Privacy-preserving biometric authentication

Abstract

Providing suitable privacy-preserving biometric authentication. [Solution] A system that uses biometric data to authenticate a subject as an individual from which biometric data has been previously acquired. A second converter having a digital electronic signal output that characterizes the subject's biometrics, a second computing facility that receives the digital electronic signals, a server array, and a third computing facility. These components implement a process that includes generating shards from the digital electronic signals, distributing the generated shards to the server array, receiving and storing the generated shards by the server array, performing a data exchange process using a subset of the generated shards, expanding information related to the subject's authentication, transmitting the expanded information to the third computing facility, and causing the third computing facility to generate an output value indicating whether the subject is authenticated as an individual. An associated enrollment system is also provided.

Description

Technical Field

[0001] (Cross - Reference to Related Applications) This patent application claims the benefit of U.S. Provisional Patent Application No. 63 / 058,330, filed Jul. 29, 2020, and U.S. Provisional Patent Application No. 62 / 945,590, filed Dec. 9, 2019. These applications are hereby incorporated by reference in their entirety.

[0002] The present invention relates to biometric authentication, and more specifically, to privacy - preserving biometric authentication.

Background Art

[0003] Biometric-based authentication offers a powerful function in today's digital world. It allows people to securely authenticate themselves using biometrics without needing to remember complex passwords or carry hardware tokens. During enrollment or registration, an individual's biometrics are captured, and a biometric template is stored. (Biometric templates can be created from biometric data, for example, by using algorithms involving feature extraction, or by using machine learning or computer vision algorithms.) Then, during subsequent authentication, the target biometrics are compared or matched against the captured and stored biometric or biometric template. However, this approach presents significant security and privacy issues. For example, in traditional biometric matching, the system must have access to the template in plaintext to invoke the matching algorithm, which exposes vulnerabilities that allow attackers to steal templates or compromise databases, similar to how attackers compromise password databases, and obtain users' biometric data or other sensitive information. The damage is even greater in the case of biometrics because users cannot reset them. Fingerprints cannot be reset like passwords. Biometrics are stored either centrally or locally. When biometrics are stored in one or more centralized databases, these databases become honeypots that hackers can target. Even when biometrics are stored locally, such as on each user's device like an iPhone, there are additional disadvantages, including the fact that if a user loses their device, the biometrics they enrolled there are stored on the lost device, and therefore, authentication can no longer be performed because there are no stored biometrics available for matching.

[0004] Today's "multi-party computation" or "MPC" techniques, when applied to biometrics, still require that biometric templates from enrollment be stored on the server. During authentication, the target biometric template on the client is compared to the biometric template on the server using multi-party computation, and the server and client perform MPC to calculate a matching score between the two templates. While this technique avoids the exchange of biometric templates between parties (as occurs in classical biometric authentication), this approach does not preserve privacy, for example, because both the server and client learn this matching score. Existing approaches using MPC are inefficient and cannot handle millions of users. For example, some approaches require excessive computation (e.g., several seconds per user per authentication), others require excessive communication (sometimes involving tens or even hundreds of steps, with >10MB exchanged per user per authentication), and others have vulnerable security models (e.g., insecure with respect to one or more actively malicious servers). Many such approaches require the server to store biometric templates in plain text, just as with traditional biometric authentication. One approach shards the data between the client and the server, which prevents a single point of failure on the server, but this introduces the requirement that the same client device be used for future authentication, as shards or multiple shards stored by the client device will be required for future authentication. Thus, this approach shares the limitations of locally stored biometric authentication, as loss of the client device implies loss of the certificate and the ability to authenticate. [Overview of the Initiative] [Means for solving the problem]

[0005] Overview of the Embodiment This application describes a privacy preservation approach for user authentication that represents a significant improvement over prior art.

[0006] According to one embodiment of the present invention, a method is provided for authenticating a subject as an individual using biometric data, with the biometric data having been previously acquired, using a first transducer. The method utilizes a computer process which includes the step of generating shards from digital electronic signals, which are provided as output of a second transducer, and such signals are characterized for the biometrics of the subject. The computer process also includes the step of causing the generated shards to be distributed to an array of servers so that the array of servers can store the generated shards and deploy information related to the authentication of the subject. The computer process further includes the step of processing the information deployed by the array of servers and generating an output value indicating whether the subject is authenticated as an individual.

[0007] Optionally, the computer process is performed by a computing entity configured to restrict information sharing to a set of information items selected from a group consisting of output values, digital electronic signals, individual biometric data, target biometrics, generated shards, and combinations thereof. Optionally, the computer process further includes a step of encoding the digital electronic signals so that the generated shards are also encoded. Alternatively, or in addition, the encoding step includes a step of using a neural network. Alternatively, or in addition, the encoding step includes a step of representing the digital electronic signals as a set of vectors in metric space. Alternatively, or in addition, the step of performing a data exchange process using a subset of the generated shards and unfolding information related to the authentication of the target includes a step of calculating a set of distances in metric space.

[0008] Optionally, the data exchange process includes multi-party computation, provided that none of the servers in the server array obtain an intermediate value for the multi-party computation. Optionally, a selected group of servers in the array generates new shards based on the generated shards. Optionally, shards can be invalidated by an invalidation process, which includes the data exchange process. Alternatively, or in addition, in response to shard invalidation, the generation of new shards does not require the individual to re-engage with the first transducer. Alternatively, or in addition, the invalidation process is configured in a manner that does not involve communication between the server array and other computing entities. Alternatively, or in addition, the invalidation process includes a step of performing the data exchange process using a subset of the subset of generated shards from a subset of the server array. Alternatively, or in addition, the data exchange process involves communication between a selected group of servers from the server array. Alternatively, or in addition, the steps of performing the data exchange process include, by each server, separately processing its generated shards for an individual together with its generated shards for a target, and generating a new set of shards, the new set of shards constituting an output value. Alternatively, or in addition, the data exchange process includes, having an array of servers run a multi-party calculation algorithm to determine a blinded value; having an array of servers calculate the corresponding shards and returning the calculated shards to a computing entity along with a previously calculated value relating to a message authentication code; and having the computing entity use the shard data to determine whether the target is authenticated as an individual and to evaluate the message authentication code.

[0009] Optionally, the step of receiving and storing generated shards by an array of servers includes receiving and storing a message authentication code for the shard, and the data exchange process includes using the message authentication code to verify that the output value itself is authentic, indicating whether the subject is authenticated as an individual. Optionally, the step of receiving and storing generated shards by an array of servers includes receiving and storing shards of Beaver triples distributed across the array of servers along with the generated shards. Alternatively, or in addition, the step of receiving and storing generated shards by an array of servers includes receiving and storing a message authentication code for the Beaver triple. Alternatively, or in addition, the step of receiving and storing generated shards by an array of servers includes receiving and storing a shard of the corresponding message authentication code key.

[0010] Optionally, the step of receiving and storing generated shards by the server array includes the step of receiving and storing random value shards. Optionally, the step of receiving and storing generated shards by the server array includes the step of receiving and storing function shards that contribute to the authentication process. Optionally, the step of receiving and storing generated shards by the server array includes the step of extracting a confidence subset of the set of target biometric values ​​in a digital electronic signal. Optionally, the step of receiving and storing a set of values ​​by the server array to enable efficient subsequent generation of shards includes the step of receiving and storing items selected from a group consisting of Beaver triples, authentication shares, message authentication code shards, random shards, other shards, and combinations thereof.

[0011] According to another embodiment of the present invention, a system is provided for authenticating a subject as an individual using biometric data, the biometric data of which has been previously acquired, using a first transducer coupled to a first computing facility. The system has a computing component, which includes a second transducer having a digital electronic signal output for characterizing the biometrics of the subject. The computing component also includes a second computing facility, which is coupled to a second transducer configured to receive the digital electronic signal from the second transducer. The computing component further includes an array of servers and a third computing facility. The second computing facility, the array of servers, the third computing facility, and an instruction-encoded computer-readable medium establish a computer process, which, in response to execution by the aforementioned computing component, causes the second computing facility to generate shards from the digital electronic signal and distribute the generated shards to the array of servers. The computer process also includes the step of the array of servers receiving and storing the generated shards. The computer process further includes the step of a data exchange process, which uses a subset of the array of servers to deploy information related to the authentication of a subject using the generated shards. The computer process also includes the step of transmitting deployed information to a third computing facility by a subset of the server array, wherein the deployed information is configured to cause the third computing facility to generate an output value indicating whether the subject is authenticated as an individual.

[0012] Optionally, the computer process is performed under the condition that the computing components are configured to restrict information sharing to items of information selected from a group consisting of output values, digital electronic signals, individual biometric data, target biometrics, and generated shards. Optionally, the computer process is performed under the condition that the computing components are configured to restrict information sharing to multiple items of information selected from a group consisting of output values, digital electronic signals, individual biometric data, target biometrics, and generated shards.

[0013] Optionally, the steps brought about by the second computing equipment further include the steps of bringing about the encoding of digital electronic signals so that the generated shards are also encoded. Alternatively, or in addition, the steps of bringing about the encoding include the steps of bringing about the use of a neural network to achieve the encoding. Alternatively, or in addition, the steps of bringing about the encoding include the steps of bringing about the representation of the digital electronic signals as a set of vectors in metric space. Alternatively, or in addition, the steps of performing a data exchange process using a subset of the generated shards and deploying information related to the authentication of the subject include the steps of calculating a set of distances in metric space. Optionally, the data exchange process includes multi-party computation in which none of the servers in the server array obtain an intermediate value of the multi-party computation. Optionally, a selected group of servers in the array of servers brings about the generation of new shards based on the generated shards.

[0014] Optionally, a shard can be deactivated by a deactivation process that includes a data exchange process. Alternatively, or in addition, in response to the deactivation of a shard, the generation of a new shard does not require the individual to re-engage with the first transducer. Alternatively, or in addition, the deactivation process does not require communication between the computing equipment and the array of servers. Alternatively, or in addition, the deactivation process includes the step of performing a data exchange process using a subset of a subset of generated shards from a subset of a subset of the array of servers. Alternatively, or in addition, the data exchange process involves communication between a selected group of servers from the array of servers. Alternatively, or in addition, the step of performing a data exchange process includes the step of each server separately processing its generated shards of an individual together with its generated shards of the target, and generating a new set of shards, the new set of shards constituting an output value.

[0015] Optionally, the step of receiving and storing generated shards by an array of servers includes a step of receiving and storing a message authentication code for the shard, and the data exchange process includes a step of using the message authentication code to verify that the output value itself is authentic, indicating whether the subject is authenticated as an individual. Alternatively, or in addition, the step of receiving and storing generated shards by an array of servers includes a step of receiving and storing shards of Beaver triples distributed across the array of servers along with the generated shards. Alternatively, or in addition, the step of receiving and storing generated shards by an array of servers includes a step of receiving and storing a message authentication code for the Beaver triple. Alternatively, or in addition, the step of receiving and storing generated shards by an array of servers includes a step of receiving and storing shards of the corresponding message authentication code key.

[0016] Optionally, the step of receiving and storing generated shards by the array of servers includes the step of receiving and storing random value shards. Optionally, the step of receiving and storing generated shards by the array of servers includes the step of receiving and storing function shards that contribute to the authentication process. Alternatively, or in addition, the step of receiving and storing generated shards by the array of servers includes the step of extracting a confidence subset of the set of biometric values ​​of the subject in the digital electronic signal. Alternatively, or in addition, the data exchange process includes the steps of causing the array of servers to run a multi-party calculation algorithm to determine blinded values, causing the array of servers to calculate the corresponding shards and returning the calculated shards to a second computing facility along with values ​​relating to a previously calculated message authentication code, and causing the second computing facility to use the shard data to determine whether the subject is authenticated as an individual and to evaluate the message authentication code. Alternatively, or in addition, the step of receiving and storing a set of values ​​by an array of servers and enabling efficient subsequent generation of shards includes receiving and storing items selected from a group consisting of Beaver triples, authenticated shares, message authentication code shards, random shards, other shards, and combinations thereof.

[0017] According to one embodiment of the present invention, a system is provided for securely enrolling the biometric data of an individual for the purpose of subsequent authentication of the individual. The system has a component including a first transducer having a digital electronic signal output for characterizing the biometrics of the individual. The component also includes a first computing facility coupled to the first transducer, configured to receive the digital electronic signal from the first transducer. The component further includes an array of servers and a second computing facility. The first computing facility, the array of servers, the second computing facility, and a computer-readable medium encoded with instructions establish a computer process that, in response to execution by the aforementioned computing component, results in the generation of original shards from the digital electronic signal. The computer process further includes the step of distributing the generated original shards across the array of servers. The computer process also includes the step of having the array of servers store the generated original shards. The generated original shards are stored under the condition that the generated original shards are invalidable.

[0018] Optionally, a first computing facility, an array of servers, and a second computing facility are configured to implement a computer process, which further includes the step of generating new shards based on the original shards. Alternatively, or in addition, the step of generating new shards does not require communication between the first computing facility and the array of servers. Optionally, a computer process implemented by the first computing facility, the array of servers, and the second computing facility further includes the step of distributing the generated original shards across the array of servers, along with helper information selected from a group consisting of Beaver triples, functional secret sharing, and combinations thereof, wherein such helper information is available for use in subsequent authentication of the subject, and the step of causing the array of servers to store the helper information associated with the generated original shards.

[0019] According to one embodiment of the present invention, a system is provided for securely enrolling the biometric data of an individual for the purpose of subsequent authentication of the individual, the system having a computing component that includes a first transducer having a digital electronic signal output for characterizing the biometrics of the individual. The computing component also includes a first computing facility coupled to the first transducer, configured to receive a digital electronic signal from the first transducer. The computing component further includes an array of servers and a second computing facility. The first computing facility, the array of servers, the second computing facility, and a computer-readable medium encoded with instructions establish a computer process that, in response to execution by the aforementioned computing component, results in the generation of original shards from the digital electronic signals. The computer process also includes the step of distributing the generated original shards across the array of servers. The computer process further includes the step of storing the generated original shards in the array of servers. The computer process also includes the step of generating new shards based on the original shards.

[0020] The step of optionally generating a new shard does not require communication between the first computing facility and the server array. This specification also provides, for example, the following items: (Item 1) A method for authenticating a subject as an individual from which biometric data has been previously acquired, using a first converter, wherein the method is: The method involves generating a shard from a digital electronic signal, provided as the output of a second converter, wherein such signal characterizes the biometric of the subject, Distributing the generated shards across the server array so that the server array can store the generated shards, use a subset of the generated shards to perform a data exchange process, and deploy the authentication-related information for the target, The process involves processing the information unpacked by the array of the server and generating an output value indicating whether the target is authenticated as the individual. A method that utilizes a computer process that includes [a specific component / process]. (Item 2) The method according to item 1, wherein the computer process is performed by a computing entity configured to restrict information sharing to a set of information items selected from a group consisting of the output value, the digital electronic signal, the biometric data of the individual, the biometrics of the target, the generated shard, and combinations thereof. (Item 3) The method according to item 1, wherein the computer process further comprises encoding the digital electronic signals such that the generated shards are also encoded. (Item 4) The encoding described above is the method described in item 3, which includes using a neural network. (Item 5) The method according to item 3, wherein the encoding includes representing the digital electronic signal as a set of vectors in metric space. (Item 6) The method of item 5, wherein performing the data exchange process using the generated subset of shards and deploying the authentication-related information for the subject includes calculating a set of distances in the metric space. (Item 7) The method according to item 1, wherein the data exchange process includes the multi-party calculation, provided that none of the servers in the server array obtain an intermediate value for the multi-party calculation. (Item 8) The method according to item 1, wherein a selected group of the server array causes the generation of new shards based on the generated shards. (Item 9) The method according to item 1, wherein the shard can be deactivated by a deactivation process that includes the data exchange process. (Item 10) The method according to item 9, wherein, in response to the invalidation of the shard, the generation of a new shard does not require the individual to engage with the first converter again. (Item 11) The method according to item 9, wherein the deactivation process is configured in a manner that does not involve communication between the array of servers and other computing entities. (Item 12) The method according to item 9, wherein the invalidation process includes performing the data exchange process using a subset of the subset of the generated shards from a subset of the array of servers. (Item 13) The data exchange process is as described in item 12, wherein the data exchange process involves communication between a selected group of servers from the array of servers. (Item 14) The method according to item 12, wherein performing the data exchange process involves each server separately processing the generated shards of the individual together with the generated shards of the target, and generating a new set of shards, the new set of shards comprising the output values. (Item 15) The method according to item 1, wherein the array of servers receives and stores the generated shards, which includes receiving and storing a message authentication code relating to the shards, and the data exchange process includes using the message authentication code to verify that the output value itself, which indicates whether the subject is authenticated as the individual, is authentic. (Item 16) The method according to item 1, wherein the array of servers receives and stores the generated shards, and includes receiving and storing Beaver triple shards distributed across the array of servers together with the generated shards. (Item 17) The method of item 16, wherein the array of servers receives and stores the generated shards, which includes receiving and storing message authentication codes relating to the Beaver triple. (Item 18) The method according to item 17, wherein the array of servers receives and stores the generated shards, which includes receiving and storing shards of the corresponding message authentication code keys. (Item 19) The method according to item 1, wherein the array of servers receives and stores the generated shards, which includes receiving and storing shards of random values. (Item 20) The method according to item 1, wherein the array of servers receives and stores the generated shards, which includes receiving and storing shards of functions that contribute to the authentication process. (Item 21) The method according to item 1, wherein the array of servers receives and stores the generated shards, and includes extracting a certain subset of the set of target biometric values ​​in the digital electronic signals. (Item 22) The method according to item 1, wherein the array of servers receives and stores a set of values ​​and enables efficient subsequent generation of shards, the receiving and storing of items selected from a group consisting of Beaver triples, authentication shares, message authentication code shards, random shards, other shards, and combinations thereof. (Item 23) The method of item 17, wherein the data exchange process includes causing the array of servers to execute a multi-party calculation algorithm to determine a blinded value; causing the array of servers to calculate a corresponding shard; returning the calculated shard to the computing entity along with a previously calculated value relating to the message authentication code; and causing the computing entity to use the shard data to determine whether the subject is authenticated as the individual and to evaluate the message authentication code. (Item 24) A system for authenticating a subject as an individual from which biometric data has been previously acquired, using a first converter coupled to a first computing facility, wherein the system Computing components, A second converter having a digital electronic signal output for characterizing the biometric of the subject, A second computing device coupled to the second converter, which is configured to receive the digital electronic signal from the second converter, A server array and The third computing facility and Computing components equipped with It has, The second computing equipment, the server array, the third computing equipment, and the computer-readable media encoded with instructions are, in accordance with the execution by the computing components, The second computing equipment generates shards from the digital electronic signals and distributes the generated shards to the server array, The array of the server receives and stores the generated shards, Using a subset of the server array, the generated subset of shards is used to perform a data exchange process and deploy the authentication-related information for the target. A subset of the server array transmits the expanded information to a third computing facility, wherein the expanded information is configured to cause the third computing facility to generate an output value indicating whether the target is authenticated as the individual. A system that establishes computer processes, including those involved. (Item 25) The system according to item 24, wherein the computer process is performed under the condition that the computing components are configured to share information with respect to a set of information items selected from a group consisting of the output values, the digital electronic signals, the biometric data of the individual, the biometrics of the subject, and the generated shards. (Item 26) The system according to item 24, wherein the second computing equipment further comprises causing the encoding of the digital electronic signals such that the generated shards are also encoded. (Item 27) The system described in item 26, wherein producing the encoding involves the use of a neural network to achieve the encoding. (Item 28) The system described in item 26, wherein encoding involves generating the representation of the digital electronic signal as a set of vectors in metric space. (Item 29) The system described in item 28, which uses the generated subset of shards to perform the data exchange process and deploy the information related to the authentication of the subject, including calculating a set of distances in the metric space. (Item 30) The system described in item 24, wherein the data exchange process includes multi-party calculation, in which none of the servers in the server array obtains an intermediate value for multi-party calculation. (Item 31) The selected group of the server array causes the generation of new shards based on the generated shards, as described in item 24. (Item 32) The system described in item 24 is deactivatable by a deactivation process that includes the data exchange process. (Item 33) The system according to item 32, wherein the generation of a new shard in response to the invalidation of the shard does not require the individual to engage with the first converter again. (Item 34) The system according to item 32, wherein the deactivation process does not require communication between the computing equipment and the server array. (Item 35) The system according to item 32, wherein the invalidation process includes performing the data exchange process using a subset of the subset of the generated shards from a subset of the array of servers. (Item 36) The data exchange process is the system described in item 24, which involves communication between a selected group of servers from the array of servers. (Item 37) The system according to item 24, wherein each server separately processes the generated shards of the individual together with the generated shards of the target, and generates a new set of shards, the new set of shards comprising the output values. (Item 38) The system according to item 24, wherein the array of servers receiving and storing the generated shards includes receiving and storing message authentication codes relating to the shards, and the data exchange process includes using the message authentication codes to verify that the output value itself, which indicates whether the subject is authenticated as the individual, is authentic. (Item 39) The system according to item 24, wherein the array of servers receives and stores the generated shards, and this includes receiving and storing Beaver triple shards distributed across the array of servers together with the generated shards. (Item 40) The system described in item 39, wherein the array of servers receives and stores the generated shards, which includes receiving and storing message authentication codes relating to the Beaver triple. (Item 41) The system described in item 24, wherein the array of servers receives and stores the generated shards, which includes receiving and storing shards of the corresponding message authentication code keys. (Item 42) The system described in item 24, wherein the array of servers receives and stores the generated shards, which includes receiving and storing shards of random values. (Item 43) The system described in item 24, wherein the array of servers receives and stores the generated shards, which includes receiving and storing shards of functions that contribute to the authentication process. (Item 44) The system according to item 24, wherein the array of servers receives and stores the generated shards, and includes extracting a certain subset of the set of target biometric values ​​in the digital electronic signals. (Item 45) The method according to item 24, wherein the array of servers receives and stores a set of values ​​and enables efficient subsequent generation of shards, which includes receiving and storing items selected from a group consisting of Beaver triples, authentication shares, message authentication code shards, random shards, other shards, and combinations thereof. (Item 46) The system according to item 38, wherein the data exchange process includes causing the array of servers to execute a multi-party calculation algorithm to determine a blinded value, causing the array of servers to calculate a corresponding shard, returning the calculated shard to the second computing facility along with a previously calculated value relating to the message authentication code, and causing the second computing facility to use the shard data to determine whether the target is authenticated as the individual, and to evaluate the message authentication code. (Item 47) A system for securely enrolling an individual's biometric data for the purpose of subsequent authentication of the individual, wherein the system is Computing components, A first transducer having a digital electronic signal output for characterizing the biometrics of the individual, A first computing device coupled to the first converter, which is configured to receive the digital electronic signal from the first converter, A server array and Second computing facility and Computing components equipped with It has, The first computing equipment, the server array, the second computing equipment, and the computer-readable medium encoded with instructions are used in accordance with the execution performed by the computing components. This causes the generation of the original shard from the aforementioned digital electronic signal, Distributing the generated original shards across the array of servers, The array of the aforementioned servers is to store the generated original shards. Establish a computer process that includes, The generated original shard is stored under the condition that the generated original shard can be invalidated. system. (Item 48) The first computing equipment, the server array, and the second computing equipment are, The system described in item 47, configured to implement a computer process that further includes generating a new shard based on the original shard. (Item 49) The system described in item 48, wherein generating the new shard does not require communication between the first computing equipment and the server array. (Item 50) In the computer process implemented by the first computing facility, the server array, and the second computing facility, distributing the generated original shards across the server array is further: The generated original shard is distributed across the server array along with helper information selected from a group consisting of Beaver triples, functional secret sharing, and combinations thereof, wherein such helper information is available for use in subsequent authentication of the target. The array of the server is to store the helper information associated with the generated original shard. The system described in item 47, including the system described in item 47. (Item 51) A system for securely enrolling an individual's biometric data for the purpose of subsequent authentication of the individual, wherein the system is Computing components, A first converter having a digital electronic signal output for characterizing the biometrics of the individual, A first computing facility, wherein the first computing facility is coupled to a first converter configured to receive the digital electronic signal from the first converter, A server array and Second computing facility and Computing components equipped with It has, The first computing equipment, the server array, the second computing equipment, and the computer-readable medium encoded with instructions are used in accordance with the execution performed by the computing components. This causes the generation of the original shard from the aforementioned digital electronic signal, Distributing the generated original shards across the array of servers, The array of the aforementioned servers is used to store the generated original shards, Based on the aforementioned original shard, a new shard is generated. A system that establishes computer processes, including those involved. (Item 52) The system according to item 51, wherein generating the new shard does not require communication between the first computing equipment and the server array. [Brief explanation of the drawing]

[0021] The aforementioned features of the embodiment will be more readily understood by referring to the following detailed description, which will be examined with reference to the accompanying drawings.

[0022] [Figure 1A] Figure 1A is a block diagram of a computer system for performing enrollment and authentication according to one embodiment of the present invention.

[0023] [Figure 1B] Figure 1B is a block diagram of another computer system for performing enrollment and authentication according to one embodiment of the present invention.

[0024] [Figure 1C] Figures 1C and 1D are block diagrams illustrating, respectively, communication paths for enrollment and authentication within a computer system using n servers, according to one embodiment of the present invention. [Figure 1D] Figures 1C and 1D are block diagrams illustrating, respectively, communication paths for enrollment and authentication within a computer system using n servers, according to one embodiment of the present invention.

[0025] [Figure 2] Figure 2 is a schematic diagram of a logical flow illustrating how encryption of shards distributed across servers during the enrollment process is achieved by a first biometric computer system according to one embodiment of the present invention.

[0026] [Figure 3] Figure 3 is a schematic diagram of the logical flow in authentication when the shard is encrypted according to the process described in relation to Figure 2.

[0027] [Figure 4] Figure 4 is a schematic diagram of the logical flow of the enrollment process according to one embodiment of the present invention.

[0028] [Figure 5] Figure 5 is a schematic diagram of the logical flow of the authentication process according to an embodiment of the present invention.

[0029] [Figure 6] Figure 6 is a schematic diagram of the logical flow of the authentication process according to another related embodiment of the present invention. [Modes for carrying out the invention]

[0030] Detailed description of specific embodiments Definitions. As used in this description and accompanying claims, the following terms shall have the meanings shown unless otherwise required by context. A "set" contains at least one belonging element. A "subset" includes a part of the whole. A "server array" is a group of servers. A computing component system is configured to be "information sharing restricted" with respect to information items when information items are handled by a given component, and the given component is prevented from sharing the information with at least one other component of the system. For the purposes of this definition, an array of servers is considered a single component. A “computer process” is the implementation of a described function within a computer system using computer hardware (such as a processor, field-programmable gate array, or other electronic combination logic, or similar device) that operates under the control of software or firmware, or a combination thereof, or may operate outside of any of the aforementioned controls. All or part of the described function may be implemented by active or passive electronic components, such as transistors or resistors. The use of the term “computer process” does not necessarily require the operation of a schedulable entity or computer program or part thereof; however, in some embodiments, a computer process may be implemented by the operation of such a schedulable entity or computer program or part thereof. Furthermore, unless otherwise required by context, a “process” may be implemented using one or more processors or one or more (single or multiprocessor) computers. "Individual" refers to a living or non-living object that has a unique identification, and may be a human being or other living organism. "Object" refers to a living or non-living object that claims to have a unique individual identification. "Biometrics" are measurable characteristics of distinctly different individuals or groups of distinctly different individuals, or combinations of such characteristics, that can be used to determine the unique identification of an individual or group. Some non-limiting embodiments of such measurable organic characteristics are an individual's iris pattern, periocular region of the face, retinal vascular pattern, fingerprint, genetic pattern or DNA fingerprint, voiceprint, type speed or frequency, blood flow pattern, brain structure or electrical pattern, behavioral signals (such as hand movements), expertise-based sustained biometrics, and gait. An embodiment of a measurable inorganic characteristic is a random variation in transistor gate delay resulting from the process of manufacturing distinctly different silicon wafers, when the individuals are distinctly different silicon wafers having transistors, and such "silicon biometrics" are detectable using a ring oscillator, as is known in the art. A "biometric value" is a categorization of a part of a biometric measurement according to the nature of the measurement. For example, if the biometric is the iris and the measurement consists of imaging the iris as an array of pixels, then the relevant part of the measurement is a single pixel in the image, and the relevant property could be the brightness or color of the pixel to be categorized. A measurement of a biometric as a whole may include many biometric values. A "confidence score for a biometric value," or simply a "confidence score," is a number that indicates the relative confidence that the corresponding biometric value has been correctly categorized. A “confidence subset” of biometric data is a set of biometric values ​​selected according to their individual confidence values, which are (a) large enough to uniquely identify an individual within a given number of identifiable individuals, and (b) small enough to be repeatedly obtainable across corresponding biometric measurements under different conditions. A "converter" is any device that has an electronic signal as its output, which encodes a biometric characterization as a set of measured biometric values. If the output of such a device is not directly digital, the term "converter" also includes any device used to convert the output into a digital form. "Computing equipment" means an electronic system having components including a computing processor and memory for storing instructions that can be executed by the computing processor. Computing equipment can be found, for example, in desktop computers, smartphones, tablet computers, wearables, smartwatches, and similar electronic devices. Computing equipment can also be found in built-in computing systems that perform special calculations, such as point-of-sale machines, automated teller machines (ATMs), physical access barriers, video display kiosks, and similar electronic devices. A value, when viewed in isolation, reveals nothing about the value itself, but when combined, reveals the value. It is called "sharding" when it is transformed into individual components. For example, x can be arithmetically sharded into [x]1 and [x]2, as follows: [x] 1 = r mod p [x]²=xr mod p In the equation, r is a random integer and p is a large prime number. We have x = [x]1 + [x]2, and it can be seen that [x]1 and [x]2 are both random (because r is random). This approach to sharding (i.e., arithmetic sharding) produces only one of several shard types, including, for example, Shamir shards, i.e., polynomial interpolation, bitwise XOR shards, linear shards, function sharing, etc. The processes listed as including "encoding and extraction into shards" may be performed in any order, namely, in a first order in which encoding precedes extraction into shards, or in a second order in which extraction into shards precedes encoding. As illustrated herein, a “shard” does not necessarily have to be secret. Depending on the context, a shard may or may not be secret. 1. Transformation of biometric data

[0031] Embodiments of the present invention provide computer systems and methods for transforming biometric data into a form that allows its indirect use for purposes including authentication, while protecting its privacy. These embodiments are discussed below.

[0032] Figure 1A is a block diagram of a computer system for enrollment and authentication according to one embodiment of the present invention. Figure 1A shows an individual (user) 103, a target (user) 106, and at least two servers 101, 102 that constitute an array of servers. Individual 103 uses a mobile phone accompanied by software called a client 104, which is software (in this case written in Javascript®) that is launched on a web browser, and which in turn is launched on the individual's mobile phone. In the embodiment of Figure 1A, client 104 has access to the camera on the mobile phone to take a photograph of the individual's face. Client 104 interacts with user 103 and, on behalf of user 103, with other entities as well.

[0033] The target (user) 106 uses different devices (client 107), such as different mobile phones, laptops, and kiosks. This device also launches client software.

[0034] In the embodiment shown in Figure 1A, Server 1, shown as Item 101, is implemented in Go and deployed using Kubernetes within the Google Cloud Platform (for example, in the central United States). Server 101 has a Postgres database that stores encoded shards used within the process. In addition to launching a set of programs that have an Application Programming Interface (API) to communicate with Server 2, shown as Item 102, the set of programs launched on Server 101 also has an API for communicating with Client 104. These APIs for communicating with Client 104 include, for example, APIs for enrollment, authentication, and signing.

[0035] In the embodiment shown in Figure 1A, Server 2, indicated as Item 102, is implemented in Python and deployed within Amazon AWS (for example, in East Europe). In this embodiment, Server 102 has a MySQL database that stores encoded shards used within the process. Server 102 has an API similar to that of Server 101, except that it is written in Python on the server side.

[0036] In the embodiment shown in Figure 1A, the series of processes are implemented as follows.

[0037] First, the enrollment process is initiated (by individual 103 or by another party). In this process, client 104 requests individual 103 to take a photograph of its face, and individual 103 takes such a photograph. Survival detection is used on the image of the individual's face in the photograph.

[0038] Next, during the enrollment process, client 104 creates an enrollment shard using the captured image of the individual's face and sends the enrollment shard to servers 101 and 102, which then store the enrollment shard.

[0039] After enrollment, the authentication process is initiated (by Subject 106 or another party). During the authentication process, Subject Client 107 requests Subject 106 to take a photograph of Subject 106's face, and Subject 106 takes such a photograph.

[0040] Next, in the authentication process, the target client 107 creates an authentication shard using the captured image of the target's face, and sends the authentication shard to servers 101 and 102, which then store the authentication shard.

[0041] During the data exchange process of the authentication process, servers 101 and 102 communicate with each other regarding the stored shards, unpacking information related to the authentication of the target, and each server 101 and 102 sends the communication to the target client 107. Upon receiving the communication, the target client 107 can then determine whether target 106 has been successfully authenticated as individual 103. The target client can determine whether target 106 has been successfully authenticated without having to know information about individual 103 to which target 106 was enrolled.

[0042] In the embodiment shown in Figure 1A, for example, neither server 101 nor 102 knows whether target 106 has been successfully authenticated as individual 103; that is, neither server 101, 102, nor the target client 107 gains access to the individual's biometric template (i.e., the individual's facial image), and neither server 101 nor 102 gains access to the target's biometric template (i.e., the target's facial image), thus preserving privacy.

[0043] The embodiment in Figure 1A is also invalid, for example, because the shards stored by servers 101 and 102 are invalid. If a malicious target 106 compromises the target client 107 and compromises all but one server, this embodiment prevents the malicious target 106 from accessing information related to individual 103. In the event of such compromise, this embodiment can invalidate the certificate of individual 103 (which may contain shards on servers 101 and 102), and a new certificate can be issued for individual 103. In some embodiments, the issuance of a new shard may occur without the individual's involvement. Therefore, if an external adversary is able to compromise all but one server, this adversary still knows nothing about individual 103, and the certificate of individual 103 can be invalidated, and a new certificate can be issued without individual 103.

[0044] In one embodiment shown in Figure 1A, five sets of shards are generated during the enrollment process. Each server 101, 102 receives one of the five sets of shards. During each authentication process, one of the sets of shards is destroyed. In this embodiment, if the authentication process is successful, a new set of shards is generated and distributed using steps similar to the enrollment process.

[0045] This embodiment optionally includes processes for handling cases where one or more servers in a server array are down, in use, offline, or otherwise unavailable. An exemplary process may include, for example, creating redundancy by creating multiple copies of each server. Another exemplary process may include performing sharding using techniques such as Shamir sharding, where only a certain threshold number of shards are required, such as n shards out of m shards. In such a process, authentication is possible even when one or more servers with shards are not involved in the authentication process. If one or more servers in a server array become unavailable, enrollment and authentication operations can be performed using a subset of servers in the array. The determination of the subset of servers for such operations may be based on a combination of one or more conditions, including, for example, online status, availability, compromise conditions, capacity, location, authorization status, and security groups.

[0046] The embodiment in Figure 1A also addresses concerns of catastrophic certificate loss, which may include, for example, a case where a subject loses their password or token and an account reset is required. Account reset processes can be costly, such as involving expensive cost centers, or because the user fails to complete the transaction. Current account reset processes do not preserve privacy, for example, because they may have a central database of user information and use knowledge-based authentication (KBAs) by default, which may include asking the user questions about their favorite sports team or a car they used to own in order to reset their account. This embodiment addresses catastrophic certificate loss by, for example, not requiring account access to remember a password or possess a token, thereby avoiding situations that require a reset due to a lost password or lost token.

[0047] In one embodiment, viability detection is used to ensure that biometrics are obtained from a real person. In one embodiment, viability detection includes taking photographs of the face while illuminating the face from different angles. In another embodiment, a neural network is used, which is trained to detect differences between photographs of real people and images of screens or photographs of photographs. In one embodiment, an infrared camera is used in conjunction with an optical camera. In one embodiment, a sensor detects a range of conditions, such as respiration, pulse, or depth between fingerprint ridges. In one embodiment, the individual must participate in viability detection by turning their head, uttering a certain phrase, or clicking a button. In one embodiment, the viability indication is part of a digital electronic signal. In another embodiment, the viability indication is contained within a shard.

[0048] In some embodiments, the invalidation process does not require the creation of a new shard. For example, regulations, including the General Data Protection Regulation (GDPR), include the right to be forgotten or the right of an individual to have their personal data erased. The ability of some embodiments to implement invalidation enables the right to be forgotten even in the case of server breach and shard compromise.

[0049] In some embodiments, the invalidation process renders one or more shards useless for future authentication. In one embodiment, if a client and all but one server are compromised, the adversary may know nothing, the individual certificates may be invalidated, and new certificates may be issued. In one embodiment, a shard is a certificate. In one embodiment, if a shard is exposed (by breach, or by other compromise, etc.), the shard may be invalidated and reissued. In one embodiment, a certificate is a subset of shards. In one embodiment, a certificate is an encoded version of biometric data. In one embodiment, a certificate is a vector resulting from a neural network. In one embodiment, a certificate is a biometric template. In one embodiment, issuing a new certificate does not require individual users. In one embodiment, the system in Figure 1A is configured so that individual users request the issuance of new certificates. In another embodiment, individual users are requested to issue replacement shards. In one embodiment, useless shards are called canceled.

[0050] In one embodiment, the server array consists of five servers, each having a unique shard, and one of the servers is compromised. In one embodiment, all five servers do not need to be involved in disabling the compromised shard. Several exemplary methods exist for disabling the compromised shard, as follows (non-exclusive list):

[0051] In one embodiment, a subset of five servers in an array (e.g., three) can cause the generation of new shards. The three new shards work together with the original shards of the remaining two servers. The authentication utility of the three original shards from the three servers in the subset is revoked from the authentication process. For example, if one of the three original shards is compromised, the compromised shard is no longer useful in determining the success of future authentication attempts, and the system's security posture reverts to what it was before the compromise of one server.

[0052] In another example, the generation of three new shards by three servers in a subset negates the usefulness of the remaining two original shards from the other two servers in the five-server array.

[0053] In another embodiment, one server in the array deletes its shard, and that action revokes the usability of all remaining shards held by the other servers in the array.

[0054] In the field of sharding, it is true that one or more (but not all) compromised shards do not compromise an individual's biometrics. In the prior art, compromised shards are persistent security vulnerabilities; that is, they retain their usefulness for the authentication process. Therefore, the security model becomes more vulnerable with each compromised shard. However, in embodiments of the present invention, the ability to neutralize (disable the compromised shards) enables the restoration of the security posture because the usefulness of the compromised shards can be revoked.

[0055] Assume that biometrics are sharded into five shards, and that the compromise of three of the five shards will compromise biometrics. In the prior art, if one shard is compromised, only two more shards would need to be compromised to compromise biometrics. However, in embodiments of the present invention, the disabling capability enables the restoration of the security posture because the usefulness of the compromised shards can be revoked (i.e., three shards must be compromised to compromise biometrics). Various embodiments allow shards to be compromised uniquely without the compromise resulting in a persistent compromise of the system's security. The disabling capability limits the timeframe in which an adversary could attempt to use the compromised shards, thereby reducing the attack surface. Since the disabling process can be performed by the server without client involvement, disabling can be carried out very efficiently.

[0056] Figure 1B is a block diagram of another computer system for performing enrollment and authentication according to one embodiment of the present invention. Using the system in Figure 1B, a certificate user 140 authenticates a user (individual 133, subject 135). The system of this exemplary embodiment includes the following:

[0057] In one embodiment, the Certificate User (RP) 140 is an enterprise, such as a pharmacy or bank, that desires to authenticate its users in a manner that does not expose them to the risks of breach and reputational damage associated with the compromise of user certificates, in accordance with HIPAA, GDPR, and / or other regulations, and that provides a seamless user experience in line with the enterprise's passwordless, self-sovereign identification, digital identity transformation, non-supervision, non-centralized, and compliance efforts. The enterprise has a website, an online marketplace, or a digital payment gateway. In one embodiment, the website is primarily written in Javascript®, and the RP has MongoDB or other key / value storage that stores a mapping from usernames to the user's public key of a public-private signing key pair.

[0058] Client software (written here in Javascript®) is launched on a web browser, which in turn runs on the user's mobile phone. This software has access to the onboard camera to take a photograph of the user's face. An instance of the software (client 134) interacts with individual 133, which is enrolled in the system, and also with other entities on behalf of individual 133. An instance of the software (client 136) interacts with object 135, which claims to be an individual, and also with other entities on behalf of object 135. We sometimes refer to the “individual client 134” as the first “computing device” when it provides the individual’s biometrics, which are enrolled for later authentication purposes.

[0059] The Badge service 130 encodes data from users (individuals 133 and subjects 135). It also handles cryptographic operations using the derived biometric root private key. In one embodiment, the service 130 is written in C++ and self-hosted by Badge. In one embodiment, each client 134, 136 performs the functions of the Badge service. In another embodiment, the Badge service 130 is hosted by a server. In another embodiment, each client 134, 136 is coupled to the Badge service 130. In another embodiment, the Badge service 130 is contained within clients 134, 136. In another embodiment, the Badge service 130 is not contained within clients 134, 136. In one embodiment, clients 134, 136 are the front-end user interface, and the Badge service 130 is the back-end. In one embodiment, the Badge service 130 performs the encoding and distribution of enrollment and authentication-related information. In one embodiment, the clients and services 134, 136, and 130 are integrated with existing clients such as Windows® Hello or Touch ID, and the servers 111, 112, 115, 121, 122, and 125 are hosted within Azure, AWS, or other cloud platforms.

[0060] The system in Figure 1B includes a cluster of replicas of server software corresponding to Server 1A111, Server 1B, ... In one embodiment, the server software is implemented in Go, deployed using Kubernetes within the Google Cloud Platform, and has a shared Postgres database that stores the encoded shared information of users, which may be based on biometrics and private keys. In addition to launching a set of programs that have APIs for communicating with other servers, each server also launches a set of programs that have APIs for communicating with clients. In one embodiment, these APIs include APIs for enrolling the secret shared information and root private key of an encoded biometric individual and for performing an authentication process that includes this shared and secret shared information of the target encoded biometric.

[0061] The system in Figure 1B also includes another cluster of replicas of the server software, corresponding to servers 2A121, 2B122, ... In this embodiment, the server software is implemented in Python and deployed within Microsoft Azure in Central Europe. The cluster may include replicas of the Python version of the server software and have a shared MySQL database that stores encoded shared information of users, which may be based on biometrics and private keys. This provides an API similar to that of the cluster of servers 1A111, 1B, ... except that it is written in Python on the server side.

[0062] Gateway 1115 is a load balancer (which may be written in Go) that routes traffic between different clients and different replicas to minimize the maximum load on the replicas. In addition, the protocol used in the load balancing embodiment requires that a replica of server 1A111 find the correct replica of server 2A121 that talks to the same client 134. Gateway 115 provides functionality to enable server 1A111 to connect to the correct replica of server 2A121. (In one embodiment, the mapping is dynamic depending on the load balancer; for example, it may dynamically determine that server 1A111 is mapped to server 2G.)

[0063] Gateway 2125 is a load balancer that implements functionality similar to that implemented by Gateway 1115, except that it is written in Python (like Cluster 2).

[0064] In the embodiment shown in Figure 1B, the step in which the relying party 140 authenticates the target user 135 using a series of enrollment processes is implemented as follows.

[0065] Individual 133 is prompted by the signatory 140 to register or create an account.

[0066] Individual 133 clicks the “Enroll” option on individual client 134, which here functions as the first computing device. Individual client 134 requests individual to take a selfie of its face, and individual takes such a selfie of its face.

[0067] Next, the Badge service 130 and the individual client 134 establish a secure encrypted session.

[0068] The Badge service 130 securely communicates with the individual client 134 using a secure encrypted session. The Badge service 130 encodes the data associated with the individual's face captured image so that it generates biometric data that is fed through a deep learning neural network, which outputs vectors.

[0069] Badge service 130 uses vectors to generate shards.

[0070] Badge service 130 causes the distribution of generated shards to servers 111, 112, 121, and 122. Within a secure encrypted session, individual client 134 receives the root private key and derives an ECDSA (Elliptic Curve Digital Signature Algorithm) public and private key pair to be used for signing. In one embodiment, neither the ECDSA public nor private key needs to be stored, as they can be re-derived as needed. In one embodiment, individual client 134 derives separate key pairs for use with different relying parties and applications. In one embodiment, several key pairs are used for data encryption. In one embodiment, individual client 134 sends the ECDSA public key to relying party 140. Relying party 140 stores the public key or uses a Certificate Authority or Registration Authority to record the public key in a public key database. In one embodiment, Badge service 130 includes a Certificate Authority, Registration Authority, and / or a public key database. In one embodiment, the Relying Party 140 stores the public key and reports the success to the individual client 134. The individual client 134 indicates the enrollment success to the individual.

[0071] In this embodiment, a shard may include one or more of the items on the following list of possible configurations. Any item on this list may have multiple occurrences. 1. Arithmetic shards for biometric data 2. MAC code for arithmetic shards of biometric data 3. Beaver Triple 4. MAC code for Beaver Triple 5. Arithmetic shards of random values ​​(e.g., alpha, r) 6. MAC code for random value arithmetic shards 7. Involvement in the arithmetic of shard random values 8. MAC key arithmetic shard (referred to as MAC key "D") 9. Function secret sharing of a certain function

[0072] In this embodiment, a Beaver triple is an arithmetic shard of {x,y,x*y} with respect to randomly selected x and y. In some embodiments, encoding includes encoding the above into the generated shard.

[0073] In one embodiment, the MAC code is considered to be part of the shared information itself. "Authenticated arithmetic shared information" is a tuple of information and its MAC code. For example, for a shard of "a", the corresponding MAC code is the shard of (a*D), where "D" is the MAC key. In this embodiment, a shard may include one or more of the following: 1. Authenticated arithmetic shards for biometric data 2. Certified Beaver Triple 3. Authenticated arithmetic shard with random value alpha 4. MAC Key Arithmetic Shard 5. Function secret sharing for a certain function

[0074] In one embodiment, an involvement value can be used to check whether the involved value has been modified. For example, an involvement value for a shard of r can be used to check whether the shard of r has been modified. In one embodiment, the involvement value is a hash.

[0075] In one embodiment, the authentication of the subject includes the step of receiving and storing one or more of the following by a second computing device: --Arithmetic shard of random value r MAC code for arithmetic shard --r --r's involvement in arithmetic shards

[0076] In one embodiment, the shard of r is received from the server array. In further embodiments, The second computing device uses the involvement values ​​for the arithmetic shards of r to verify that none of the server arrays are actively malicious or otherwise compromised in such a way that the shards of r have been modified. The second computing device performs the step of generating r from the shard of r, Includes.

[0077] In one embodiment, I, The second computing device generates a blinded shard from the target digital electronic signal and r shard, The second computing device broadcasts the blinded shards to the server array, Includes.

[0078] In another embodiment, authentication includes the step of causing an array of servers to own a shard of the target digital electronic signal.

[0079] In one embodiment, authentication includes the step of generating a shard of the target digital electronic signal and an associated MAC using a blinded shard and a shard of r by an array of servers.

[0080] In one embodiment, the above process determines, by using the MAC code of the shards, whether any of the servers in the array are actively malicious, for example, whether they are modifying any shard. In a further embodiment, if a server is detected to be actively malicious, a breach of security or contractual legal process is implemented. For example, if a third-party server is compromised and results in the modification of a shard, appropriate legal or compensatory measures for disputes and disputes may be initiated.

[0081] Alternatively, or in addition, in another embodiment, authentication is, The second computing device receives data exchange information from the server array, A second computing device uses data exchange information to verify that a subset of the server array is not malicious, Includes.

[0082] In a further embodiment, if the server is found to be malicious, a security process is performed.

[0083] Alternatively, or in addition, in another embodiment, authentication is, The steps include generating and distributing additional values ​​such as the hash of the shard of the target digital electronic signal or the value of involvement, The server array receives and stores the generated shards and additional values. Includes.

[0084] In one embodiment, the above process determines whether any of the server arrays is actively malicious by using the MAC code of the shards.

[0085] In one embodiment of the system, where a certificate holder 140 authenticates an object 135 that claims to be user 133, the authentication process is implemented as follows:

[0086] Target 135 attempts to log in to the certificate user's application, and in this case, requests login on target client 136, which acts as a second computing device for authentication purposes.

[0087] The target client 136 (for example, running on the target device) sends a request for user authentication to the relying party 140, which uses what is called a third computing facility.

[0088] The relying party 140 returns a challenge to the target client 136, which includes a request to sign the message with the ECDSA private key.

[0089] The target client 136 requests a selfie of the target 135's face.

[0090] Subject 135 takes such a selfie of their face.

[0091] The target client 136 and Badge service 130 establish a secure, encrypted communication channel.

[0092] Badge service 130 encodes and generates the shards.

[0093] Badge service 130 distributes a subset of shards across multiple servers 111, 112, 121, and 122.

[0094] A subset of servers 111, 112, 121, and 122 will perform the data exchange process.

[0095] A subset of the array of servers 111, 112, 121, and 122 sends information to Badge service 130.

[0096] Badge service 130 uses the information to re-derive the root private key.

[0097] Badge service 130 communicates with target client 136 over a secure encrypted channel in a manner that enables target client 136 to re-derive the ECDSA private key.

[0098] The target client 136 signs the message with an ECDSA private key.

[0099] The target client 136 transmits a signed message to the relying party 140.

[0100] Relying party 140 verifies the signature using the ECDSA public key (which has been previously stored by relying party 140 for access).

[0101] If the signature is valid, the relying party 140 successfully authenticates the target 135 as individual 133. In one embodiment, the relying party 140 grants the target client 136 access to the application.

[0102] The authentication results will be reported to target 135.

[0103] Once authenticated as individual 133, object 135 accesses the certificate user's application. In one embodiment, object 135 views its account balance. In another embodiment, object 135 views the results of its medical tests. In yet another embodiment, object 135 decrypts messages, payment wallets, or other data. In yet another embodiment, object 135 signs documents or other data using a digital signature. In one embodiment, object 135 signs transactions for, for example, approval and recording by a distributed ledger, blockchain, or transaction processing stack.

[0104] In some embodiments, the output value is a key if the subject is authenticated as an individual, and all zeros if the subject is not authenticated as an individual. In one such embodiment, a third computing facility uses the output value / key to derive an ECDSA private key. Furthermore, the third computing facility uses the ECDSA private key to perform signature-based authentication and authenticate to a fourth computing facility. In such embodiments, the third computing facility receives a token from the fourth computing facility that enables access to the application. In another embodiment, encoding includes processing biometric data for the generation of a biometric template. In one embodiment, a deep learning neural network is provided by another entity, such as a biometric vendor. In another embodiment, the biometric data is processed using a feature extraction and / or matching algorithm that outputs a biometric template. In another embodiment, facial biometric data is fed through a neural network trained on faces that outputs a first vector, and speech biometric data is fed through a neural network trained on speech that outputs a second vector, and the two vectors are combined, for example, using a tensor product, for the generation of a biometric template.

[0105] Some embodiments of the present invention can uniquely utilize multiple biometric inputs. For example, if each biometric input is fed through a machine learning model and has an output in metric space, these embodiments can generate shards from these biometric inputs. In an embodiment, Badge service 130 uses machine learning to generate vectors and then uses the generated vectors as inputs to the authentication process. The use of machine learning is applied to multiple biometric and non-biometric inputs, and also to multiple vectors. In one embodiment, these techniques are utilized when generating shards from digital electronic signals.

[0106] In one embodiment, the digital electronic signal is a video containing a person's face image and audio. The face image will travel through its own neural network, and the audio will travel through its own neural network. Each neural network will produce vectors (i.e., called "enroll vectors") such as face vectors and audio vectors upon enrollment, and again upon authentication, a vector (called "authentication vector"). These two vectors are merged (with or without additional information) to create an input vector. For example, the face vector and audio vector may be combined with a PIN code to create a merged vector. In a further embodiment, the additional information may include a set of metadata indicating the type of biometric input from which the vector can be derived. In one embodiment, a computing device obtains the input vector and uses it to generate shards. Thus, shards can be generated based on multiple biometric vectors. In an alternative embodiment, there are two digital electronic signals, one for the face and one for the audio. In one embodiment, the generating step includes obtaining an output in a metric space created using a neural network whose inputs include components of a digital electronic signal. Outputs in the metric space may include vectors. Biometric data may be represented in the metric space as one or more vectors. In one embodiment, the vectors are generated using a neural network or deep learning model. According to various embodiments of the present invention, a process configured to preserve the privacy of biometric data for authentication involves calculating the distance (between the authentication vector and the enrollment vector) in the metric space and comparing the calculated distance against a threshold.

[0107] The neural network described above may have a given performance in terms of false acceptance rate (FAR) and false rejection rate (FRR). Some embodiments of the present invention provide a method for performing privacy-preserving authentication without degrading FAR and FRR performance at a given threshold.

[0108] Thus, these embodiments provide a uniform approach using arbitrary biometric modalities; that is, the deep learning approach described above can be used in conjunction with more conventional biometric modalities such as facial recognition, voice recognition, behavioral recognition, etc., as well as fingerprints, iris, retina, palm, etc. Architectures in some embodiments enable uniform support for biometric modalities that have not yet been invented. Such architectures also enable uniform support in combination with factors such as PINs, tokens, patterns, passwords, etc.

[0109] In the various patterns of authentication described herein, --An individual can be enrolled using one or more modalities (face, voice, fingerprint, peri-eyes face, PIN, password, SSID, token, etc.). --Then, authentication can be performed using a subset of these modalities. --Additional modalities can be enrolled over time, --(As will be explained in the following paragraphs) some of these modalities can compromise the system without compromising it.

[0110] For example, if fingerprint biometrics are not related to the techniques described herein, i.e., if a fingerprint template stored anywhere in the database is compromised, it may be compromised, but such compromise in the prior art does not result in system compromise according to one embodiment of the present invention. In another embodiment, if an underlying private key is compromised, the compromised key can be invalidated according to an embodiment of the present invention. In another embodiment, when it is determined that a password should no longer be used, the password can be excluded as an effective modality for authentication. In some embodiments, this decision is made by a user, and in other embodiments, the decision may be made automatically by an organization such as a bank or government agent, or when a set of conditions has been established to justify the decision.

[0111] In some embodiments, the nature of the proposed use of the information governs the selection of the hierarchy of security risks associated with such use, and consequently, the authentication factors required to implement such use. For example, in one scenario described herein, only an individual's face may be required to log in to verify their bank balance, while in another scenario, to perform a transaction involving a higher hierarchy of security risks, the individual may be required to pass both facial and voice recognition requirements. In yet another scenario, for example, involving a change of address for an individual, in addition to biometric requirements, a requirement may be imposed to provide confidential information such as a user's PIN. Other embodiments include an organization selecting the required input factors or combinations based on user convenience to an application or transaction with which the user wishes to access, or, in another embodiment, based on a security policy.

[0112] In some embodiments, one or more separate subkeys are derived for each factor or modality that an individual enrolls. A subset of the set of subkeys may be sufficient to authenticate the subject as an individual. Depending on the enrollment, a primary key related to the subkeys may be generated. The primary key may be derived from the subkeys. In some embodiments, all subkeys are required to re-derive the primary key. In some embodiments, the primary key behaves like a master key.

[0113] In some embodiments, compromising a secondary key does not compromising any other key. Secondary keys can be invalidated. In some embodiments, the primary key can be updated to no longer be associated with the invalidated secondary key. For example, the primary key can be updated to no longer contain the invalidated secondary key.

[0114] In some embodiments, the secondary and primary keys may be ECDSA or RSA keys and may be used in standard cryptographic operations such as signing and encryption. In one embodiment, the primary key is an ECDSA key that encompasses the secondary key. In one embodiment, a Diffie-Helman process is used to combine the secondary key and generate the primary key. In some embodiments, the key generation step includes generating a secret and deriving therefrom a private / public key pair such as an ECDSA key pair and others known in the public key infrastructure.

[0115] In one embodiment, the set of secondary keys re-derived during authentication is a subset of the primary key, and if this subset is determined to be sufficient for authentication, the server receives the configured attribution evidence. In one embodiment, the determination of what is sufficient is made at enrollment. In one embodiment, the threshold for the subset determined to be sufficient can be dynamically set by the organization (for example, it does not have to remain static from enrollment). Furthermore, the threshold may be as low as a single partial modality or as high as all modalities, depending on the organization's preferences for user preferences and security, etc.

[0116] In some embodiments, there is one or more subkeys for each factor or modality. For example, with respect to a given user, there may be a subkey for each partial fingerprint on each finger of each hand. In another embodiment, all 10 fingerprints and two palms of the user have one subkey. In yet another embodiment, with respect to a given user, there is a separate subkey for each type of face scanning, such as visual, infrared (IR), or three-dimensional (3-D). In one embodiment, there is a separate subkey for scanning the user's face in each of several distinct conditions, such as low light, wearing glasses, wearing a face mask, having a head covering, being outdoors, using a wearable camera while on a phone, or having a beard.

[0117] In some embodiments that implement secondary and primary keys, one of the secondary keys is generated during authentication. In some of these embodiments, the secondary key may be associated with the user's primary key as follows: x and y are secondary secret keys, If the primary private key is x*y, associated with the public key g^{x*y}, then a secondary key x, associated with the public key g^x, can be verified as part of the primary private key using g^y, g^{x*y} can be calculated, and its equivalence with the primary public key can be verified. This allows the derived key to demonstrate that the subject is an enrolled element of the key, even if not all modalities are used during authentication. In some embodiments, this also allows for specific key invalidation; that is, if x is compromised, all subkeys including x can be invalidated. In these embodiments, compromising or invalidating x does not reveal information about other keys (e.g., y) and does not affect the functionality of other keys.

[0118] In some embodiments, secondary keys may be extracted individually from their respective modalities, and these keys may be combined sequentially. For example, a secondary key for facial recognition and a secondary key for a PIN may be extracted. These two keys may be used, for example, for a login authentication process. Then, in order to perform a step-up authentication process, the service may require that a voice key also be extracted. In this embodiment, the voice key can be extracted and combined with the previously extracted facial and PIN keys to obtain a key used for the step-up authentication process.

[0119] In the embodiment shown in Figure 1B, the step of causing shard distribution is based on one or more combinations of conditions, including online status, availability, compromise conditions, capacity, location, authorization status, decentralization, load balancing, history, performance, scheduling algorithm, or security group. For example, if several servers 111, 112 in a cluster are compromised, the other servers in that cluster may not receive distribution. For example, gateway 115 or gateway 125 may select which servers in the cluster should be used to achieve load balancing. For example, Badge service 130 or clients 134, 136 may indicate a preference for which servers receive distribution. For example, several servers may receive one or more shards that another server also receives. In another embodiment, no server receives the same shard as another server.

[0120] Such “steps that cause distribution” do not require a specific pattern of distribution, and the range of distribution patterns can be adopted depending on the context of the relevant computer processes. Under one pattern of distribution, all servers receive the same information, which may or may not be public. Under one further scenario, the information may be “blinded,” as the term is used herein. In another pattern, for example, different servers receive different information, which may or may not be duplicated, and which is generally not public information. Various methods of distribution may be employed. In one scenario, for example, the distribution method may involve a step that provides further information to a server, enabling it to interpret information previously delivered to it.

[0121] In one embodiment, within a secure encrypted session between clients 134, 136 and Badge service 130, clients 134, 136 receive a root private key and derive an RSA public and private key pair to be used for signing. In another embodiment, Badge service 130 derives the key pair and posts the public key to a public key directory, which, in some embodiments, is accessed by certain relying parties and applications. In one embodiment, neither the RSA public nor private keys need to be stored, as they can be re-derived as needed. In one embodiment, clients 134, 136 derive separate key pairs for use with different relying parties and applications. In one embodiment, several key pairs are used for data encryption. Thus, a human is the origin of trust (instead of a hardware or physical origin of trust, or a software origin of trust, which can be lost or compromised). The human origin of trust can, on demand, re-derive, sign, encrypt, or otherwise provide key pairs for authentication with relying parties, services, and applications.

[0122] In some embodiments, the system in Figure 1B includes more than two server clusters. In this embodiment, the system architecture in Figure 1B is modified so that Badge service 130 is connected to an additional server cluster. In one embodiment, a server or server cluster has two-point connections with every other server or cluster. In one embodiment, a server would have a series of broadcasts between itself to perform the MPC protocol.

[0123] In some embodiments, the system communicates to the Relying Party (sometimes referred to herein as the "RP") that an object has been authenticated, in a variable manner. In one embodiment, the Relying Party communicates with its individual client upon enrollment (as depicted in Figure 1B). To this end, the client (after enrollment) sends the Relying Party certain information that links its Badge account to the Relying Party's account. For example, this can be achieved using the standard OAuth protocol. In another embodiment, the Relying Party communicates with the Badge service, which acts as a Certificate Authority (CA) and registers its root certificate with the Relying Party. The Badge service can then send a signed message that the client has been authenticated, which can be verified by the Relying Party. In yet another embodiment, the Relying Party has no communication with anything other than its secondary clients. In this case, a third-party CA (e.g., COMODO) issues a certificate to the Badge service, which is used to sign authentication messages. The Relying Party verifies these signed authentication messages using a protocol, for example, standard Transport Layer Security (TLS). 1.1 Data Encoding

[0124] In some embodiments, user U may be represented by a set of features, a subset of points corresponding to the entropy of the template. [ka] has a biometric template T. In one embodiment, each feature is an element of the same population, which must be finite and have a total order. In some embodiments, this total order must be known for both U and U I and must be constant or variable depending on one or more authentication factors that may include, for example, a PIN, password, ear canal characteristics, biometric data. To describe the conditions of these embodiments differently, there is a subset of points that represents the randomness of the biometric data. Let the subset of points P be called entropy points. In one embodiment, an encoding algorithm is used to encode T into an encoded template E T and an algorithm f performs authentication assuming the entropy points P T of the encoded template E I and a second template T I . T I is generated by user U I . That is, if user U I is identical to U, then f(E T ,P I ) = 1, otherwise f(E T ,P I ) = 0. It should be noted that this also means that the function is symmetric in that f(E I I,P) = 1 if and only if U is identical to U T .

[0125] An embodiment of such a biometric template and encoding scheme represents a two-dimensional face or fingerprint template as a list of (x,y) coordinates of features associated with the template. The encoding and entropy points are, strictly speaking, a list of (x,y) coordinates, and the corresponding f will check whether each of the large proportion of entropy points in the second template has a corresponding point in the first template within a small Euclidean distance. The selection of encoding and f can be done so that they improve performance. 1.2 Communication for Enrollment and Authentication

[0126] In some embodiments, enrollment (also referred to as registration) takes place between a sincere individual and multiple servers. The purpose of enrollment is to enable the individual to authenticate itself at a later point in time. After the individual is enrolled, authentication takes place between a target, which may or may not be the same as the enrolled individual, and multiple servers.

[0127] Figures 1C and 1D are block diagrams illustrating, respectively, the communication paths for enrollment and authentication within a computer system using n servers according to one embodiment of the present invention. In enrollment in Figure 1C, an individual user (U) 18 enrolls in the system by sending its sharded data to each server 11, 12, ..., 15. In authentication in Figure 1D, the target user (U t )19 attempts to authenticate itself as user (U)18 by communicating with servers 11, 12, ..., 15. In the embodiments of Figures 1C and 1D, servers 11, 12, ..., 15 must also communicate with each other.

[0128] In one embodiment, we assume that at least one of the servers 11, 12, ..., 15 is honest, meaning that it will correctly follow the authentication protocol in this embodiment and will not reveal any of its private values. If at least one server is honest, the following objectives can be achieved:

[0129] Accuracy. If the object is an individual, and both the server and the object adhere to the protocol without deviating from it, the server is confident that the object is an individual.

[0130] Honesty. If the target is not an individual, and at least one server is honest, the honest server will not be confident that the target is an individual, and authentication will fail.

[0131] Zero knowledge. For example, if at least one server is honest, no server should know the biometric data of an individual or target. Furthermore, even if the target is malicious in this scenario, neither the target nor any server will know anything about the individual's biometric template during the authentication protocol.

[0132] Zero knowledge is related to privacy preservation. In some embodiments, even if all but one of the servers are actively malicious,

[0133] The output values ​​are not disclosed to the computing equipment or multiple servers.

[0134] Neither the individual's biometric data nor the target's biometric data (or digital electronic signals characterizing the target's biometrics) is disclosed to the server.

[0135] The server does not retrieve the intermediate value for multi-party calculations. 2.3 A Brief Background of MPC

[0136] There are many different forms of multi-party computation (MPC), including methods that perform computation on "sharded" values. A "sharded" value is a value x shared across two or more servers. A shard alone does not reveal anything about x, but only when combined does it reveal x. For example, x can be arithmetically sharded into [x]1, [x]2, as follows: [x] 1 = r mod p [x]²=xr mod p In the equation, r is a random integer and p is a prime number. We have x = [x]1 + [x]2, and it can be seen that [x]1 and [x]2 are both random (because r is random).

[0137] Here, we describe a method of sharding data (arithmetic sharding). Several other methods of sharding data also exist. Processes for sharding secrets (e.g., Shamir sharding, i.e., polynomial interpolation, bitwise XOR sharding, linear sharding, etc.) may also be used.

[0138] MPC allows complex operations, including addition, multiplication, and integer comparison, to be performed on these sharded values. These operations, collectively, occur on the sharded values, generating shards of the computation results. The servers then reveal these output shards and together understand the results of the computation. Thus, the set of servers understands only the outputs of the computation, and not the inputs or any intermediate values.

[0139] While MPC is common and powerful, it is also expensive and therefore impractical for many applications. For example, in the sharding protocol described above, some operations are more expensive than others. Specifically, each multiplication and comparison operation is expensive. The operations typically require a separate offline "setup" phase involving a large amount of computation and communication.

[0140] This setup phase is extremely expensive (both in terms of computation and communication), making most MPCs impractical for most applications. Even the online phase (which occurs after the setup phase) can be impractical, as each multiplication and comparison operation requires the exchange of information between all servers involved. This process can be costly in terms of time (approximately 200ms to 500ms), particularly due to network latency.

[0141] Finally, many approaches to address these shortcomings come at the expense of security. That is, many protocols only protect user data if all servers faithfully comply with the protocol. This security model is generally too vulnerable for practical use.

[0142] The sharding described above shards values. Function secrecy is a mechanism that shards functions instead of values. Functionally, they operate similarly to the sharding described above. The key difference is that instead of sharding a value (x) and then computing a known shared function (f) together, the function (f) is sharded and the computation is performed on a known shared value (x). 2.0 Secure Subset Selection

[0143] In accordance with embodiments of the present invention, we develop and use a sharded subset protocol. The sharded subset protocol comprises two phases: configuration (which sometimes corresponds to what is called "enrollment") and selection (which sometimes corresponds to what is called "authentication"). The configuration phase involves selecting a server S, of which at least one is sincere. i This takes place between trusted third-party users. The selection phase is between the same server and another third-party user, which may or may not be trusted. I This takes place between them. The high-level goal of the sharded subset is that trusted party U sends several messages during the setup phase. [ka] The purpose is to enable the "passing" of to the server. At a later point, in authentication, the protocol is U I However, it should be possible to select a subset of messages of a fixed size f without knowing the content of the messages, given server S a Next, without knowing the index Φ of the selected message, the content of the subset [ka] This should be understood. That is, at the end of the protocol, one of the servers will have access to a subset U of the plaintext messages passed, but the specific messages selected to form this subset will remain hidden. For the purpose of formally defining the protocol, [ka] However, given server S a A set of messages that S holds at the end of the protocol. a teeth, [ka] If true, output 1; otherwise, abort. As more generally described herein in relation to authentication, there are three goals for sharding a subset: accuracy, sanity, and zero knowledge.

[0144] Accuracy: If all participants are in good faith, the protocol will not be terminated, given server S a It outputs 1 with a probability of 1. Furthermore, S a and U I If both are sincere and the protocol is not discontinued, M I It is precisely selected using Φ.

[0145] Healthiness: S a However, if they are sincere, [ka] If so, the protocol is used by other servers and U I Regardless of the method of deception, it will be canceled with overwhelming probability.

[0146] Zero knowledge: No server should know anything about Φ as long as one server remains honest. Furthermore, {S i} i≠a and U I is given server S a As long as they are honest, they should not know anything about the underlying plain text messages. 3.0 Enrollment and Authentication Protocols

[0147] Here, we securely store the biometric template of individual U on the server, and target U I However, at a later point, it will explain how it may be able to authenticate itself. This section of the explanation is an extension of the concepts disclosed in PCT Publication WO2017 / 083732, filed on November 11, 2016 (which is incorporated herein by reference in its entirety).

[0148] Figure 4 is a schematic diagram of the logical flow of the enrollment process according to one embodiment of the present invention. During enrollment, in process 41, the first biometric computer system generates biometric data about individual U, and in process 42, the generated biometric data is encoded and extracted into a shard. (The encoded biometric data is in template E T(This corresponds to Section 1.1.) The encoded biometric data appears in n shards, where n is the number of servers. In process 43, the first biometric computer system distributes the n shards across the n servers. In further relevant embodiments, additional (optional) processes are performed by the first biometric computer system. In particular, in process 44, the first biometric computer system performs the offline phase of the MPC protocol, which will later be used for authentication. In process 45, the first biometric computer system then sends customized outputs, calculated for use in the MPC, to each server. (From Section 1.1, it will be recalled that for authentication, the MPC uses an algorithm corresponding to f.)

[0149] Figure 6 is a schematic diagram of the logical flow of an authentication process according to another related embodiment of the present invention. During authentication, in process 61, a second biometric computer system generates the target biometric data. Then, in process 62, the second biometric computer system encodes the target biometric data and extracts it into a shard. The biometric data thus encoded reaches the entropy point P I This constitutes (as initially described in Section 1.1 above). In process 63, a second biometric computer distributes n shards across n servers. In process 64, each server retrieves pre-calculated MPC parameters from memory during the offline phase of the MPC (processes 44 and 45 in Figure 4) from U. In process 65, the server E T and P I Without understanding anything about f(E T ,P IThe calculation is performed. In one embodiment, the function "f" is a biometric matching function. In one embodiment, this calculation yields shards of the output value O. In one embodiment, the shards of O are returned to the subject, which then reconstructs these shards to restore O. In one embodiment, if the final output O is 1, the subject is authenticated as an individual. Otherwise, the subject is not authenticated as an individual.

[0150] In another embodiment, the server may restore O without returning any shard to the user. In one embodiment, if the final output O is 1, the object is authenticated as an individual; otherwise, the object is not authenticated as an individual.

[0151] In another embodiment, O may be arbitrarily selected to be any value at enrollment. In one embodiment, O may be selected to be the private key (or a shard of the private key if more than one factor is used).

[0152] In another embodiment, a second biometric computer causes a server to calculate MAC codes for the target shard. These MAC codes are f(E T ,P I It is used throughout the process of determining which server to calculate f(E). The MAC code is returned along with the shard of O. The target then checks this MAC code before reconstructing O, and the server determines that f(E) is the correct server. T ,P I ) correctly calculate P I Determine whether or not you know anything about it.

[0153] In another embodiment, the server uses a protocol including SPDZ and / or function secret sharing to f(E T ,P I Calculate ).

[0154] In another embodiment, a second biometric computer generates biometric data for a subject claiming to be an individual, shards the subject's biometric data, and distributes the subject's shards across multiple servers. Shard distribution causes the servers to calculate MAC codes for the subject's shards, and each server runs a multi-party calculation algorithm to determine a matching score for the blinded values ​​of the subject's sharded biometric data in relation to the individual's corresponding sharded data. Each server uses the blinded matching score to calculate a corresponding function share and returns the calculated function share, along with the previously calculated MAC code value, to the second biometric computer. The second biometric computer uses the function share data to determine whether a matching decision has been made, evaluates the MAC code, and verifies the authenticity of the function share data.

[0155] In process 66, each server is programmed to approve or deny individually. In one embodiment, the programming is carried out in such a manner that a server does not know whether it has approved or denied. In addition, it does not know whether any other servers have approved or denied. In one embodiment, it is impossible to determine from a given server shard of output values ​​whether the output value indicates that the subject has been authenticated as an individual. The authentication process 68 succeeds only if a sufficiently large subset of servers approve in process 66.

[0156] The following are two examples of how, in some embodiments, not all servers approve in process 66.

[0157] In the first embodiment, not all servers are authorized based on redundancy. In one embodiment, more than one server receives the same shard during enrollment / authentication. In this case, more than one server will produce the same output shard. In one embodiment, authentication requires only one instance of each output shard. If two servers that received the same shard produce different output shards (for example, one server is malicious or faulty), and a subset of the output shards results in successful authentication, the subject is successfully authenticated as an individual. In one embodiment, if it is possible to restore the output to verify authentication, the subject is successfully authenticated as an individual.

[0158] Alternatively, in another embodiment, Server 1 receives Enroll Shard 1 and Authentication Shard 1. Server 2 receives Enroll Shard 1 and Authentication Shard 2. Server 3 receives Enroll Shard 2 and Authentication Shard 1. Server 4 receives Enroll Shard 2 and Authentication Shard 2. Authentication can be performed using only Servers 1 and 4, or using only Servers 2 and 3. When either Servers 1 and 4 or Servers 2 and 3 verify authentication, the subject is authenticated as an individual.

[0159] In the second embodiment, a sharding method such as Shamir sharding results in a situation where only a certain number of shards are needed to recreate the secret (in this case, the secret is the output value), i.e., n out of m shards are sufficient.

[0160] The exemplary methods described in Examples 1 and 2 above may be chosen for reasons including the possibility that the server may occasionally go down, become unavailable, fail, go offline, or become malicious.

[0161] In one embodiment, all servers connected to a given gateway receive the same shard. In such an embodiment, during a given authentication attempt, each gateway selects one server connected to it to participate in the data exchange process (so that one server from each gateway is involved). In case of authentication failure, authentication may be retried either under certain conditions or automatically. During this retry, each gateway may select to assign a different server than the one used in the previous attempt (based on internal scheduling or load balancing algorithms, etc.). Thus, the array of servers involved in the first authentication attempt may be a different subset of servers than the one involved in the second authentication attempt. This reduces the potential for a single point of failure within the array or subset of servers.

[0162] Here, we describe another embodiment in relation to Figure 4. Figure 4 is a schematic diagram of the logical flow of the enrollment process according to one embodiment of the present invention. During enrollment, in process 41, the first biometric computer system generates biometric data relating to individual U, and in process 42, the generated biometric data is encoded and extracted into a shard. (The encoded biometric data is in template E T(This corresponds to Section 1.1.) The encoded biometric data appears in n shards, where n is the number of servers. In process 43, the first biometric computer system distributes the n shards across the n servers. In further relevant embodiments, additional (optional) processes are performed by the first biometric computer system. In particular, in process 44, the first biometric computer system performs the offline phase of the MPC protocol, which will later be used for authentication. In process 45, the first biometric computer system then sends customized outputs, calculated for use in the MPC, to each server. (From Section 1.1, it will be recalled that for authentication, the MPC uses an algorithm corresponding to f.)

[0163] In some embodiments of the present invention, shards distributed across servers during the enrollment process (as described in relation to Figure 4) are encrypted. Figure 2 is a schematic diagram of the logical flow illustrating how such encryption is achieved by a first biometric computer system according to one embodiment of the present invention. In process 21, the first biometric computer obtains the encryption key for server a. In process 22, the first biometric computer system shards each message into n-1 shards for each server other than server a. In process 23, the first biometric computer system encrypts the shards for each server i (other than server a) using the encryption key for server i (obtained by the first biometric computer from server i). Now there are n-1 encrypted shards. Next, in process 24, the first biometric computer system generates a random symmetric key k. In process 25, the first biometric computer system further encrypts the n-1 encrypted shards using the symmetric key k. In process 26, the first biometric computer system sends its corresponding double-encrypted shard to each server i of the n-1 servers. (Recall that each shard for server i is initially encrypted with a key obtained from server i.) In process 27, the key k itself is also sharded into n shards, and in process 28, the first biometric computer system sends the shards of key k to each server.

[0164] Figure 3 is a schematic diagram of the logical flow in authentication under the circumstances that the shards are encrypted according to the process described in relation to Figure 2. In process 31, the second biometric computer system downloads the double-encrypted shards and shard k from the server, which were distributed by the first biometric computer system in processes 26 and 28 of Figure 2. In process 32, the second biometric computer system reconstructs k. In process 33, the second biometric computer system decrypts one layer of the shard using the reconstructed k. However, the shards on each server i (other than server a) remain encrypted with the encryption key of server i. In process 34, the second biometric computer system selects a subset of these encrypted shards, and in process 35, from server s, biometric U I The encoding is restored, and a subset is sent to server a for decryption so that the server can evaluate the existence of a match.

[0165] Figure 5 is a schematic diagram of the logical flow of the authentication process according to a related embodiment of the present invention. During authentication, in process 51, the second biometric computer system identifies user U I The biometric data is generated. Then, in process 52, the second biometric computer system generates the data for user U. I The biometric data is encoded and extracted into a shard. The biometric data thus encoded is at the entropy point P I This constitutes (as initially described in Section 1.1 above). In process 53, the server and the second biometric computer system perform the subset protocol selection step (described above in relation to Figure 3), and P I Select a subset of encrypted shards that corresponds to this. At this point, each server then P I Shared information on point E TIt holds the shared information. In process 54, each server retrieves from memory the MPC parameters that were pre-calculated from U in the offline phase of the MPC (processes 44 and 45 in Figure 4). In process 55, the server E T and P I Without understanding anything about it, along with the second biometric computer system, f(E T ,P I ) is calculated. In one embodiment, the function "f" is a biometric matching function. If the final output is 1, U I =U. Otherwise, U I ≠U. In process 56, each server is programmed to approve or deny individually. Authentication in process 58 succeeds only if all servers approve in process 56. Otherwise, target U I The authentication is denied in process 57.

[0166] This certification process has potential applications in multiple fields. Those skilled in the art will be able to recognize that this technology can be used for many applications, including certification. Applicable industries include finance and banking, government and defense, healthcare and medical services, retail, consumer certification, enterprise, identification, and many others.

[0167] Furthermore, while the above embodiment clarifies a "yes" / "no" result regarding authentication, other embodiments include key derivation, for example, by sharding the key across multiple servers, and then (depending on the success of authentication), each server uses its shard. I It will be sent to U. Therefore, depending on the success of authentication, U I This allows for the reconstruction of a secret key for use in further cryptographic operations.

[0168] Additional embodiments of the authentication use of some embodiments of the present invention include a step of authenticating a user to a server (e.g., derived SSH key, client SSL certificate and key, Enterprise 802.11 certificate and key, OAuth token, one-time password, etc.).

[0169] It should also be noted that these can be chained together (for example, an OAUTH token can be used to obtain a subsequent certificate / key).

[0170] In addition, some embodiments of the present invention may be used for authentication of the authentication server itself. For example, an authenticated user can update their authentication data, user details, authorization policy, etc., using each server. 4.0 Exemplary Encoding Schemes and Authentication Algorithms

[0171] Here, the above fragments can be put together in an exemplary embodiment that provides fingerprint authentication and achieves the security benefits described in Section 2. In this exemplary embodiment, we will use fingerprint biometric data, which will be encoded as described below, and utilize the SPDZ multi-party calculation protocol for comparison phase. This exemplary embodiment is discussed below. 4.1 Fingerprint Biometrics and Representation

[0172] Fingerprints are a common biometric modality widely used commercially today. Many fingerprint recognition algorithms use the locations and angles of feature points (where fingerprint ridges split or terminate) extracted to represent a fingerprint. Comparing two fingerprints then requires determining the degree of similarity of the sets of feature points relative to each other. One method for performing this matching is using a "feature point cylinder code" (MCC). This method maps the space of feature points around a given point to a three-dimensional quantized data structure (x-coordinate, y-coordinate, θ-angle).

[0173] The presence of a feature point at a specific location with a specific angle assigns a value of 1 to the associated point in the data structure. Absence corresponds to zero. To compare fingerprints, as follows, the dot product of two feature point cylinder codes is determined, and it is determined whether the dot product exceeds a threshold T. E T ·E T I>T where E T is the MCC encoding of template T, and E T I is the MCC encoding of template T I .

[0174] Entropy subset

Chemical formula

[0175] P I When the MCC from is represented as 1 and 0 overall, the dot product of E I with the encoding of P T is simply the sum of the subsets of E T . The subset operation is performed using the protocol in Section 3, and the sum / threshold operation is performed using MPC (described below).

[0176] Before continuing, note that the above MCC representation can be extended by using one or more than one of the following methods.

[0177] Use feature point features (e.g., feature point type, feature point neighborhood, ridge descriptor) to more accurately describe the feature points.

[0178] By using non-binary encoding and encoding a "score" for each feature point, noise is handled more smoothly. Specifically, areas closer to feature points will have higher scores, while areas further away will have lower scores.

[0179] Depending on the model used and sensor parameters, either an unmatched or globally matched representation of the fingerprint will be used.

[0180] Instead of, or in addition to, feature point features, use non-feature point features (e.g., ridge descriptors).

[0181] Finally, it should be noted that, naturally, other biometrics may also be used as input, and multiple biometrics may be combined in a single enrollment or authentication.

[0182] We can represent the "norm" in a vector space in several forms, including the Hamming distance, the Hamming distance of a subset, the l_p distance (with respect to any p), the 1_p distance of a subset, cosine similarity, etc. In one embodiment, we embed the concept of similarity between two vectors as the dot product between those two vectors. 4.2 SPDZ Multi-Party Calculation Overview

[0183] Please recall the discussion of Multi-Party Computation (MPC) from Section 2. The MPC component of our authentication protocol is involved in implementing a comparison algorithm. Specifically, as described above, one simple way to do this is to calculate a thresholded subset sum, that is, a value x sharded across n servers. i Assuming the following set, the following can be calculated for a certain threshold T. [ka]

[0184] SPDZ is a protocol that performs calculations on sharded data (as discussed in Section 2). It has all the security requirements we require. Therefore, as discussed in Section 3, we can use the subset protocol to select the appropriate shards as input to the MPC protocol, and then the SPDZ protocol to calculate the sum and threshold.

[0185] Our threshold calculation involves integer comparison, which is significantly expensive in SPDZ (it takes several seconds to calculate, communicates >50MB of data per comparison, and requires a set phase). This cost would immediately render the protocol impractical.

[0186] However, we identified a way to avoid a significant portion of this cost by leveraging the enrollment step. During enrollment, the original user U is, by definition, trusted by all the servers. Therefore, U can generate all the offline phase data on behalf of all the servers, and the process eliminates the associated computational and communication complexities (for technical reasons).

[0187] In embodiments using different MPC approaches (e.g., variations of SPDZ), these pre-generated data may vary. [See, for example, Damgard, I., Keller, M., Larraia, E., Pastro, V., Scholl, P., and Smart, NP Practical covertly secure mpc for dishonest majority-or: breaking the SPDZ limits. In European Symposium on Research in Computer Security (2013), Springer, pp. 1–18.] They may also vary depending on the actual function computed by the MPC protocol.

[0188] Therefore, we can efficiently launch the SPDZ online protocol (with negligible computation costs and small amounts of data exchanged between servers). 5.0 Overview of Exemplary Embodiments

[0189] In one embodiment, the final overall flow is a combination of the enrollment flow (depicted in Figure 4) and the authentication flow (depicted in Figure 6), which are discussed below.

[0190] User U, an individual, scans its biometric data and generates an encoding of that individual's biometric data via what is called the "First Biometric Computer." The encoding is used by the First Biometric Computer to generate shards of that biometric data and additional information that assists in the execution of the MPC protocol but is not related to U's biometric data. The shards and other data are distributed to servers for use during the online authentication phase.

[0191] During the subsequent authentication process, User U I The subject, in order to be authenticated (and to claim to be an individual), scans its biometric data and generates these biometric data and associated encoded templates through what is called a “second biometric computer system”. Once this occurs, U I It generates shards of that biometric data and distributes them across servers.

[0192] Finally, the server independently invokes an online MPC protocol (e.g., SPDZ, FSS) using the offline data generated during enrollment to calculate the biometric matching function. At this point, each server independently has a shard of output O, which is U I The response is returned to determine whether authentication was successful.

[0193] In another embodiment, the final overall flow is a combination of an enrollment flow (depicted in FIG. 4) and an authentication flow (depicted in FIG. 5).

[0194] An individual, who is user U, scans their biometric data and generates an encoding of the individual's biometric data via what is referred to as a "first biometric computer". The encoding is used by the first biometric computer to generate an encrypted shard of that biometric data and additional information that aids in the execution of the MPC protocol but is not related to U's biometric data. The encrypted shard and other data are distributed to a server for use during the online authentication phase.

[0195] During the later authentication process, user U I the subject scans their biometric data to be authenticated (and claim to be an individual) and generates a confidence subset of these biometric data and an associated encoded template via what is referred to as a "second biometric computer system". Once this occurs, U I and the server initiate a subset selection protocol whereby each server is provided with a distinct set of decrypted shards of the encoded template but is not provided with information by which such server itself can determine the location of the decrypted shards.

[0196] Finally, the server independently uses the offline data generated during enrollment to initiate an online MPC protocol (e.g., SPDZ) to calculate a biometric matching function. At this point, each server independently determines the biometric match. U I is considered authenticated if all servers approve. Otherwise, U I is not authenticated.

[0197] Embodiments of the present invention are more efficient than previous multi-party computation approaches. For example, by (1) treating enrolling users as universally trusted individuals among a set of mutually untrustworthy servers, and (2) using our secure subset selection algorithm, we can eliminate the expensive offline phase of the bidirectional MPC protocol (e.g., computation of multiplicative triplets). By simplifying the authentication protocol to a dot product, we reduce the number of steps in the online phase to an acceptable number (e.g., about 5 steps, although this may depend on precision).

[0198] In one embodiment, one or more servers enforce rate limiting or account lockout if conditions are met. Those skilled in the art will be familiar with such conditions. These may include, for example, too many incorrect authentication attempts, authentication attempts originating from a particular location, authentication attempts at a particular time (e.g., a time or date indicating a higher risk, or behavior not characteristic of the user), authentication attempts with variable identification assurance requirements, authentication attempts with factors indicating a certain risk level, and so on. In one embodiment, after the conditions are met, a security process is implemented. The security process may include, for example, preventing further authentication attempts over a period of time, notifying users, servers, or organizations exhibiting suspicious behavior, and / or increasing the requirements for subsequent authentication. 6.0 Additional Exemplary Embodiments

[0199] In another exemplary embodiment, the user may present multiple biometric modalities, which are combined to form a single encoded template and / or confidence subset.

[0200] In another embodiment, the user may present multiple biometric modalities, each to be encoded and authenticated as described herein. Each generates a distinct output value O. These output values ​​are combined to determine whether the subject is authenticated as an individual.

[0201] In another embodiment, these output values ​​are combined to form a secret key.

[0202] In another embodiment, the same biometric shard computes f(E T ,P I ) may be enrolled with two (or more) separate thresholds by having U perform an offline phase to calculate with two (or more) thresholds and send each of these sets along with its shard. During authentication, the desired threshold is selected and f(E T ,P I Associated auxiliary data for calculating the desired threshold is invoked and used in the authentication protocol. In one embodiment, authenticating at a lower threshold may have a more user-friendly experience and a lower false rejection rate (FRR), but a higher false acceptance rate (FAR), allowing the subject to access lower-risk functionality, such as viewing their account balance on a mobile banking app on their phone. Authenticating at a higher threshold is required for the subject to access certain functionality or authorize higher-risk transactions, such as high-value transactions. In some embodiments, higher levels of authentication require additional factors, biometrics, or inputs.

[0203] In another embodiment, the shards and auxiliary data are encrypted at storage by one or more of the servers. This enables layering of security.

[0204] In another exemplary embodiment, during the enrollment phase, the individual scans its fingerprint and enters its PIN code into the device.

[0205] A first biometric computer system trusted by the individual determines a confident subset of the biometric input data. The first biometric computer system characterizes the confident subset into an ordered list or matrix of locations and unique biometric elements, or, for example, feature points. All elements are sharded by the first biometric computer system into n shards, where n is greater than 1. No shard characterizes even a portion of the biometrics. In some embodiments, if an adversary obtains all but one of the n shards, the adversary would still not be able to reconstruct any biometric information; that is, all n shards would be required. In other embodiments, a threshold number of shards is sufficient to reconstruct the biometric information.

[0206] In some embodiments, to obscure location information, the first biometric computer system applies an ordering scheme. In some embodiments, the ordering scheme is partially based on an authentication input such as a PIN or fingerprint. In one embodiment, each set of shards sent to the server is subjected to the same ordering scheme. The first biometric computer system generates n sets of shards. The first biometric computer system also generates n unique and corresponding noise datasets for use during the authentication phase.

[0207] In one embodiment, n is 2. A first set of shards is encrypted using key A. A second set of shards is encrypted using key B. The first biometric computer system sends a data set to server 1 that includes (a) a set of shards encrypted using key A, (b) key B, and (c) a noise dataset. Similarly, the first biometric computer system sends a distinctly different data set to server 2 that includes (a) a set of shards encrypted using key B, (b) key A, and (c) a noise dataset. It should be noted that server 1 holds key B, which is used to encrypt the shards held by server 2, and server 2 holds key A, which is used to encrypt the shards held by server 1, so that neither server can decrypt the shards it holds using the key it holds. This is one embodiment of a novel method for distributing shards and keys across different servers.

[0208] In one embodiment, information transmitted by the processor is authenticated and / or signed. During the authentication phase, an object claiming to be an individual scans its fingerprint and enters its PIN code into a second device. A second biometric computer system, coupled to the second device, determines a confident subset of the biometric input data. In one embodiment, the second biometric computer system applies an ordering scheme to the confident subset. (In another embodiment, the second biometric computer system instead applies the inverse of the ordering scheme to the shard-encrypted set.)

[0209] Server 1 sends a set of shards encrypted using key A to a second biometric computer system. Server 2 sends a set of shards encrypted using key B to the second biometric computer system. In one embodiment, the information sent by the servers is authenticated. The information may be sent over a secure channel.

[0210] Using the confident subset, the second biometric computing system selects a new subset for each of the encrypted sets of shards.

[0211] In one embodiment, an ordering scheme (which may or may not be the same ordering scheme used previously) is applied to the new subset. In another embodiment, locations are not included in the new subset. The second biometric computer system sends the new subset of shards encrypted using key A to server 2. The second biometric computer system sends the new subset of shards encrypted using key B to server 1.

[0212] In one embodiment, information transmitted by a second biometric computer system is authenticated and / or signed. Server 1 uses key B to decrypt a new subset of shards encrypted using key B. Server 2 uses key A to decrypt a new subset of shards encrypted using key A. Here, both servers have a decrypted set of shards of a biometric confidence subset from an object they claim to be an individual. However, since location information is not included or grasped, even the compromise of the decrypted shards does not compromise the biometric information.

[0213] In one embodiment, Server 1 and Server 2 communicate with each other without sharing a decrypted shard. A noise dataset is used to make this secure communication more efficient, including by requiring less computation and less data to be exchanged between Server 1 and Server 2, thereby increasing efficiency. In some embodiments, this novel method enables secure communication between two or more servers in a highly efficient manner by leveraging auxiliary data (e.g., a noise dataset) provided at enrollment by a trusted party, which is an enrolling person or processor.

[0214] Once the calculation is complete, Server 1 and Server 2 can (or have already determined) whether the subject is authenticated as an individual. In one embodiment, this decision is based on a combination of shards that reveals whether the confident subset of the subject was able to select enough unique biometric feature points from the subject dataset without the need for non-transient memory of the subject dataset. "Enough" may depend on a threshold that can be adjusted, for example, to reduce the true rejection rate (FRR) or false acceptance rate (FAR).

[0215] References 1. Beaver, D. Efficient multiparty protocols using circuit randomization. In Annual International Cryptology Conference (1991), Springer, pp. 420-432. 2. Ignatenko, T., and Willems, FM Information leakage in fuzzy commitment schemes. IEEE Transactions on Information Forensics and Security 5, 2 (2010), 337-348. 4. Micali, S., and Rogaway, P. Secure computation. In Annual International Cryptology Conference (1991), Springer, pp. 392-404. 5. Shamir, A. How to share a secret. Communications of the ACM 22, 11 (1979), 612-613. 6. Stoianov, A., Kevenaar, T., and Van der Veen, M. Security issues of biometric encryption. In Proceedings of Toronto International Conference on Science and Technology for Humanity (2009), pp. 34-39. 7. Uludag, U., Pankanti, S., and Jain, AK Fuzzy vault for fingerprints. In International Conference on Audio- and Video-Based Biometric Person Authentication (2005), Springer, pp. 310-319. 8. Yao, AC-C. Protocols for secure computations. In FOCS (1982), vol. 82, pp. 160-164.

[0216] The embodiments of the present invention described above are intended to be illustrative only, and numerous variations and modifications will be obvious to those skilled in the art. All such variations and modifications are intended to be within the scope of the present invention as defined in any appended claims.

Claims

[Claim 1] The invention described herein.

Images