server The session key is derived from the randomized secret element K′.

[0048] 8) Let E be the set of indices of the positions where the biometric b′ in the authentication and key negotiation phase and the biometric b in the registration phase are different. Then, the randomized sub-secret derived elements... Represented as Where h is the hash value of password pw, i.e., h = H(pw), and i ∈ [n]\E means that i belongs to set [n] but not set E; for the randomized sub-secret derived elements user First, randomly select a subset. in, The i-th secret value k t Size secret, For the i-th secret value v t The secret is to construct a polynomial. in T = {i1,i2,...,i t} is a subset of [n], where j and η are intermediate variables; if there are more than or equal to r equations If this holds true, and i = 1, 2, ..., n, then the user... Calculate secret derived elements otherwise Reselect the subset and perform step 8);

[0049] 9) User Calculate the secret element after randomization Then use Decrypting ciphertext C yields plaintext.

[0050] 10) Users Will Parsed as Then verify whether (1) is true or false. Where i = 1, 2, ..., n; (2) Does there exist a bit string of length n? satisfy and in express Hamming distance between b' ; if the verification passes, the user by the randomized secret element computing the session key the session key agreement is completed; otherwise, the protocol is terminated.

Claims

1. A two-factor authentication and key agreement method suitable for low-entropy biometric features, characterized in that, Specifically comprising the following steps: Initialization step: system initialization according to security parameters, determine the public parameters of the system; Registration phase: 1) the user selects a password and collects a biometric feature; 2) the user sends the password and the biometric feature to the server; 3) the server selects two secret values k and v, calculates the secret element K using k and calculates the element P according to the user's biometric feature; 4) the server uses a secret sharing algorithm to divide the two secret values k and v into multiple sub-secrets respectively; 5) the server calculates a sub-secret derived element based on the sub-secret and the password, and stores it together with a random element, wherein the position of the sub-secret derived element is determined by the user's biometric feature; 6) the server stores the sub-secret derived element, the random element, the element P, the secret element K and the secret value v in the authentication file File, and deletes other values; Authentication and key agreement phase: 1) the user inputs a password and collects a biometric feature; 2) the user sends the password to the server after blinding; 3) the server retrieves the authentication file File, selects a random number to randomize the secret element, the sub-secret derived element and the random element, and processes the received blinded password using the random number and the secret value v; 4) the server encrypts the element P using the randomized secret element, and sends the ciphertext and the processed blinded password to the user; 5) the user de-blinds the processed blinded password to obtain the password-related element without revealing the password information; 6) the user performs a secure oblivious transfer protocol with the server using the biometric feature to obtain the randomized sub-secret derived element without revealing any biometric feature information; 7) the server derives a session key from the randomized secret element; 8) the user constructs a secret derived element based on the randomized sub-secret derived element; 9) the user calculates the randomized secret element using the secret derived element and the password-related element, and decrypts the ciphertext sent by the server to obtain the element P and the randomized sub-secret derived element and the random element; 10) the user verifies the correctness of the element P and the randomized sub-secret derived element and the random element, if the verification is passed, a session key is derived from the randomized secret element; otherwise, the protocol is terminated. The initialization phase is specifically: The specific steps of the registration phase are:

2. The method of claim 1, wherein, Where the polynomial independent variable i = 1, 2, …, n; Determining system common parameter set according to security parameter where q is a prime number, G is a cyclic group of order q, g is a generator of G, is a finite field, n is the bit length of the biometric, t is the threshold of the secret sharing algorithm, 0 < t ≤ n, r is a positive integer satisfying t ≤ r ≤ n, PRG is a pseudo-random number generator, H: {0,1} * → G is a collision-resistant hash function, OT is a secure oblivious transfer protocol, Enc / Dec is a secure symmetric encryption / decryption algorithm.

3. The method of claim 2, wherein, The specific steps of the authentication and key agreement phase are: 1) user selects a password pw and uses a sensor to collect his own biometric feature b; 2) user Performing a secure transport layer protocol, TLS, sends the password pw and the biometric b to the server 3) server Randomly select two secret values Compute element P = g b and secret element K = g k ; 4) server The two secret values are each divided into multiple sub-secrets using a secret sharing algorithm: randomly select An upper t-1 degree polynomial f'(x) = v + a1x +... + a t-1 x t-1 And g'(x) = k + d1x +... + d t-1 x t-1 , a1,..., a t-1 And d1,..., d t-1 Are polynomial coefficients, then calculate n polynomial values k i = f'(i) and v i = g'(i) as sub-secrets of secret values k and v, respectively, ​ 5) server based on a sub-secret k i , v i and a password pw to compute a sub-secret derived element and a random element where i = 1, 2,..., n, b i denotes the i-th bit of the biometric b, denotes the XOR operation, r i is a random number chosen in . 6) server Store the authentication file File = ({(a 0,i ,a 1,i )|i∈[n]}, P, K, v) and delete other values, where [n] denotes the set {1, 2, …, n}, {(a 0,i ,a 1,i )|i∈[n]} are the sub-secret derived elements and random elements.

4. The method of claim 3, wherein, ​ 1) user Enter password pw' and use sensor to collect own biometric b' 2) user selecting a random number blind the password pw' to get a blinded password B = H(pw') r and send it to the server 3) Received from user After sending the blind password B, the server Retrieve the corresponding authentication file File = ({(a 0,i ,a 1,i (i∈[n]},P,K,v), select random numbers Randomizing the secret element K, the sub-secret derived element, and the random element yields the randomized secret element K′=K. k′ Randomized sub-secret derived elements and random elements Then, using the random number k′ and the secret value v, the blinded password B is processed to obtain the processed blinded password D = B. vk′ ; 4) server A and P using the randomized secret element K' to obtain ciphertext C = Enc K′ (A, P), and then sends the ciphertext C and the processed blinded password D to the user 5) Upon receipt of the message, the user D is de-blinded to obtain the password-dependent element where r -1 is the inverse of r in ; 6) server and the user performing n times an oblivious transfer protocol OT, wherein is the sender of the OT, is the receiver of the OT, inputs are and {b′ i | i ∈ [n]}, wherein b′ i denotes the i-th bit of the biometric b′; after the protocol, obtaining the randomized sub-secret derived element 7) server Deriving a session key from the randomized secret element K' 8) Let E be the set of indices of the positions of the bits of the biometric b' in the authentication and key agreement phase that are not identical to the bits of the biometric b in the enrollment phase, then the randomized sub-secret derived element is denoted as where h is the hash value of the password pw, i.e. h = H(pw), i ∈ [n] \ E means that i belongs to the set [n] but not to the set E; for the randomized sub-secret derived element User First, a subset of n' elements is randomly selected where, is the i t th sub-secret of the secret value k, and is the i t th sub-secret of the secret value v, then the polynomial is constructed, where the polynomial parameter The set T = {i1, i2,..., i t} is a subset of [n], j and η are intermediate variables; if more than or equal to r equations hold, i = 1, 2,..., n, then the user Computing the secret derived element Else Re-select the subset and perform step 8); 9) user computing the randomized secret element then using decrypting the ciphertext C to obtain the plaintext 10) user will be parsed into Then verify (1) whether where i = 1, 2,..., n; (2) whether there exists a bit string of length n satisfies and wherein denotes the Hamming distance between b' and b; if the verification passes, the user by the randomized secret element computes the session key the session key agreement is completed; otherwise the protocol is terminated.

Images