Methods and systems for secure authentication and / or identification of users

Abstract

Computer method of authenticating or identifying users. A data set is received from a user, feature extraction is performed to obtain a feature vector. An integer vector representation is generated of the feature vector. The integer vector representation and a master key are used to generate a user-specific key. The user-specific key together with a user ID are sent to a remote server. In other embodiments a claimed user ID is authenticated as belonging to a user by processing an encrypted vector using a user-specific key to obtain an output value. Alternatively, a plurality of ciphertexts are generated, each of which has a label indicating a respective user. User-specific keys are generated for each user. A determination is made about whether a user indicated by a label accompanying a first group of ciphertexts is the user operating a client device. Alternatively, encrypted vectors are processed using a respective one of the user-specific keys, if an output value is less than a predetermined threshold a user is authenticated at a server. Optionally, the first data set includes biometric data such as facial biometrics.

Description

FIELD Embodiments described herein relate to methods and systems for secure authentication and / or identification of users. BACKGROUND The ability to successfully identify and / or authenticate users is a crucial requirement in enabling online transactions to be carried out in a secure manner. One way of achieving this is to utilise a trusted server for securely storing enrolled biometric readings (templates) from users and computing distances between the enrolled biometric readings and biometric readings that are freshly produced / submitted during the authentication I identification process. If the computed distance is less than or equal to an acceptance threshold T, then the user is considered to be successfully authenticated and / or identified. The use of a trusted server nevertheless imposes a heavy cost, both in terms of the real estate needed to house the server, and in ensuring the server is physically secure and well-maintained. Being able to host biometric-based services on the cloud offers a more attractive alternative, as it reduces the need to purchase servers, land etc. and instead enables a more lightweight, subscription-based service to be adopted instead. The biometric matching approach used in the conventional model, however, requires that the server first decrypt user biometrics before distances are computed between them. Such an approach is not acceptable from a security perspective for cloud-based servers, since cloud-based servers are considered to be at greater risk of being compromised. The compromise of data during computation (i.e. whilst it is unencrypted) could lead to leakage of user biometrics, i.e. highly sensitive information. Moreover, cloud-based servers may try to read and use the data in an unauthorised manner. It is desirable, therefore, to provide a means for supporting computation of distances between user biometrics in a privacy preserving manner, so as to support cloud hosted biometric authentication and / or identification services. SUMMARY According to a first aspect of the present invention, there is provided a computer-implemented method comprising: receiving, at a first point in time, a first data set from a user; upon receipt of the first data set: performing feature extraction on the first data set to obtain a first feature vector; generating a first integer vector representation of the first feature vector; generating, using the first integer vector representation and a master key, a user-specific key; and sending, to a remote server, a user ID together with the user-specific key. The first data set may comprise biometric data. Generating the integer vector representation of the first feature vector may comprise: computing the norm of the first feature vector; dividing each value in the first feature vector by the norm; and rounding or scaling the values of the first feature vector into integer values. The method may further comprise: receiving, at a later point in time, a second data set; upon receipt of the second data set: performing feature extraction on the second data set to obtain a second feature vector; generating a second integer vector representation of the second feature vector; generating an encrypted version of the second integer vector representation using the master key; and sending, to the remote server, the encrypted version of the second integer vector representation. The method may further comprise: sending, to the remote server, the user ID together with the encrypted version of the second integer vector representation. The second data set may comprise biometric data. Generating the second integer vector representation of the second feature vector may comprise: computing the norm of the second feature vector; dividing each value in the second feature vector by the norm; and rounding or scaling the values of the second feature vector into integer values. According to a second aspect of the present invention, there is provided a computer-implemented method comprising: receiving, at a server, from a user, a user-specific key and a user ID, the userspecific key being generated using (i) an integer vector representation of a first feature vector and (ii) a master key; receiving, at the server, from the user, an encrypted vector and a claimed user ID, wherein the vector is encrypted using the master key; processing, by the server, the encrypted vector using the user-specific key to obtain an output value; determining, by the server, whether the output value is equal to or less than a predetermined threshold; and in the event the output value is less than or equal to the threshold, authenticating the claimed user ID as being the same as the user ID. According to a third aspect of the present invention, there is provided a computer-implemented method comprising: (i) receiving, at a server, from a client device, a plurality of ciphertexts, wherein each ciphertext is generated by encrypting the same vector using a different respective master secret key, each ciphertext being accompanied by a label indicating a respective user; (ii) retrieving from storage, by the server, a user-specific key corresponding to the user indicated by the label accompanying a first one of the ciphertexts; (iii) processing, by the server, the first one of the ciphertexts using the userspecific key to obtain an output value; (iv) in the event the output value is less than or equal to a predetermined threshold, determining that the user indicated by the label accompanying the first ciphertext is a user operating the client device; (v) in the event the output value is greater than the threshold, retrieving a second user-specific key corresponding to the user indicated by the label accompanying a second one of the ciphertexts and processing, by the server, the second one of the ciphertexts using the second user-specific key to obtain a second output value; and (vi) in the event the second output value is less than the threshold, determining that the user indicated by the label accompanying the second ciphertext is the user operating the client device. In the event the second output value is greater than the threshold, the method may comprise repeating steps (ii) and (iii) for further ciphertexts and their corresponding user-specific key, until the output value obtained is less than the threshold or else a predetermined number of user-specific keys have been retrieved. Each dataset may comprise an image of a user’s face. According to a fourth aspect of the present invention, there is provided a computer-implemented method comprising: receiving, at a first point in time, a first data set from a user; performing feature extraction on the first data set to obtain a first feature vector; generating a binary vector representation A of the first feature vector; receiving a mask for the first data set; generating a binary vector representation MaskA of the mask for the first data set; generating, using the first binary vector representation MaskA and a first master secret key msk a user-specific key; applying the binary vector representation MaskA of the mask to the binary vector representation A of the first feature vector to obtain a masked template vector ^MASKED . generating a second user-specific key using the masked template vector ^masked anc| a seconc| master secret key; generating an inverse vector ANOT of the binary vector representation MaskA, generating a third user-specific key using the inverse vector AN0T and a third master secret key; generating a hamming vector ahamminc by replacing all zero entries in the masked template vector amasked with -1; generating a fourth user-specific key using the hamming vector ahamm,ng and a fourth master secret key; and sending, to a remote server, a user ID together with the first user-specific key, the second user-specific key, the third user-specific key and the fourth user-specific key. The method may further comprise: receiving, at a later point in time, a second data set from the user; performing feature extraction on the second data set to obtain a second feature vector; generating a binary vector representation B of the second feature vector; receiving a mask for the second data set; generating a binary vector representation Masks of the mask for the second data set; encrypting the binary vector representation Masks with the first master secret key; applying the binary vector representation Masks to the binary vector representation B of the second feature vector to obtain a second masked template vector bmasked ; encrypting the second masked template vector bmasked with the second master secret key; obtaining an inverse vector BN0T of the second binary vector representation Masks', encrypting the inverse vector BNOT with the third master secret key; obtaining a hamming vector bhamming by replacing all zero entries in the masked template vector bmasked with -1; encrypting the hamming vector bhamm,ng with the fourth master secret key; and sending, to the remote server, the encrypted binary vector representation Masks of the mask for the second data set, the encrypted masked template vector ^masked , encrypted inverse vector BNOT and the encrypted hamming vector ^HAMMING The method may further comprise: sending, to the remote server, the user ID together with the encrypted second binary vector representation Masks of the mask for the second data set, the encrypted masked template vector bmasked, the encrypted inverse vector BN0T and the encrypted hamming vector bhamm,ng. The method may further comprise: applying one or more shifts to the binary vector representation Masks and / or the binary vector representation B of the second feature vector, wherein each shift represents a shift in relative alignment of the second data set and the mask for the second data set; for each shift, generating a new version of each of the encrypted binary vector representation Masks of the mask for the second data set, the encrypted masked template vector bmasked, the encrypted inverse vector BN0T and the encrypted hamming vector bhamming-, and sending the new version of each of the encrypted binary vector representation Masks of the mask for the second data set, the encrypted masked template vector ^masked , encrypted inverse vector BNOT and the encrypted hamming vector ^hamming t0 remote server. According to a fifth aspect of the present invention, there is provided a computer-implemented method comprising: (i) receiving, at a server, from a client enrolment device used to enrol a user with the server, a user ID, a first user-specific key, a second user-specific key, a third user-specific key and a fourth user-specific key; the first user-specific key being generated at the client enrolment device using a binary vector representation MaskA of a first mask and a first master secret key, the second user-specific key being generated at the client enrolment device using a second master secret key and a masked template vector amasked obtained by applying the binary vector representation MaskA to a binary vector representation of a first data set A; the third user-specific key being generated at the client enrolment device using a third master secret key and an inverse vector AN0T of the binary vector representation MaskA, the fourth user-specific key being generated at the client enrolment device using a fourth master secret key and a hamming vector ahamming obtained by replacing all zero entries in the masked template vector amasked with -1; (ii) receiving, at the server, from a client authentication device used in authenticating the user with the server, a first encrypted vector, a second encrypted vector, a third encrypted vector, and a fourth encrypted vector, the first encrypted vector being generated at the client authentication device by encrypting a binary vector representation Masks of a second mask using the first master secret key; the second encrypted vector being generated at the client authentication device by encrypting a masked template vector bmasked using the second master secret key, the masked template vector bmasked being obtained by applying the binary vector representation Masks of the second mask to a binary vector representation of a second data set 8; the third encrypted vector being generated at the client authentication device by encrypting an inverse vector BN0T of the binary vector representation Masks using the third master secret key; the fourth encrypted vector being generated at the client authentication device by encrypting a hamming vector bhamming using the fourth master secret key, the hamming vector bhamm,ng obtained by replacing all zero entries in the masked template vector bmasked with -1; processing each encrypted vector using a respective one of the user-specific keys to return a respective inner product; calculating the value of a distance metric between the first data set when masked by the first mask and the second data set when masked by the second mask as a function of the inner products; and determining, whether the output value is equal to or less than a predetermined threshold; and in the event the output value is less than or equal to the threshold, authenticating the user by the server. The method may further comprise: receiving, at the server, from the client authentication device, a plurality of sets of encrypted vectors, each set of encrypted vectors comprising a first encrypted vector, a second encrypted vector, a third encrypted vector and a fourth encrypted vector, wherein for each set of encrypted vectors: the first encrypted vector in the set is generated at the client authentication device by applying a respective shift to the binary vector representation of the Masks of the second mask to obtain a shifted binary vector representation of the Masks, and encrypting the shifted binary vector representation of the Masks using the first master secret key; the second encrypted vector is generated at the client authentication device by applying the respective shift to the binary vector representation of the second data set B to obtain a shifted binary vector representation of the second data set, applying the shifted binary vector representation of the Masks to the shifted binary vector representation of the second data set to obtain a masked template vector bmasked for the respective shift, and encrypting the masked template vector bmasked using the second master secret key; the third encrypted vector is generated at the client authentication device by encrypting an inverse vector BN0T of the shifted binary vector representation MaskB using the third master secret key; and the fourth encrypted vector is generated at the client authentication device by replacing all zero entries in the masked template vector bmasked for the respective shift with -1 to obtain a hamming vector bhamming and encrypting the hamming vector ^hamming usjng the fourth master secret key; the method further comprising, for one or more of the sets of encrypted vectors: processing each encrypted vector within the set using a respective one of the user-specific keys to return a respective inner product; calculating the value of a distance metric between the first data set when masked by the first mask and the second data set when masked by the second mask as a function of the inner products; and determining, whether the output value is equal to or less than a predetermined threshold; and in the event the output value is less than or equal to the threshold for one of the sets of encrypted vectors, authenticating the user by the server. According to a sixth aspect of the present invention, there is provided a computer-implemented method comprising: (i) receiving and storing, at a server, for each one of a plurality of users, a first user-specific key, a second user-specific key, a third user-specific key and a fourth user-specific key; wherein for each user: the first user-specific key is generated using a binary vector representation MaskA of a first mask and a first master secret key of the user; the second user-specific key is generated using a second master secret key of the user and a masked template vector amasked obtained by applying the binary vector representation MaskA to a binary vector representation of a first data set A, the third user-specific key is generated using a third master secret key of the user and an inverse vector ANOT of the binary vector representation MaskA, and the fourth user-specific key is generated using a fourth master secret key of the user and a hamming vector ahamm,ng obtained by replacing all zero entries in the masked template vector amasked with -1; (ii) receiving, by the server, from a client device, for each one of the users, a group of ciphertexts, each group being accompanied by a label indicating the respective user, each group of ciphertexts comprising: a first ciphertext generated by encrypting a binary vector representation Maska of a mask using the first master secret key of the respective user; a second ciphertext generated by encrypting a masked template vector bmasked USjng the second master secret key of the respective user, the masked template vector bmasked being obtained by applying the binary vector representation Maska of the first mask to a binary vector representation of a data set 8; a third ciphertext generated by encrypting an inverse vector BN0T of the binary vector representation Maska using the third master secret key of the respective user; and a fourth ciphertext generated by encrypting a hamming vector bhammingusing the fourth master secret key of the respective user, the hamming vector bhamm,nc obtained by replacing all zero entries in the masked template vector bmasked with -1; (iii) selecting a first one of the groups of ciphertexts; (iv) retrieving the user-specific keys for the user indicated by the label accompanying the first group of ciphertexts; (v) processing each ciphertext in first group of ciphertexts using a respective one of the retrieved user-specific keys to return a respective inner product; (vi) calculating the value of a distance metric as a function of the inner products; and (vii) determining, whether the output value is equal to or less than a predetermined threshold; (viii) in the event the output value is less than or equal to the threshold, determining that the user indicated by the label accompanying the first group of ciphertexts is the user operating the client device. In the event the output value is greater than the predetermined threshold, the method may comprise repeating steps (iii) to (viii) for one or more groups of ciphertexts, until the output value obtained is less than the threshold or else a predetermined number of groups of ciphertexts have been selected. The method may further comprise: (ii) receiving, by the server, from a client device, for each one of the users, a plurality of groups of ciphertexts, each plurality of groups being accompanied by the label indicating the respective user, each group of ciphertexts in each of the plurality of groups comprising a first ciphertext, a second ciphertext, a third ciphertext, and a fourth ciphertext; wherein for each group of ciphertexts in the plurality of groups received from a user: the first ciphertext in the respective group is generated by applying a respective shift to the binary vector representation of the Masks of the second mask to obtain a shifted binary vector representation of the Masks, and encrypting the shifted binary vector representation of the Masks using the first master secret key of the respective user; the second ciphertext is generated by applying the respective shift to the binary vector representation of the second data set B to obtain a shifted binary vector representation of the second data set, applying the shifted binary vector representation of the Masks to the shifted binary vector representation of the second data set to obtain a masked template vector bmasked for the respective shift, and encrypting the masked template vector bmasked using the second master secret key of the respective user; the third ciphertext is generated by encrypting an inverse vector BN0T of the shifted binary vector representation Masks using the third master secret key of the respective user; and the fourth encrypted vector is generated by replacing all zero entries in the masked template vector bmasked for the respective shift with -1 to obtain a hamming vector bhamming and encrypting the hamming vector bhamming using the fourth master secret key; the method comprising: (iii) selecting, from a first one of the plurality of groups of ciphertexts, a first one of the groups of ciphertexts; (iv) retrieving the user-specific keys for the user indicated by the label accompanying the first one of the plurality of groups of ciphertexts; (v) processing each ciphertext in first group of ciphertexts using a respective one of the retrieved user-specific keys to return a respective inner product; (vi) calculating the value of a distance metric as a function of the inner products; and (vii) determining, whether the output value is equal to or less than a predetermined threshold; (viii) in the event the output value is less than or equal to the threshold, determining that the user indicated by the label accompanying the first one of the plurality of groups of ciphertexts is the user operating the client device. In the event the output value is greater than the predetermined threshold, the method may comprise repeating steps (iii) to (viii) for one or more other groups of ciphertexts in the first one of the plurality of groups of ciphertexts. In the event the output value is greater than the predetermined threshold for each of the one or more other groups of ciphertexts in the first one of the plurality of groups of ciphertexts, the method may comprise: selecting, from a second one of the plurality of groups of ciphertexts, a first one of the groups of ciphertexts; and repeating steps (iii) to (viii) for one or more groups of ciphertexts in the second one of the plurality of groups of ciphertexts. Each user-specific key may be generated as a function of its respective master secret key. The user specific key sk may be generated by computing sk = u + Tx', where: x' is the first integer vector representation of the first feature vector; u is a vector of length n + k with elements sampled uniformly at random from Zq, where n and q are predefined values and k is the length of the first feature vector; and T is a matrix where Ik is the identity matrix of size k x k and S is an n x k matrix of random integer values. The first master secret key may comprise a tuple (ui, S); The second master secret key may comprise a tuple (m, 5); The third master secret key may comprise a tuple (113, Sy and The fourth master secret key may comprise a tuple (1¼ S); wherein: ui is a first vector of length n + k with elements sampled uniformly at random from Zq; U2 is a second vector of length n + k with elements sampled uniformly at random from Zq-, us is a third vector of length n + k with elements sampled uniformly at random from Zq, U4 is a fourth vector of length n + k with elements sampled uniformly at random from Zq; S is an n x k matrix of random integer values, Zq, where n and q are predefined values and k is the length of the first feature vector. The first user-specific key may be generated by computing sk} =^ + 7%) The second user-specific key sk2 may be generated by computing sk2 = u2 + Tx2'\ The third user-specific key sk3 may be generated by computing sk3 = u3 + Tx3'; The fourth user-specific key sk4 may be generated by computing sk^ = u4 + Tx4'; where: x3' is the binary vector representation MaskA of the first mask; x2' is the masked template vector amasked; x3' is the inverse vector AN0T', x^ is the hamming vector ahamming ; T is a matrix [^], where lk is the identity matrix of size kxk. Each master secret key may be derived in part from a combination of the same root key and a respective unique label using a Key Derivation Function. Each data set may comprise an image captured by a camera of a client device. Each image may be an image of a user’s eye. The mask applied to the respective image may be such as to isolate the user’s iris in the image. According to a seventh aspect of the present invention, there is provided a computer-readable storage medium comprising computer executable instructions that when executed by a computer will cause the computer to carry out a method according to any one of the first, second, third, fourth, fifth and sixth aspects of the invention. According to an eight aspect of the present invention, there is provided a computer system configured to carry out a method according to any one of the first, second, third, fourth, fifth and sixth aspects of the invention. BRIEF DESCRIPTION OF DRAWINGS Embodiments of the invention will now be described by way of example with reference to the accompanying drawings in which: Figure 1 shows an example system according to an embodiment, comprising a client device and cloud-based server; Figure 2 shows a flow-chart of steps carried out by the client device as part of an enrolment process; Figure 3 shows steps carried out by an enrolled user when seeking to authenticate themselves to the cloud-based server; Figure 4 shows a sequence of steps as carried out by the cloud-based server in order to authenticate the user of the client device; Figure 5 shows a sequence of steps as carried out by the client device in order for the cloud-based server to identify the user from among a plurality of users to have previously enrolled with the server; Figure 6 shows a sequence of steps as carried out by the cloud-based server in order to identify the user of the client device; Figure 7 shows an image of a user’s eye, together with a mask for capturing a biometric image of the user’s iris; Figure 8 shows a flow-chart of steps carried out by a client device as part of an enrolment process; Figure 9 shows a flow-chart of steps carried out by the cloud-based server as part of an enrolment process; Figure 10 shows steps carried out by an enrolled user when seeking to authenticate themselves to the cloud-based server; Figure 11 shows an example of how the relative alignment between the user’s eye and the image mask as shown in Figure 7 may shift for different image acquisitions; Figure 12 shows a sequence of steps as carried out by the server device in order for the cloud-based server to authenticate a user from among a plurality of users to have previously enrolled with the server; Figure 13 shows steps carried out by an enrolled user when seeking to identify themselves to the cloud-based server; and Figure 14 shows a sequence of steps as carried out by the cloud-based server in order to identify the user of the client device. DETAILED DESCRIPTION Embodiments described herein enable a matching distance between two sets of biometric data to be captured in a privacy preserving manner and are well suited to support cloud-based authentication and identification solutions. Embodiments described herein are based on so called ‘functional inner product encryption’, an example of which is the lattice based functional inner product encryption (IPE) scheme described in “Cheon J. et al., “Lattice-Based Secure Biometric Authentication for Hamming Distance”, in proceedings of ACISP 2021, J. Baek and S. Ruj (Eds.), LNCS 13083, pp. 653-672, 2021” (referred to in the following as “Cheon, J. et al.”). Such schemes allow the inner product of two vectors to be calculated in a privacy preserving way. More specifically, one of the vectors is turned into a “userspecific key”. The user-specific key has the property that even if an adversary can read it, they would be unable to obtain any information about the vector from which it was generated. The second vector is simply encrypted, so as to provide its confidentiality protection. The functional inner product encryption scheme is able to take the userspecific key and the encrypted vector, and obtain from these the inner product of the two underlying vectors. It is important to note that this computation does not require decryption of the underlying vectors; a computer may perform this computation without any ability to decrypt the underlying vectors, or indeed obtain any information about them besides the inner product. A first embodiment in which the approach proposed in Cheon, J. et al is adapted for use in an authentication protocol will now be described with reference to Figures 1 to 6. The present embodiment is applicable to authentication protocols that rely on biometrics such as facial biometrics, where the biometrics can be represented as floating point vectors and the differences between the biometrics calculated as the cosine distance between those vectors. Figure 1 shows an example system for implementing the protocol according to the first embodiment. The system comprises a client device 101 and a cloud-based server 103 that are in communication with one another over a network. The server 103 may be used to authenticate or identify a user of the client device 101. Having authenticated and / or identified the user, the server may facilitate access to one or more services for the user, either by providing those services directly itself, or providing confirmation to other devices or servers of the user’s authentication I identity. In order to perform user authentication or identification, the user of the client device must first enrol with the server. Figure 2 shows a flow-chart of steps carried out by the client device in order to complete the enrolment. Beginning in step S201, the client device receives, from the user, a template data set. The template data set will serve as a reference data set for use in authenticating I identifying the user at a later point in time. The template data set may comprise a set of biometric data specific to the user. For example, the template data set may comprise an image of part of the user’s body, such as their face or fingerprint, or a recording of the user’s voice. In step S203, the client device performs feature extraction on the template data set. Feature extraction may be carried out using one of a number of known techniques in the art. For example, one or more trained machine learning algorithms may be used to obtain an embedding of the template data set that is unique to the template data set and which provides a lower-dimensional representation of that data. The embedding may define a reduced set of features that is able to summarize information of interest in the template data whilst removing other irrelevant data. Having performed feature extraction, the client device now outputs a vector x of floating point values that represent the extracted features. The client device then performs the following steps: (i) computes the norm (magnitude) ||x|| of the feature vector x; (ii) divides each value in the vector x by the norm | |x| |; and (iii) scales or rounds each value in the vector to an integer value. The vector of floating point values is next presented as a vector of integers x' (step S205). In step S207, the client device generates a master secret key msk and stores the key securely on the device. The master secret key msk may be stored in association with a user ID for the user in question. The master secret key must be unique and distinguished from any key previously used for a particular set of scheme parameters. The master secret key consists of two variables: (i) A vector u of length n + k with elements sampled uniformly at random from Zq (ii) An (n + k) x k matrix T = where Ik is the identity matrix of dimension k x k and S is an n x k matrix with values sampled randomly from Zq using the Discrete Gaussian distribution with width parameter a. Here, the values n and q are underlying parameters of the encryption scheme and can be selected based on the required security level of the scheme; k is the length of vectors x and y (more specifically, the number of elements in each vector x and y) and is a pre-defined parameter from the biometric scheme (the number of features captured from each user’s face). Zq is understood to mean integer values mod q\ for the present scheme, this means integers x in the range -q / 2 <x <=q / 2. It will be appreciated that arithmetic is carried out by adding / multiplying the integers and then taking the remainder after dividing by q. Next, in step S209, the client device generates a user-specific key using the master secret key msk and the vector x’. The user-specific key sk is found by computing sk = u + Tx', where T is the matrix [^] from the master secret key. The user-specific key sk will be a vector of length m with integer values mod q, where m = n + k. . In step S211, the client device forwards the user-specific key and user ID to the cloudbased server. The user ID serves to associate the key with the particular user, and may comprise the user’s name, email address or phone number, for example. It will be understood here that standard security measures are adopted to preserve the integrity, authenticity and confidentiality of the data transmitted from the client device to the cloud-based server. For example, encryption and signatures are adopted as part of the network protocol. It will be further understood that the received user key and ID are securely stored on the cloud-based server i.e. integrity protected. With the client device having forwarded the user-specific key and user ID to the cloud-based server, enrolment is now complete. Figure 3 shows steps carried out by an enrolled user when seeking to authenticate themselves to the cloud-based server at a later point in time. The user begins by inputting a new data set that corresponds to that used as the template data set during enrolment (step S301). For example, in the event that enrolment was carried out based on an image of the user’s face, the user may provide a new facial image, by taking a photo of themselves with a camera of the client device. As part of this process, the client device may prompt the user to provide the necessary set of input data. In step S303, the client device performs feature extraction on the input data set, in the same way as when performing feature extraction on the template data set in step S203 of Figure 2. In step S305, the client device proceeds to generate a vectory of floating point values that represent features extracted from the newly input data set. As was the case in enrolment, the client device computes the norm (magnitude) ||y|| of the feature vector y, divides each value in the vectory by the norm ||y||, performs scaling and rounding of the values into integers, and outputs the vector of floating point values as a vector of integers y’. Having calculated the vector y’, the client device now generates a ciphertext by encrypting the vector y’ using the master secret key msk (step S307) and forwards the vector Y' = Encmsk(y'} to the cloud-based server, together with the user ID (step S309). It will be appreciated here that the master secret key msk used for encrypting the vector y’ must be the same master secret key as was used during the enrolment phase; further detail of how to ensure that the client device can ensure it selects the correct master secret key is provided later on below. Figure 4 shows a sequence of steps as carried out by the cloud-based server in order to authenticate the user of the client device. As shown in Figure 4, in order to perform authentication, the cloud-based server must first be in possession of the user-specific key and user ID from the user. It will be appreciated that receiving the user-specific key and the user ID forms part of the stage of enrolment described with reference to Figure 2 above. Having received user key and ID, these are securely stored in the cloud-based server (step S401). Authentication commences in step S403, in which the cloud-based server receives from the client device the vector Y', as generated in step S307 of Figure 3. On receiving this data, the cloud-based server retrieves the user specific key sk associated with the user’s claimed ID from the secure storage. In step S405, the cloud-based server processes the received vector Y’ using the user specific key sk. By virtue of the user specific key sk being derived from the master secret key msk and x’, the result of processing the vector / ’with the user specific key sk is to return the inner product of x' and y’. The output value is then converted back into floating point value representation by re-scaling (step S407). The re-scaled value is equal to the inner product of x and y, divided by | |x| | | |y| |, which is the cosine similarity between x and y. The cosine distance can then be simply calculated by the cloud-based server as the cosine similarity value subtracted from 1. In step S409, the cloud-based server determines whether the cosine distance as calculated in step S407 is below or equal to a predefined threshold. In the event the cosine distance is below or equal to the threshold distance, the user is authenticated (step S411). The server may then go on to perform another operation, such as provide the user with an authentication token or physical access to a room. If the cosine distance is found to be above the threshold, the user is not authenticated. As discussed above, when processing the received ciphertext (encrypted vector) with the user specific key sk, the same master secret key msk must have been used to generate both the user secret key and the ciphertext. If different master secret keys have been used, then the inner product that is output will be incorrect. It is also important for the security of the scheme that a master secret key is only used for a single user secret key generation (i.e. user enrolment). Hence, not only must the master secret key msk be unique for each user, but if ever that user was to enrol again (needing a new user-specific key generation) then a new master secret key will also need to be generated for that user. The same master secret key can, however, be used for multiple encrypt operations (i.e. user authentications). It follows that unique master secret keys must be used each time a user secret key is generated, but that when performing an authentication, the same master secret key as was used for enrolment will need to be selected. In the case where the client device used for enrolment and authentication is unique to a particular user (e.g. the client device is that user’s personal mobile phone), these requirements may be met by storing the master secret key on the client device and using that master secret key whenever the client device is used for authenticating the user. In other embodiments, the client device may need to serve multiple users. For example, the client device may comprise an authentication terminal at building or site entry. In this case, the client device may store all master secret keys, and retrieve the one associated with the claimed user at authentication. Storing all master secret keys for multiple users may, however, become impractical if the number of users is very large. There is also a potential key management problem, in that each new enrolment will require a secure distribution of the generated master secret key to all trusted clients. A solution to this problem is to derive all master secret keys from a common root key. Here, each specific master secret key can be derived from a combination of the root key with a unique (public) label using a suitable Key Derivation Function (KDF). This means that a trusted client need only store one root key, but can generate master secret keys as and when needed for authentication. As noted above, the master secret key consists of two variables: (i) A vector u of length n + k with elements sampled uniformly at random from Zq (ii) An (n + k) x k matrix T = where Ik is the identity matrix of dimension k x k and S is an n x k matrix with values sampled randomly from Zq using the Discrete Gaussian distribution with width parameter a. One way to ensure uniqueness of the master key each time it is generated is to use a new matrix T (or equivalently S) for each user secret key generation. However, a more preferable approach is to use a different vector u each time, with the matrix T being generated once in a setup stage and then reused for all enrolments. Using a different vector u each time is sufficient to ensure uniqueness, and is more efficient as the vector u is significantly smaller than T and only requires uniformly random sampling, which is simple to accomplish with common KDFs. The matrix T can be stored along with the root key on all devices that need to perform enrolments or authentications. It is recommended that a NIST approved KDF from Reference 1 (“Recommendation for Key Derivation Using Pseudorandom Functions”, NIST Special Publication 800, NIST SP 800-108r1-upd1, Lily Chen, Computer Security Division, Information Technology Laboratory , August 2022”) is selected for this purpose (e.g. “KDF in Counter Mode” based on HMAC as the Pseudo Random Function (PRF) - see “The Keyed-Hash Message Authentication Code (HMAC)”, FIPS PUB 198-1 FEDERAL INFORMATION PROCESSING STANDARDS PUBLICATION, Information Technology Laboratory, National Institute of Standards and Technology, Gaithersburg, MD 20899-8900, July 2008). To ensure collisions are unlikely (i.e. to ensure each vector u is indeed unique), the root key should be of size 256 bits for the selected security parameter of 128-bits, and a hash function with input length at least 256 bits should be selected (e.g. SHA-256). The remaining question is then how to manage the labels used to identify each user, and in turn identify which master secret key is to be retrieved for that particular user. The user IDs themselves provide a natural choice of labels and make sense in the context of authentication, as the authentication process is attempting to confirm a user ID, and hence the user ID must be known or presented during authentication in any case. However, other options may make sense, such as a simple sequence number, or a combination of user ID and sequence number to allow for multiple enrolments by the same user. Such options would require the label to be stored somehow by the user after enrolment, and presented at authentication. Accordingly, by using the root key in conjunction with the user’s unique ID / label and the KDF, it is possible to derive a master secret key for each user without the need to permanently store each user’s master secret key on the client device. When seeking to authenticate a user, the client device can use the label associated with that user (e.g. the user ID) to ensure that when encrypting the vector y’ the correct master secret key is selected i.e. the same master secret key as was originally used in generating that user’s user-specific key during the enrolment phase. In addition to authenticating a user, the techniques described herein may also be utilised in identifying a user from one of a plurality of different users. Regardless of whether the cloud-based server performs the step of authenticating the user of the client device, or identifying that user, the user will perform the same process of enrolment as shown in Figure 2. It is possible that multiple different users will be enrolled with the cloud-based server and the server will identity the particular user from among the plurality of users to have previously enrolled. An embodiment in which the cloud-based server is used to identify the user of the client device will now be described with reference to Figures 5 and 6. Figure 5 shows a sequence of steps as carried out by the client device in order for the cloud-based server to identify the user from among the plurality of users to have previously enrolled with the server. Here, steps S501 to S505 reproduce steps S301 to S305 exactly. In step S507, the client device performs a similar operation to step S303, but rather than encrypting the vector y’ with a single master secret key, the client device now generates a ciphertext for each one of the master secret keys stored on the device; that is, the client device generates a respective vector Y’ using each master secret key stored on the device. The client device further associates each one of the generated vectors / ’with a label identifying the respective master secret key. In step S509, the client device sends the vectors Y’to the cloud-based server together with the associated labels. Figure 6 shows a sequence of steps as carried out by the cloud-based server in order to identify the user of the client device. In step S601, the server receives the encrypted vectors Y' from the client device, together with the associated labels. In step S603, the server selects one of the encrypted vectors Y’ and using the label, retrieves from memory the user-specific key sk associated with that user (i.e. the user whose master secret key was used to encrypt the vector 7'). The user-specific key is itself stored by the server in conjunction with the user ID as supplied during enrolment. In step S605, the server processes Y’ using the user-specific key, so as to return the inner product of x’ and y’. The output value is then converted back into floating point value representation by re-scaling (step S607) to return the cosine similarity between x and y. The cosine distance between x and y may then be computed as before as the cosine similarity subtracted from 1. The cosine distance is compared with a predefined threshold (step S609). In step S611, if the cosine distance is less than or equal to the threshold, the server is able to identify the user is that whose user-specific key was retrieved in step S603. Conversely, if the cosine distance is above the threshold, the server is able to deduce that the user-specific key sk used to process the vector Y’ is not the same key as was originally generated using the vector x’during enrolment (see step S207 of Figure 2). Following this, the server is able to determine that the user is a different user from that associated with the user-specific key sk retrieved in step S603. The server may then select a new one of the encrypted vectors Y’, together with the corresponding user specific key (step S613) and proceed through steps S605 to S609 using the newly selected user-specific key to process the vector Y’, The process may repeat until such time as the server returns a positive result in step S609. The user is then found to have the identity associated with the successful user-specific key. The need to encrypt the vector y’ with each one of the master secret keys means that the above identification approach may not be applicable where the pool of users is especially large i.e. where there are a large number of users to have enrolled with the server, and where a respective encrypted vector must be generated each time the server needs to identify an individual one of those users from that pool. Nevertheless, the above approach may still be suitable in certain scenarios, such as “watchlist” applications. If the watchlist is small (e.g. a few hundred users) and the labels are simple sequence numbers, then the client device may produce the required ciphertexts I encrypted vectors Y’ for all possible labels / users without undue overhead. Accordingly, through use of the functional inner product encryption described above, cosine distances may be computed between biometrics represented as vectors of floating point numbers in a privacy preserving manner by a single cloud-based server. By proceeding in this way, the server (or other adversary) is unable to learn raw user templates, through observation or via trying to reverse engineer any data stored by the cloud-based server. The cloud server may be used to perform the distance computations to support authentication and / or identification use cases, without risk of the server either learning the raw data and using it in an unauthorised manner, or leaking raw data in case of compromise during computation. The methods as discussed above are applicable in authentication schemes in which the biometrics (e.g. facial biometrics) can be represented as floating point vectors and the differences between them calculated as the cosine distance between those vectors. However, some authentication protocols may involve additional processing steps that necessitate a different approach. As an example, we can consider an iris-matching technique. Referring to Figure 7, the enrolment phase of the iris-matching technique includes capturing a template image 701 of a user’s eye(s), together with a mask 703, and converting both the template image and the mask into binary vectors. The mask vector is used to remove bits from the template vector during matching calculations, to ensure that only useful (discriminative) bits of the template are made use of. Authentication may be carried out by determining the Hamming distance between the masked template 705 and a newly captured image of the user’s iris, again with the mask applied to it. Here, the authentication scheme must accommodate the fact that the input data set used in enrolment comprises a combination of two vectors, namely the vector corresponding to the underlying template image and the vector corresponding to the applied mask; likewise, the input image used for authenticating / identifying the user will comprise a combination of these two vectors. In what follows, an embodiment will be described in which matching is performed in a privacy preserving manner by computation of hamming distances between these different input vectors. The described embodiment extends the approach described in Cheon J., et al. to support a commonly applied iris matching process. More broadly, the described embodiment facilitates the use of inner product encryption (IPE) in authentication / identification protocols where the data sets being compared with one another include both an underlying template vector and a mask vector. The following notation will be used: « During Enrolment, a template vector A and a mask vector MaskA are captured. » During Authentication, a template vector B and a mask vector Masks are captured. ® The inner product between two vectors A and B is denoted (A,B). * The Hamming Distance between two vectors A and B is denoted HD (A, B). © denotes XOR (Exclusive-OR). A denotes AND. * -i denotes NOT. * 11--- || denotes the L1 norm, which is the sum of the entries of the vector. For binary vectors, this is equivalent to the number of non-zero entries. * / (A) denotes the number of elements in the vector A. Note that in the described implementations, each vector will have the same length, with that length being known by both the client and server. It will be appreciated that for binary vectors: . \\A®B\\=HD(A,B) • ||A AB|| = {A,B} • Hamming distances can be calculated as inner products with some preprocessing of the vectors involved, as shown in Cheon, J. et al. If all “0” elements are replaced with -1, then it can be shown that HD (A, B) = ( / (A)-(A,B» / 2. Based on the above, the following distance metric is used by the matching algorithm: d((A, MaskA), (B, MaskB)) ||(A © B)^MaskA^MaskB\\ \\MaskA / \MaskB || In order to utilise the IPE approach described in Cheon, J. et al., the vectors A, MaskA, B and Masks need to be pre-processed into vectors for which the application of inner products alone will be sufficient to calculate the distance d. Moreover, any inner product can only involve a vector pre-processed from A and / or MaskA, together with a vector pre-processed from B and / or Masks. It is not possible, for example, to use inner products where one of the input vectors is a combination of A and B; this is because such combinations of vectors will not be available at enrolment or authentication (enrolment can only access vectors related to A and MaskA, and authentication can only access vectors related to B and Masks. This presents a challenge in that the numerator in the above expression has no simple or obvious way of being calculated from vector inner products whilst also complying with these other constraints. The solution to the above problem resides in determining that the distance d can be written instead as: d((A,MaskA), (B,MaskB)) = \\(AAMaskA) Q (B / \MaskB)\\ — ||(AAMas / ci4)A-iMcis / cB|| — \\(BAMaskB) / \-iMaskA\\ \\MaskAAMaskB || The proof of the above statement can be verified by writing out truth tables for the two expressions and showing equivalence. Note that this form of the distance d satisfies all the constraints as discussed above. Each individual term in the expression involves just A and / or MaskA, or B and / or Masks. These terms are combined using XORs or AN Ds, which correlate to hamming distances (which can be computed as inner products) and inner products respectively. It will be appreciated that the specific formulation for d((A,MaskA), (B,MaskB)) above is a Boolean formula that may be written in many equivalent ways; for example, the formula may be modified by making use of equivalents such as A ® B = (A a -tB) v (-iA AB); or P v (Q v R) a (R v ->P)) = R v (-J3 a Q). As such, using the embodiments described herein, and in particular, by calculating the different vectors described below, it will be possible to formulate a host of different Boolean formulae that satisfy the conditions needed to utilise the IPE approach described in Cheon. As in the example shown in Figures 1 to 6, the process commences with an enrolment phase in which the user provides the cloud server with a reference biometric template and associated ID (e.g. user’s name), which it can use to later authenticate and / or identify the user. Figure 8 shows the steps carried out in the enrolment phase in the present embodiment. As before, the user may capture their biometric reading on a client device (step S801), which then performs feature extraction on the biometric reading to keep features of interest, and remove irrelevant data (step S803). Having performed feature extraction, the client device now outputs a binary vector A that represent the extracted features (step S805). In step S807, the client device captures a mask that is to be applied to the template data set and similarly generates a binary vector representation of that mask MaskA (step S809). At this stage, the biometric consists of the binary vectors A and MaskA. In steps S811 to S815, the client device determines the following vectors: ^masked _ AKMaskA (the template vector with mask applied) AW0T = -Mask^ (the “inverse” of the mask vector) and ^Hamming where ahamming js the vector obtained by replacing all 0 entries in the vector A / \MaskA with -1. In step S817, having obtained the vectors MaskA, amasked, Anot and ahamming , the client device generates four master secret keys, mski, msk2, msks. msk4 and stores these securely on the device. Each of the generated master secret keys must be unique and distinguished from any other previously used for a particular set of scheme parameters. Each master secret key msk is obtained using the same approach as described above in step S207 of Figure 2, the master secret key being a tuple (u, S), where u is a vector of length m of random integer values mod q and S is an n x k matrix of random integer values mod q. As before, the values m, n and q are underlying parameters of the encryption scheme and can be selected based on the required security level of the scheme; k is the length of vectors A, MaskA, amasked, Anot and ^HAMMING Next, in step steps S819 to S825, the four master secret keys are used to generate respective user-specific keys for each one of the vectors MaskA, amasked, Anot and ^hamming The C|jent device then forwards the user-specific keys together with the user ID to the server (step S827). Figure 9 shows the steps carried out by the server as part of the enrolment process. Here, the server receives the user-specific keys and the user ID (step S901) and stores them in memory (step S903). It is assumed here that suitable security measures are adopted to preserve the integrity and confidentiality of the data transmitted from the client device to the server (e.g. encryption and signatures are adopted as part of the network protocol) and that the received user keys and user ID are securely stored on the server in terms of integrity protection. Figure 10 shows steps carried out by the user during the authentication phase. The user captures a fresh biometric data set on the client device (step S1001), which then performs feature extraction on that data set (step S1003). The client device outputs a binary vector Bo that represents the extracted features (step S1105). In step S1007, the client device captures a mask that is to be applied to the input data set and generates a binary vector representation of that mask Maskao (step S1009). At this stage, the biometric consists of the binary vectors Bo and Maskso. In step S1011, the client device determines a number of shifts n to be applied to the mask. The shifts accommodate the fact that the mask applied to the input template during enrolment may not perfectly align with the mask that is applied to the input template during authentication. This can be further understood with reference to Figure 11. Figure 11A shows the same sequence of images as shown in Figure 7, namely a template image 701 of a user’s eye(s) captured during the enrolment phase, a mask 703 and the masked template 705 that results from applying the mask 703 to the template image 701. Figure 11B shows another template image 1101 captured during the authentication phase, together with a new mask template 1103 and the result 1105 of applying the mask 1103 to the template image 1101. In this case, the alignment between the mask 1103 and the image template 1101 is shifted relative to that of the mask 703 and the image template 701; that is, the mask 1103 is shifted a distance Sy in the vertical direction relative to the image template 1101. Applying the different shifts to the mask during enrolment or authentication increases the likelihood of reproducing the same alignment between the mask 1103 and image template 1101 for the authentication phase as between the mask 703 and image template 701 in the enrolment phase; this in turn can help mitigate against false negatives where the person seeking authentication is genuine but cannot be verified owing to a difference in the alignment between the mask and template. (Although the shift 8y in Figure 11B represents a shift in the vertical direction, shifts may also be obtained in the horizontal direction either in addition to, or alternatively from, the vertical direction). As discussed further below, during authentication, the distance metric d may be calculated for each one of the shifts of A and MaskA (i.e. image template 701 and mask 703) against B and Masks (i.e. image template 1101 and mask 1103). The obtained distances d can then be compared with the threshold T, and if any of the distances are within that threshold distance, the matching algorithm will output a match. Typically, the shifts can be implemented as simple bit-shifts of the vectors as used in common computing languages. Referring again to Figure 10, in step S1013, a first shift i = 0 is selected. In steps S1015 to S1023, the client device determines the following vectors: Bi (the original template vector) MaskB. (the mask vector) ^masked _ E. / \MaskB. (the template vector with mask applied) bnot _ _lj^asiCg^ “inverse” of the mask vector) and Bamming w(-]ere ^hamming jS veCfOr obtained by replacing all 0 entries in the vector Bi / \MaskB. with —1. (It will be appreciated that for i = 0, the vectors Bt and MaskB. are the same ones Bo and MaskBo as obtained in steps S1005 and S1009, respectively). The four vectors MaskB.>b^asked, b*ot and B"amming are encrypted, respectively, with the keys mski, msk2, msk3 and msk4 used to generate the first, second, third and fourth user-specific keys. In step S1025, the client device proceeds with the next shift by incrementing the value of i, following which steps S1015 to S1023 are repeated with the new shift applied to the vectors. The process will repeat for each shift 0 <i <n - 1, resulting in a total number of 4n encrypted vectors being generated, there being four encrypted vectors generated for each shift n. The encrypted vectors are in turn forwarded to the server (step S1119). Similarly to the enrolment phase, it is assumed that the data is sent securely to the server and integrity protected. Figure 12 shows steps carried out by the server during the authentication stage. Having received the An encrypted vectors MaskB.,B™ASKED, BfOT and bhamming where (0 <i <n - 1) from the user, together with the user ID (step S1201), the server retrieves from storage the four user-specific keys corresponding to the user ID (step S1203). In step S1205, the server sets i = 0, and in step S1207 computes the distance metric d, as: W(MaskBl) - (ahamming, - ^masked>bnot^ _ ^masked, (MaskA, MaskB.) The above formulation for d follows directly from the Boolean formula set out earlier. As formulated in this way, the distance metric dean be calculated using inner products, where each inner product involves processing an encrypted vector (e.g. beamming with a user secret key (e.g. ahamm,ng) using the Inner Product Encryption scheme. The inner product encryption scheme is able to take the user-specific key and the encrypted vector, and obtain from these the inner product of the two underlying vectors. As in the embodiment shown in Figures 1 to 6, this computation does not require decryption of the underlying vectors; a computer may perform this computation without any ability to decrypt the underlying vectors, or indeed obtain any information about them besides the inner product. If the distance d is found to be less than or equal to a predetermined threshold (step S1209) the user is authenticated (step S1211). Otherwise, the server increments the value i and applies the next shift, with steps S1207 and S1209 being repeated until either the calculated distance metric d / for one of the shifts is found to be less than or equal to the predetermined threshold, or the total number of shifts n is complete without the distance metric d, having satisfied the threshold criterion; in this case, authentication fails and the user is blocked from accessing the server (step S1215). As in the example shown in Figure 6, the present embodiment can also be used to support user identification, rather than authentication. Here, the steps carried out in enrolling the user remain the same (see Figures 8 and 9). Figure 13 shows the steps carried out by the client device if performing user identification. Here, the client device carries out a similar sequence of steps to that shown in Figure 10, the difference being that a respective set of four master secret keys mski, msk2, msk3l msk4 is retrieved for each user m = 1,...w, where w is the total number of enrolled users, and steps S1015 to S1023 are repeated for each one of those sets of master secret keys (steps S1319 to S1327 in Figure 13). In more detail, each user m enrolled with the server will have a set of four master secret keys used to generate the vectors MaskB, bmasked,BN0T and bhamming for that user. The client device will generate these four vectors for each shift for each user. Thus, in the event that a number of shifts n are used for each user, and the total number of enrolled users is w, the client device will perform 4n encryptions for each one of the users and send a total of 4nw encrypted vectors I ciphertexts to the server. As in the embodiment of Figure 5, when sending each set of 4n encrypted vectors to the server, the client device includes a label identifying the user associated with the respective set of encrypted vectors (step S1331). Figure 14 shows the steps carried out by the server as part of the identification process. The server receives the encrypted vectors MaskBi,l^’ASKI':D, B^ot and BpMMlNG for each user, and uses the associated labels to match each set of encrypted vectors with the respective user’s set of four user-specific keys mski, msk2, msk3, and msk4 (step S1401). In step S1403, the server selects a first user m = 1 from among those who have enrolled with the server and in step S1405, the server retrieves the set of four user-specific keys and the associated set of encrypted vectors it has received for the user m = 1. In step S1407, the server selects the first shift i = 0 and using the selected user-specific keys, together with the encrypted vectors for i = 0, computes the distance metric di (step S1409). In step S1413, if the value of di is found to be less than or equal to the predetermined threshold (step S1411), the server is able to identify the selected user m as the one to have generated the binary vector representation of features Bo (see step S1005 of Figure 10). Otherwise, the server increments the value i and applies the next shift (step S1415), with steps S1409 to S1411 being repeated until either the calculated distance metric d, for one of the shifts is found to be less than or equal to the predetermined threshold, or the total number of shifts n is complete without the distance metric di having satisfied the threshold criterion. In the latter case, it is determined that the user m is not the correct user. In step S1417, it is determined whether there are other enrolled users yet to be considered (i.e. if m = w); if not, the next user m = m + 1 is selected. The steps S1405 to S1415 are then repeated using the user-specific keys associated with that other user. The process will continue to repeat until such time as a user is identified for whom the computed distance metric di for one of the shifts is found to be equal to or less than the predetermined threshold, or all enrolled users have been considered without a positive identification having taken place. As in the embodiment of Figure 5, it will be appreciated that the need to encrypt the vectors with each set of master-secret keys each time an identification process is carried out means that this approach may not be applicable where the pool of users is especially large. However, the approach may still be suitable in watchlist applications where there are a comparatively small number of users enrolled with the server. Thus, embodiments described herein enable an iris matching metric to be computed between biometrics represented as binary vectors together with associated binary masks in a privacy preserving manner by a single Cloud Server. This is performed in such a way that the server (or an adversary) is not able to learn raw user templates, through observation or via trying to reverse engineer any data stored by the server. In particular, embodiments described herein provide privacy of data not only during rest and in transit, but also now during computation (when compared against conventional approaches). Embodiments can also offer better runtime performance than alternative privacy preserving schemes based on technologies such as Homomorphic Encryption and Multi-Party Computation. Embodiments described herein are based on latticebased ‘functional inner product encryption’ and are thus considered to be quantum safe. Implementations of the subject matter and the operations described in this specification can be realized in digital electronic circuitry, or in computer software, firmware, or hardware, including the structures disclosed in this specification and their structural equivalents, or in combinations of one or more of them. Implementations of the subject matter described in this specification can be realized using one or more computer programs, i.e., one or more modules of computer program instructions, encoded on computer storage medium for execution by, or to control the operation of, data processing apparatus. Alternatively or in addition, the program instructions can be encoded on an artificially generated propagated signal, e.g., a machine-generated electrical, optical, or electromagnetic signal that is generated to encode information for transmission to suitable receiver apparatus for execution by a data processing apparatus. A computer storage medium can be, or be included in, a computer-readable storage device, a computer-readable storage substrate, a random or serial access memory array or device, or a combination of one or more of them. Moreover, while a computer storage medium is not a propagated signal, a computer storage medium can be a source or destination of computer program instructions encoded in an artificially generated propagated signal. The computer storage medium can also be, 5 or be included in, one or more separate physical components or media (e.g., multiple CDs, disks, or other storage devices). While certain embodiments have been described, these embodiments have been presented by way of example only and are not intended to limit the scope of the 10 invention. Indeed, the novel methods, devices and systems described herein may be embodied in a variety of forms; furthermore, various omissions, substitutions and changes in the form of the methods and systems described herein may be made without departing from the spirit of the invention. The accompanying claims and their equivalents are intended to cover such forms or modifications as would fall within the 15 scope and spirit of the invention.

Claims

1. A computer-implemented method comprising:receiving, at a first point in time, a first data set from a user;upon receipt of the first data set:performing feature extraction on the first data set to obtain a first feature vector;generating a first integer vector representation of the first feature vector;generating, using the first integer vector representation and a master key, a user-specific key; andsending, to a remote server, a user ID together with the user-specific key.

2. A computer-implemented method according to claim 1, wherein the first data set comprises biometric data.

3. A computer-implemented method according to claim 1 or 2, wherein generating the integer vector representation of the first feature vector comprises:computing the norm of the first feature vector;dividing each value in the first feature vector by the norm; androunding or scaling the values of the first feature vector into integer values.

4. A computer-implemented method according to any one of the preceding claims, further comprising:receiving, at a later point in time, a second data set;upon receipt of the second data set:performing feature extraction on the second data set to obtain a second feature vector;generating a second integer vector representation of the second feature vector;generating an encrypted version of the second integer vector representation using the master key; andsending, to the remote server, the encrypted version of the second integer vector representation.

5. A computer-implemented method according to claim 4, comprising:sending, to the remote server, the user ID together with the encrypted version of the second integer vector representation.

6. A computer-implemented method according to claim 4 or 5, wherein the second dataset comprises biometric data.

7. A computer-implemented method according to any one of claims 4 to 6, wherein generating the second integer vector representation of the second feature vector comprises:computing the norm of the second feature vector;dividing each value in the second feature vector by the norm; androunding or scaling the values of the second feature vector into integer values.

8. A computer-implemented method comprising:receiving, at a server, from a user, a user-specific key and a user ID, the userspecific key being generated using (i) an integer vector representation of a first feature vector and (ii) a master key;receiving, at the server, from the user, an encrypted vector and a claimed user ID, wherein the vector is encrypted using the master key;processing, by the server, the encrypted vector using the user-specific key to obtain an output value;determining, by the server, whether the output value is equal to or less than a predetermined threshold; andin the event the output value is less than or equal to the threshold, authenticating the claimed user ID as being the same as the user ID.

9. A computer-implemented method comprising:(i) receiving, at a server, from a client device, a plurality of ciphertexts, wherein each ciphertext is generated by encrypting the same vector using a different respective master secret key, each ciphertext being accompanied by a label indicating a respective user;(ii) retrieving from storage, by the server, a user-specific key corresponding to the user indicated by the label accompanying a first one of the ciphertexts;(iii) processing, by the server, the first one of the ciphertexts using the userspecific key to obtain an output value;(iv) in the event the output value is less than or equal to a predetermined threshold, determining that the user indicated by the label accompanying the first ciphertext is a user operating the client device;(v) in the event the output value is greater than the threshold, retrieving a second user-specific key corresponding to the user indicated by the label accompanying a second one of the ciphertexts and processing, by the server, thesecond one of the ciphertexts using the second user-specific key to obtain a second output value; and(vi) in the event the second output value is less than the threshold, determining that the user indicated by the label accompanying the second ciphertext is the user operating the client device.

10. A computer-implemented method according to claim 9, wherein:in the event the second output value is greater than the threshold, the method comprises repeating steps (ii) and (iii) for further ciphertexts and their corresponding user-specific key, until the output value obtained is less than the threshold or else a predetermined number of user-specific keys have been retrieved.

11. A computer-implemented method according to any one of the preceding claims, wherein each dataset comprises an image of a user’s face.

12. A computer-implemented method comprising:receiving, at a first point in time, a first data set from a user;performing feature extraction on the first data set to obtain a first feature vector;generating a binary vector representation A of the first feature vector;receiving a mask for the first data set;generating a binary vector representation MaskA of the mask for the first data set;generating, using the first binary vector representation MaskA and a first master secret key msk a user-specific key;applying the binary vector representation MaskA of the mask to the binary vector representation A of the first feature vector to obtain a masked template vector ^MASKED ■generating a second user-specific key using the masked template vector ^masked anc| a seconc| master secret key;generating an inverse vector AN0T of the binary vector representation MaskA,generating a third user-specific key using the inverse vector AN0T and a third master secret key;generating a hamming vector ahamm,ng by replacing all zero entries in the masked template vector amasked with -1;generating a fourth user-specific key using the hamming vector ahamming and a fourth master secret key; andsending, to a remote server, a user ID together with the first user-specific key, the second user-specific key, the third user-specific key and the fourth user-specific key.

13. A computer-implemented method according to claim 12, further comprising: receiving, at a later point in time, a second data set from the user;performing feature extraction on the second data set to obtain a second feature vector;generating a binary vector representation B of the second feature vector;receiving a mask for the second data set;generating a binary vector representation Masks of the mask for the second data set;encrypting the binary vector representation Masks with the first master secret key;applying the binary vector representation Masks to the binary vector representation B of the second feature vector to obtain a second masked template vector bmasked ;encrypting the second masked template vector bmasked with the second master secret key;obtaining an inverse vector BNOT of the second binary vector representation Masks',encrypting the inverse vector BNOT with the third master secret key;obtaining a hamming vector bhamming by replacing all zero entries in the masked template vector bmasked with -1;encrypting the hamming vector bhamming with the fourth master secret key; and sending, to the remote server, the encrypted binary vector representation Masks of the mask for the second data set, the encrypted masked template vector bmasked^ tpe encrypted inverse vectorBNOT and the encrypted hamming vector ^HAMMING14. A computer-implemented method according to claim 13, comprising:sending, to the remote server, the user ID together with the encrypted second binary vector representation Masks of the mask for the second data set, the encrypted masked template vector bmasked, the encrypted inverse vector BN0T and the encrypted hamming vector bhamming.

15. A computer-implemented method according to claim 13 or 14, further comprising: applying one or more shifts to the binary vector representation Masks and / or the binary vector representation B of the second feature vector, wherein each shift represents a shift in relative alignment of the second data set and the mask for the second data set;for each shift, generating a new version of each of the encrypted binary vector representation Masks of the mask for the second data set, the encrypted masked template vector bmasked , the encrypted inverse vector BNOT and the encrypted hamming vector bhamm,ng; andsending the new version of each of the encrypted binary vector representation Masks of the mask for the second data set, the encrypted masked template vector smashed, encrypted inverse vector BN0T and the encrypted hamming vector shamming to ^g remote server.

16. A computer-implemented method comprising:(i) receiving, at a server, from a client enrolment device used to enrol a user with the server, a user ID, a first user-specific key, a second user-specific key, a third user-specific key and a fourth user-specific key;the first user-specific key being generated at the client enrolment device using a binary vector representation MaskA of a first mask and a first master secret key, the second user-specific key being generated at the client enrolment device using a second master secret key and a masked template vector amasked obtained by applying the binary vector representation MaskA to a binary vector representation of a first data set A;the third user-specific key being generated at the client enrolment device using a third master secret key and an inverse vector AN0T of the binary vector representation MaskA',the fourth user-specific key being generated at the client enrolment device using a fourth master secret key and a hamming vector ahamming obtained by replacing all zero entries in the masked template vector amasked with -1;(ii) receiving, at the server, from a client authentication device used in authenticating the user with the server, a first encrypted vector, a second encrypted vector, a third encrypted vector, and a fourth encrypted vector,the first encrypted vector being generated at the client authentication device by encrypting a binary vector representation Masks of a second mask using the first master secret key;the second encrypted vector being generated at the client authentication device by encrypting a masked template vector bmasked using the second master secret key, the masked template vector bmasked being obtained by applying the binary vector representation Masks of the second mask to a binary vector representation of a second data set B;the third encrypted vector being generated at the client authentication device by encrypting an inverse vector BN0T of the binary vector representation Masks using the third master secret key;the fourth encrypted vector being generated at the client authentication device by encrypting a hamming vector bhamming using the fourth master secret key, the hamming vector bhamming obtained by replacing all zero entries in the masked template vector bmasked with -1;processing each encrypted vector using a respective one of the user-specific keys to return a respective inner product;calculating the value of a distance metric between the first data set when masked by the first mask and the second data set when masked by the second mask as a function of the inner products; anddetermining, whether the output value is equal to or less than a predetermined threshold; andin the event the output value is less than or equal to the threshold, authenticating the user by the server.

17. A computer-implemented method according to claim 16, comprising:receiving, at the server, from the client authentication device, a plurality of sets of encrypted vectors, each set of encrypted vectors comprising a first encrypted vector, a second encrypted vector, a third encrypted vector and a fourth encrypted vector, wherein for each set of encrypted vectors:the first encrypted vector in the set is generated at the client authentication device by applying a respective shift to the binary vector representation of the Masks of the second mask to obtain a shifted binary vector representation of the Masks, and encrypting the shifted binary vector representation of the Masks using the first master secret key;the second encrypted vector is generated at the client authentication device by applying the respective shift to the binary vector representation of the second data set B to obtain a shifted binary vector representation of the second data set, applying the shifted binary vector representation of the Masks to the shifted binary vectorrepresentation of the second data set to obtain a masked template vector bmasked for the respective shift, and encrypting the masked template vector bmasked using the second master secret key;the third encrypted vector is generated at the client authentication device by encrypting an inverse vector BN0T of the shifted binary vector representation MaskB using the third master secret key; andthe fourth encrypted vector is generated at the client authentication device by replacing all zero entries in the masked template vector bmasked for the respective shift with -1 to obtain a hamming vector bhamming and encrypting the hamming vector ^Hamming USing tine fourth master secret key;the method further comprising, for one or more of the sets of encrypted vectors: processing each encrypted vector within the set using a respective one of the user-specific keys to return a respective inner product;calculating the value of a distance metric between the first data set when masked by the first mask and the second data set when masked by the second mask as a function of the inner products; anddetermining, whether the output value is equal to or less than a predetermined threshold; andin the event the output value is less than or equal to the threshold for one of the sets of encrypted vectors, authenticating the user by the server.

18. A computer-implemented method comprising:(i) receiving and storing, at a server, for each one of a plurality of users, a first user-specific key, a second user-specific key, a third user-specific key and a fourth user-specific key;wherein for each user:the first user-specific key is generated using a binary vector representation MaskA of a first mask and a first master secret key of the user;the second user-specific key is generated using a second master secret key of the user and a masked template vector amasked obtained by applying the binary vector representation MaskA to a binary vector representation of a first data set A;the third user-specific key is generated using a third master secret key of the user and an inverse vector AN0T of the binary vector representation MaskA', andthe fourth user-specific key is generated using a fourth master secret key of the user and a hamming vector ahamming obtained by replacing all zero entries in the masked template vector amasked with -1;(ii) receiving, by the server, from a client device, for each one of the users, a group of ciphertexts, each group being accompanied by a label indicating the respective user, each group of ciphertexts comprising:a first ciphertext generated by encrypting a binary vector representation MaskB of a mask using the first master secret key of the respective user;a second ciphertext generated by encrypting a masked template vector ^masked USjng second master secret key of the respective user, the masked template vector bmasked being obtained by applying the binary vector representation Masks of the first mask to a binary vector representation of a data set B;a third ciphertext generated by encrypting an inverse vector BN0T of the binary vector representation MaskB using the third master secret key of the respective user; anda fourth ciphertext generated by encrypting a hamming vector bhamm,ng using the fourth master secret key of the respective user, the hamming vector bhamming obtained by replacing all zero entries in the masked template vector bmasked with -1;(iii) selecting a first one of the groups of ciphertexts;(iv) retrieving the user-specific keys for the user indicated by the label accompanying the first group of ciphertexts;(v) processing each ciphertext in first group of ciphertexts using a respective one of the retrieved user-specific keys to return a respective inner product;(vi) calculating the value of a distance metric as a function of the inner products; and(vii) determining, whether the output value is equal to or less than a predetermined threshold;(viii) in the event the output value is less than or equal to the threshold, determining that the user indicated by the label accompanying the first group of ciphertexts is the user operating the client device.

19. A computer-implemented method according to claim 18, wherein:in the event the output value is greater than the predetermined threshold, the method comprises repeating steps (iii) to (viii) for one or more groups of ciphertexts, until the output value obtained is less than the threshold or else a predetermined number of groups of ciphertexts have been selected.

20. A computer-implemented method according to claim 18 or 19, comprising:(ii) receiving, by the server, from a client device, for each one of the users, aplurality of groups of ciphertexts, each plurality of groups being accompanied by the label indicating the respective user, each group of ciphertexts in each of the plurality of groups comprising a first ciphertext, a second ciphertext, a third ciphertext, and a fourth ciphertext;wherein for each group of ciphertexts in the plurality of groups received from a user:the first ciphertext in the respective group is generated by applying a respective shift to the binary vector representation of the Masks of the second mask to obtain a shifted binary vector representation of the Masks, and encrypting the shifted binary vector representation of the Masks using the first master secret key of the respective user;the second ciphertext is generated by applying the respective shift to the binary vector representation of the second data set B to obtain a shifted binary vector representation of the second data set, applying the shifted binary vector representation of the Masks to the shifted binary vector representation of the second data set to obtain a masked template vector bmasked for the respective shift, and encrypting the masked template vector bmasked using the second master secret key of the respective user;the third ciphertext is generated by encrypting an inverse vector BN0T of the shifted binary vector representation Masks using the third master secret key of the respective user; andthe fourth encrypted vector is generated by replacing all zero entries in the masked template vector bmasked for the respective shift with -1 to obtain a hamming vector bhamming and encrypting the hamming vector bhamming using the fourth master secret key;the method comprising:(iii) selecting, from a first one of the plurality of groups of ciphertexts, a first one of the groups of ciphertexts;(iv) retrieving the user-specific keys for the user indicated by the label accompanying the first one of the plurality of groups of ciphertexts;(v) processing each ciphertext in first group of ciphertexts using a respective one of the retrieved user-specific keys to return a respective inner product;(vi) calculating the value of a distance metric as a function of the inner products; and(vii) determining, whether the output value is equal to or less than a predetermined threshold;(viii) in the event the output value is less than or equal to the threshold,determining that the user indicated by the label accompanying the first one of the plurality of groups of ciphertexts is the user operating the client device.

21. A computer-implemented method according to claim 20, wherein:in the event the output value is greater than the predetermined threshold, the method comprises repeating steps (iii) to (viii) for one or more other groups of ciphertexts in the first one of the plurality of groups of ciphertexts.

22. A computer-implemented method according to claim 21, wherein in the event the output value is greater than the predetermined threshold for each of the one or more other groups of ciphertexts in the first one of the plurality of groups of ciphertexts, the method comprises:selecting, from a second one of the plurality of groups of ciphertexts, a first one of the groups of ciphertexts; andrepeating steps (iii) to (viii) for one or more groups of ciphertexts in the second one of the plurality of groups of ciphertexts.

23. A computer-implemented method according to any one of the preceding claims, wherein each user-specific key is generated as a function of its respective master secret key.

24. A computer-implemented method according to claim 23 as dependent on any one of claims 1 to 10, wherein the user specific key sk is generated by computing sk = u + Tx', where:x' is the first integer vector representation of the first feature vector;u is a vector of length n + k with elements sampled uniformly at random from Zq, where n and q are predefined values and k is the length of the first feature vector; andT is a matrix where Ik is the identity matrix of size k x k and 5 is an n x k matrix of random integer values.

25. A computer-implemented method according to claim 23 as dependent on any one of claims 12 to 22, wherein:the first master secret key comprises a tuple (m. S);the second master secret key comprises a tuple {112, S);the third master secret key comprises a tuple (us, S); andthe fourth master secret key comprises a tuple (u4, 5);wherein:m is a first vector of length n + k with elements sampled uniformly at random from Zq,112 is a second vector of length n + k with elements sampled uniformly at random from Zq,us is a third vector of length n + k with elements sampled uniformly at random from Zq,U4 is a fourth vector of length n + k with elements sampled uniformly at random from Zq;S is an n x k matrix of random integer values, Zq, where n and q are predefined values and k is the length of the first feature vector.

26. A computer-implemented method according to claim 25, wherein:the first user-specific key skt is generated by computing s / q = it, + Tx / ;the second user-specific key sk2 is generated by computing sk2 = u2 + Tx2'\the third user-specific key sk3 is generated by computing sk3 = u3 + Tx3';the fourth user-specific key sk4 is generated by computing sk4 = u4 + Tx4\ where:x4 is the binary vector representation MaskA of the first mask;x2 is the masked template vector amasked ;x3' is the inverse vector AN0T-,x4 is the hamming vector ahamming\T is a matrix [^], where Ik is the identity matrix of size k x k.

27. A computer-implemented method according to any one of the preceding claims, wherein each master secret key is derived in part from a combination of the same root key and a respective unique label using a Key Derivation Function.

28. A computer-implemented method according to any one of the preceding claims, wherein each data set comprises an image captured by a camera of a client device.

29. A computer-implemented method according to claim 28, wherein each image is an image of a user’s eye, and the mask applied to the respective image is such as toisolate the user’s iris in the image.

30. A computer-readable storage medium comprising computer executable instructions that when executed by a computer will cause the computer to carry out a method5 according to any one of the preceding claims.

31. A computer system configured to carry out a method according to any one of the preceding claims.10 32. A computer system comprising:a client device configured to carry out a method according to any one of claims1 to 7, 12 to 15 and 21 to 29; anda server device configured to carry out a method according to any one of claims8 to 11 and 16 to 20.

Images