Matching encrypted biometric data

Abstract

Biometric scanners capture information about a person that is stored for the purpose of later recognizing that it is the same person when subsequently scanned. The scanned information captured and stored in prior art systems might be misused to impersonate people, create false identities, and even to extract genetic information. The present invention solves these problems by encrypting the scanned information in a novel way that allows subsequent encrypted scans to be recognized as matching, if and only if from the same person. All scan data can be encrypted at the time of scanning and remains encrypted, including for storage and comparison. The strength of the encryption can be identical to that of standard public key cryptographic algorithms.

Description

[0001] Matching encrypted biometric data

[0002] FIELD OF THE INVENTION

[0003] The invention relates to cryptographic protocols and biometric systems, and more specifically to privacy preserving techniques for the same.

[0004] BACKGROUND

[0005] Some biometric identity systems encode each scan of a person as a bit vector. The cleartext form of such digital scan vectors can be, it is believed, a significant liability from a privacy perspective. For instance, the cleartext vectors could potentially be used for identity theft and impersonation, and they may also contain genetic information that can be desired to be kept confidential. The criteria used in such systems for determining that the bit vectors are from unique people, it is believed, can for instance be that the hamming distance between all vectors in a set is above a predefined threshold. A known way to match encrypted biometric data collected with that already stored in a database is to decrypt the data before applying the algorithm that looks for matches; the present invention obviates the need for such decryption — by being able to perform the algorithm that looks for matches directly on the encrypted data — and is thereby believed to provide an advantageous approach to privacy in biometric systems.

[0006] Hundreds of millions of people are enrolled in national biometric identity schemes in Latin America, with a similar number in Africa, and significantly more in Asia. As one timely example of a new private- sector global system, WorldCoin and its affiliates have already scanned millions of people’s eyes, rewarding those participating with small amounts of its crypto currency. The resulting database of biometric scans used to prevent people from registering more than once is believed to pose significant vulnerabilities and has triggered some outcry and raised regulatory hurdles. The technique disclosed here, in contrast, is believed to allow biometric data to remain always in encrypted form — from initial scanning, through transport and storage, as well as during comparison testing for matches — obviating these problems.

[0007] WorldCom’ s online publications suggest that they are using an iris scan system with hamming distance tests, which are believed amenable to the systems disclosed here. Specifically, according to their online publications, WorldCom’ s system is based on the use of Fourier transforms of raw scan data disclosed by J. Daugman, in a publication titled “How iris recognition works,” IEEE Transactions on Circuits and Systems For Video Technology, Vol. 14, No. 1, January 2004. Other biometrics, such as the very widely used fingerprints, have also been proposed as suitable for matching after Fourier transforms of scan data. For instance, Cai et al has disclosed a technique in “Fingerprint Segmentation Algorithm Based on Fourier Transform,” in ng (ITIM 2017) Advances in Intelligent Systems Research (AISR), volume 142, 2017 International Conference on Information Technology and Intelligent Manufacturing; and B.C Seow et al disclosed “Image based fingerprint verification,” proceedings of Student Conference on Research and development, Shah Alam, Malaysia, 2002. (Such work, as will be appreciated, should not be conflated with efforts to derive keys from biometrics.)

[0008] SUMMARY OF THE INVENTION

[0009] In a brief summary of the invention, but without implying any limitations or restrictions, some desiderata can be listed: A way to store the scan vectors in an encrypted form that would allow testing whether a candidate vector is already in the database of vectors, while the candidate and vectors remain protectively encrypted, is believed advantageous. It could further be advantageous, from a privacy perspective, it is believed, to be able to unpredictably rearrange the vectors into an unknown order in the database where they are stored, so as to reduce what can be learned from the position of vectors in the database, such as which positions arc entered or matched at what times. Moreover, it could also be advantageous from a privacy perspective, it is believed, to at least obscure information related to which candidate scan image was captured by which scanner and at which time.

[0010] Continuing the brief summary of the invention, without implying any limitations or restrictions, some inventive aspects that are believed to allow the above desiderata to be achieved and can be listed: A believed inventive and believed true observation is that if the cleartext bit vectors are each subject to the identical permutation, then hamming distance threshold tests can still be applied to yield the same result. Another observation believed inventive and believed true is that inverted bits in identical positions also allows the hamming distance threshold tests to be applied to yield the same result. It will also be appreciated that permuting the order of whole scans in the database can also preserve testing a candidate for its presence in the database. Moreover, hiding which scanner makes which scan also preserves the ability to test for presence.

[0011] One aspect of the invention is a system for biometric identification using encrypted biometric information. The system is designed to protect the biometric information of persons that has been obtained and stored in a database from being used for improper purposes, e.g., identity theft and the like. The system is also designed as a safeguard when acquiring biometric information from persons to determine whether newly-acquired information is already found in the biometric information database and not suitable for adding to the database or when the newly-acquired information is not found in the database, it can be stored therein. The system includes means for encrypting biometric information obtained from at least two persons. With the biometric information still encrypted, a means is provided for testing the encrypted biometric information of the at least two persons to determine whether the encrypted biometric information matches for those two persons.

[0012] The system can further include means for obtaining the biometric information from respective portions of the bodies of the at least two persons, wherein the obtaining means includes one or more of a fingerprint scanner, an iris scanner, a retina scanner, a facial feature scanner, a vein pattern scanner, an anatomic geometry scanner, and a skin surface pattern scanner. The software and hardware associated with the means for encrypting, means for comparing, and means for obtaining are detailed below.

[0013] The means for encrypting and means for testing or comparing for match keeps the biometric information obtained from the at least two persons hidden but allows anyone to verify a match. The means for testing can also include demonstrating a match to parties that are unable to decrypt the encrypted biometric information.

[0014] The system can also include an encrypted database for storing the encrypted biometric information.

[0015] The means for encrypting included as part of the system, including a system that has the capability to obtain the biometric information, includes unpredictable rearranging and / or inverting of the encrypted biometric information to be unpredictable while still allowing testing or comparing the encrypted biometric information for matching.

[0016] The system, with or without the means for obtaining the biometric information, can also include a mix network, the mix network configured to receive the biometric information from a scanner that is to be encrypted and to hide the biometric information travelling from the obtaining means such as a scanner so that which scanner submitted which biometric information is substantially hidden.

[0017] Besides providing a system that has the functionality for encrypting, testing, optionally obtaining, the invention also includes a method of biometric identification using encrypted biometric information. The method entails encrypting biometric information obtained from at least two persons. With the biometric information still encrypted, the encrypted biometric information of the at least two persons is compared to determine whether the encrypted biometric information matches.

[0018] The method can also include the step of obtaining the biometric information from a portion of a body of the at least two persons, and the obtaining can be one or more of fingerprint scanning, iris scanning, or retina, facial feature, vein pattern, anatomic geometry, or skin texture scanning is used to obtain the biometric information. Another aspect of the method is the ability wherein the encrypting step and the testing step keeps the biometric information obtained hidden generally, and including from the at least two persons.

[0019] The testing step can include demonstrating a match to parties that are unable to decrypt the encrypted biometric information.

[0020] As part of the method, an encrypted database is provided for storing of the encrypted biometric information in the database including storing plural encrypted items of biometric scan information in the database and rearranging the items in a substantially unpredictable order.

[0021] The encrypting of the biometric information can include rearranging and / or inverting the encrypted biometric information to be unpredictable while still allowing comparing the encrypted biometric information for matching.

[0022] Another feature of the method is submitting the biometric information obtained from the at least two persons over a mix network so that which source provided the biometric information is substantially hidden, the source being in one embodiment a scanner.

[0023] Another aspect of the invention is a biometric identification system that filters out a number of database items that would be used as pail of the comparing or testing for a match so that the comparing of candidates against the database of items is streamlined and made more efficient. The biometric identification system uses a database of existing scan data, and with new scan data available from time to time, has the following functionalities: transforming, using a first transformation, items in the database to produce at least database subset cleartext vectors; transforming, using the first transformation, at least a new candidate to produce at least a candidate subset cleartex vector; filtering out from further matching for the at least new candidate at least substantially those database items whose subset vectors are at least unlikely to match because of a larger number of differences in the subset cleartext vectors so that the number of first transformations to test a new candidate is reduced.

[0024] The transformation using the first transformation can be used for a later candidate with the filtering out with at least database subset vectors that have been previously processed by the first transformation.

[0025] After a number of candidates have been transformed using the first transformation, the system can use a second transformation. Before changing to the second transformation, the database can be permuted. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] Figure 1 shows an exemplary flowchart of a combination cryptographic protocol schematic, mixing system and data structure.

[0027] Figure 2 shows an exemplary cryptographic protocol schematic and notation definition, for a mix comparing of a candidate against a database entry.

[0028] Figure 3A and 3B show detailed combination block and flowchart diagrams of an exemplary overall encrypted biometric identity system.

[0029] Figures 4A to 4E show detailed combination block and flowchart diagrams of an exemplary inventive overall encrypted biometric identity system.

[0030] Figures 5A to 5B show alternate detailed combination block and flowchart diagrams of an exemplary overall encrypted biometric identity system.

[0031] Figures 6A to 6B show alternate detailed combination block and flowchart diagrams of an alternate exemplary inventive overall encrypted biometric identity system.

[0032] Figures 7 A to 7C show detailed combination block and flowchart diagrams of an alternate exemplary inventive overall encrypted biometric identity system that improves efficiency of the matching aspect of the invention.

[0033] DET AIDED DESCRIPTION OF THE INVENTION

[0034] Turning now to Figure 1, an exemplary combination cryptographic protocol schematic, mixing system and data structure is shown in accordance with the teachings of the present invention. A collection of scanners and means for sending in their data are shown in the upper left quadrant; an encrypted database is shown in the lower left quadrant; a comparison system, detailed further with reference to Figure 2, is shown in the upper right quadrant; and comparison logic is shown in the lower right quadrant.

[0035] More specifically, referring first now to the upper left quadrant, a collection of scanners 11 to lj are shown. The ellipsis 2 indicates, as will be understood, that the configuration includes j scanners. Each scanner is shown communicating with a front-end mix 3, via a dotted line 4. This is intended to indicate, as will be appreciated, that which scanner is sending in the scan data, that will here be called a “candidate” scan vector, ideally sent in encrypted form, is not revealed. The front-end mix 3 is shown in dot-dash lines to indicate that it is in some sense, and in some embodiments can be, optional. This can be a conventional mix or cMix, for instance, configured to hide the origin of the payloads that are delivered at its output. These payloads are here called candidate scan vectors 5 and shown as a series of pairs of squares 7 and 9, as will be explained below, and in addition shown as input to a special “mix with transformations” 23, as will also be explained below.

[0036] The candidate scan vector 5, just mentioned, is shown in the same notation as each of the k instances of encrypted vectors 11 in what can be called the encrypted database 13. The same form is also shown for the entry from the database 13 to be tested and the outputs of the test or comparison 16, all as will be described. The notation is made up of a series of pairs of stacked squares. Each square can be, in an example implementation, the entry in a re-encryption mix system, of which the special transformation mixing 23 already mentioned, can be an example. Such re-encryption systems are well known and are believed to have been built and used and are described in a number of publications.

[0037] Some such example publications related to re-encryption mixing and its variations are hereby are incorporated by reference in their entirety to the same extent as if each individual publication, patent or patent application was specifically and individually indicated to be incorporated by reference in its entirety in their entirety by reference as if copied here in the present application: Golle, Philippe, et al. "Universal re-encryption for mixnets." Topics in Cryptology-CT-RSA 2004: The Cryptographers’ Track at the RSA Conference 2004, San Francisco, CA, USA, February 23-27, 2004, Proceedings. Springer Berlin Heidelberg, 2004. Kiisters, Ralf, and Tomasz Truderung. "Security analysis of re-encryption RPC mix nets." 2016 IEEE European Symposium on Security and Privacy (EuroS&P). IEEE, 2016. Puiggall Allepuz, Jordi, and Sandra Guasch Castello. "Universally verifiable efficient re-encryption mixnet." 4th International Conference on Electronic Voting 2010. Gesellschaft fur Informatik eV, 2010. Golle, Philippe, and Ari Juels. "Parallel mixing." Proceedings of the 11th ACM conference on Computer and communications security. 2004. Singh, Kunwar, C. Pandu Rangan, and A. K. Banerjee. "Lattice Based Universal Re-encryption for Mixnet." J. Internet Serv. Inf. Secur. 4.1 (2014): 1-11. Kiisters, Ralf, and Tomasz Truderung. "Security Analysis of Re-Encryption RPC Mix Nets." Cryptology ePrint Archive (2015). Ribarski, Pance, and Ljupcho Antovski. "Mixnets: Implementation and performance evaluation of decryption and re-encryption types." Journal of computing and information technology 20.3 (2012): 225-231. Jakobsson, Markus, and Ari Juels. Millimix: Mixing in small batches. DIMACS Technical report 99-33, 1999. Jakobsson, Markus, Ari Juels, and Ronald L. Rivest. "Making mix nets robust for electronic voting by randomized partial checking." 11th USENIX Security Symposium (USENIX Security 02). 2002.

[0038] A pair of squares contacting each other, e.g., 7 and 9, are to each contain, in the examples, a single bit as the payload encrypted, with the rule that the payloads must differ. Thus, accordingly, payload pairs 0,1 and 1,0 are those allowed. By convention here, but without loss of generality, the first can stand for the bit zero and the second for the bit one. It will be appreciated that by interchanging the position of the two squares, that is for instance moving the content of the top square 7 into the bottom square 9 and the content of the bottom square 9 into the top square 7, the value that the configuration encodes will be inverted. By “inverted” what is meant here is that if it were zero it would be changed to one or if it was one it would be changed to zero. The re -encryption mixing systems mentioned arc believed to allow a mix “node” performing a mixing operation to make such an inversion, an example “transformation,” such as by switching the order of two adjacent items, thereby essentially inverting the bit represented by the payload, using the what can be called “double-bit encoding” just described. Also, as will be appreciated, in a second kind of transformation, a node can simply permute the order of the bits within the vector, that is re-arrange the paired boxes 5 into a different linear order and / or positioning, leaving which boxes are paired unchanged, and again without revealing the permutation because of the re-encryption encoding.

[0039] Encrypted scan vectors, in this encoding, are shown in four places: many as 11 making up the encrypted database 13, one being a candidate 5 that arrives from a scanner, one as the entry 15 from the encrypted database to be compared, and also a pair 19 and 21 as the output 24 of the transformation mix 23. This last collection of encrypted scan vectors 19 and 21, the output 24 of the mix with transformation 23, are shown with dashed lines. The reason is that it is believed that they can be decrypted, such as by cooperation of a set of mix entities, such as using so-called threshold decryption in some examples. When these are decrypted, they are believed to allow the hamming distance to be calculated directly from what is revealed, as will be understood; however, they are also believed not to reveal the underlying cleartext scan data, that is assuming that the mix nodes perform their operations, with full-size I.U.D. random values, as they should. Nevertheless, in some optional examples, an entity or collection of entities could receive the ability to see the decrypted values and make some interactive and / or non-interactive cryptographic proofs, such as based on homomorphic properties of the cryptography, that convince others of whether there is a match between the two vectors, as will be understood.

[0040] Thus, and as will be understood, two types of encryption of candidates are described. The first type of encryption is for the re-encryption mix, as has just been described. The second type of encryption is for two (or more) scans that are transformed in the same manner, as has been explained. The first type of encryption can be a public-key type of encryption, as in the example, and thus is ideally applied as soon as the scan is captured. The second type of encryption should ideally be applied when multiple items are processed together, as is shown by box 23; however, this second type can be applied separately to items, so long as it is mainly applied with the same parameters. It will be understood that the first type of encryption can be removed by the nodes revealing private keys and / or by the nodes performing decryption operations. Before the comparison is made, the first type of encryption would be removed. This leaves the second type of encryption, which hides the scan data.

[0041] Comparison 20, shown as a dotted box in the upper right of Figure 1, contains two encrypted vectors, as mentioned earlier, one shown as 19 and the other 21. However, which is the candidate 5 and which is the database entry 15 may or may not be known to the nodes, depending on whether the order of these is maintained or switched randomly, as will be understood is an option. Nevertheless, an example way to perform the comparison function is to decrypt the items fully. This yields the underlying 1,0 or 0,1 vectors in the example earlier described. These pairs are readily converted to the bits that they encode, 1 or 0, respectively, in the example. These cleartext bits are the constituents of the two cleartext vectors whose hamming distance should be evaluated, as will be understood. A first example type of way to evaluate the hamming distance is to make the decryptions known to a wide audience, such as making them public; a second example type of way to evaluate the hamming distance, as will be appreciated, is for one or a limited set of parties to sec the all or part of the cleartext and then prove to a wider audience what properties, such as the hamming distance, the hidden data has.

[0042] As just one instance of the first type of approach to comparison, the decryption can for example be accomplished in two steps: first change the public key to a temporary key, by raising to a quotient that cancels the original and substitutes the new value. A zero-knowledge or other interactive or non- interactive proof that this is being done can, as will be understood, give confidence about the correctness of the keys. Then the temporary key can be made public. Anyone can decrypt the vectors, translate to the bits encoded by the pairs, calculate the hamming distance, and perform the comparison by determining whether or not there is a match. In other non-limiting examples, portions of the total keying material can be removed by nodes as they process the items, either reducing the amount of encryption keys to some extent or even reducing the amount of encryption all the way.

[0043] As an exemplary instance of the second type of approach, one or more entities knows the keys and / or has access to a so-called oracle that performs the decryptions for them. These entities can then calculate the hamming distance and decide if they would like to show their conclusion to a larger audience without revealing everything about the actual decryption, encoding and / or distance. So, for instance, as will be appreciated, the parties could simply provide a proof, such as of the types already mentioned, that establishes for instance that the hamming distance is: above a certain value; below a certain value; and / or very likely above, close to, or below a certain value. Such proofs are known in the art. This type of approach may, as will be appreciated, have advantages in further reducing what is known to whom about the underlying cleartexts.

[0044] In some examples not shown for clarity, removal of the second layer can be in parts that allow one or more parties to prove the number of matches, or a range of values for the number of matches, in a portion of the bits, as will be understood. This is believed to reduce what could be learned from the comparison by other parties but is believed to allow a comparison decision or steps in the direction of such a decision, to be made. It is also believed to have the advantage of reducing what is learned by any one participant.

[0045] An example of a typical processing using the inventive method and means is as follows.

[0046] (1) The scanner encrypts with first encryption for the mix nodes. This encryption remains up until comparison 20, but it is modified by the nodes 16 randomly prior to the comparison 20. Whatever is in the database 13 is also encrypted by this first type of encryption, presumably by the original scanner that obtained it from a person, but then modified.

[0047] (2) The mix nodes 16 apply a second encryption to this first encrypted data, also randomly. The mixing paradigm can have each node change the first encryption and the second encryption randomly.

[0048] (3) As part of the comparison 20, the first encryption is removed and only the second encryption remains; and

[0049] (4) The comparison 20 can then be made on the candidate and entry to compare with the second encryption from 23 to determine whether a match occurs.

[0050] Means for encrypting the biometric information can in some embodiments optionally but ideally be included in at least three portions of the system as described with reference to Figure 1. The first portion of the figure includes scanners 1. These are hardware devices that obtain biometric information in cleartext form. The scanners ideally process and then encrypt that information using cryptographic protocols as is known in the art and also embodying the inventive transformations described in connection with Figures 1 and 2 above. The encryption is done preferably as soon as practical while keeping it within protected hardware domains. Examples of protection of the encryption include so-called HSM (hardware security modules) and / or secure hardware enclaves and / or protected memory and chips. (In terms of software, there can ideally be protected domains as well.) Also, the nodes 16, which are part of the mixing 23 of Figure 1 15, which are hardware computing and communication devices, ideally protect their keys by the best available hardware and encryption software means, such as including so-called HSM and / or secure hardware enclaves and / or protected memory and chips. Furthermore, the comparison means for comparing the encrypted biometric information to determine if a match occurs between a candidate and entry to test or compare from the database 13 is represented by the comparison 20 in Figure 1, and this means can include that hardware, e.g., one or more computers, and software that can accomplish the hamming distance tests described above in connection with, for example, iris scanning and fingerprint scanning to determine whether a match occurs between the candidate and entry for test. The comparison 20 can, in some examples, be given access to the cleartext output and the cleartext output can be protected by hardware means including so-called HSM and / or secure hardware enclaves and / or protected memory and chips. Also, in all three portions of the Figure 1 , so-called TEMPEST hardware elements and techniques can be ideally used to prevent emanations allowing compromise of secrets.

[0051] The control logic section, which is designated generally by the reference numeral 25 and in the lower right portion of the figure, is now described. It performs a process designated by 27 that can repeat step 29 of selecting an entry 15 from the database of encrypted scans and sending that entry to be compared with the current candidate 5. Since the database contains k entries, in the example state shown as mentioned, the “repeat for each database entry” operation 27, shown in conventional flowchart notation for clarity, as will be appreciated, is performed in some examples a full k times without finding a match; this is believed to indicate that the candidate is not in the database and should be added. This is shown by the dot-dash line 31 from the end repeat box 28 to the store candidate in database box 30. If, however, match decision diamond 33 triggers a “y” or yes output 34, then end repeat can be caused, and as a result the candidate is not added to the database, as the match detected indicates that the candidate is already in the database.

[0052] In some examples, as will be appreciated, it may be practical or beneficial or expedient to end a comparison sequence before all the bit positions are compared. One type of such example, which can here be called “early definitive,” is when it becomes clear that no match will be possible, as enough differences have already been found. Another type of example, which can here be called “early likely,” is when the probability of the outcome is high enough that completing all the comparisons can be skipped. For instance, if the bits are in a random order and the first ones all match, at least probability theory would suggest at least to a frequentist it is believed that a match is very likely; similarly, and of more practical interest, is when it becomes unlikely that a match will occur. This latter can, it is believed, be used to safely stop early and save a significant amount of comparing; however, in some examples, the processing can also be done bit by bit and those vectors that are stopped early can save significant processing.

[0053] Turning now to Figure 2, an exemplary combination cryptographic protocol schematic and notation definition, for a mix comparison of a candidate against a database entry, designated by reference numeral 23, is shown in accordance with aspects of the teachings of the present invention. Notation is defined, statements made in the notation, and an exemplary detailed view of the internal state processing of nodes is shown.

[0054] Across the bottom of the figure the permutation notation 37 is defined. The function p(n,ni) is a random permutation. The number of elements permuted is the counting number n. The selection of the particular permutation with n elements is controlled by the second parameter, in. The values of m can range over all possible permutations, n factorial. However, the particular value of the second parameter is considered to be similar to a cryptographic key: ideally randomly and / or unpredictably chosen and kept secret, at least until some point in time. Here, the second parameter is used to show when two or more permutations are to be identical; this is indicated by the same variable name appearing in the particular instances of the function p. Thus, for example, p(5,4) is a permutation of five elements and p(5,4) appealing again indicates the same such permutation. The particular permutation is determined by the integer four in some ordering of the five factorial possible permutations.

[0055] Across the top of the figure some variables and the values they can assume are defined. The variables x,y,z,x 'y'z'are to range over the integers one and two, as indicated by the set-membership or element-of symbol “6” and the set indicated in curly brackets “{ }” as will be understood. Two other variables, c and c, are given a range from one to n, where n is, at least in some examples, the number of bits in the scan images.

[0056] Now, referring to the containing rectangle in the figure, which is labelled “mixing of database entry and candidate with transformations,” and which corresponds to box 23 of Figure 1, to indicate that it is a more detailed view of the rectangle of the same name, as already described with reference to Figure 1.

[0057] The processing by node_l in the re-encryption mix, or whatever mix protocol is used, is shown as the leftmost contained rectangle 16. Two vectors, of n bits each, arc shown horizontally as encoded in the graphical notation shown as a pair of squares as already described with reference to Figure 1. Permutations are shown for each square pair, p(2,x), p(2,y) through p(2,z); these same permutations, as mentioned indicated by instances of the same notation, apply crucially both for the upper vector and the lower vector. The upper vector is, as will be understood, the candidate vector 5 of Figure 1; the lower vector, as will be understood, is the “entry to test” vector 15 also of Figure 1. Thus, as will be appreciated, the same permutation or re-arrangement of the two rectangles is applied to the bit position in the upper vector as is applied to the same bit position in the lower vector. Put differently, for removal of any doubt, if a bit position in the candidate 5 is inverted, that same bit position is inverted by this node in the entry to compare 15; if a bit position in the candidate 5 is not inverted by this node, the same position in the entry to test 15 is also not inverted by this node. Referring to the upper large horizontal curly brace 39, labelled by p(n,c), a random unpredictable permutation, ideally “Independent and Uniformly Distributed” (sometimes “IUD”), as will be understood, is shown as being applied to the ordering of the bit positions of the candidate; similarly, the lower brace for that node indicates that the same permutation is applied to the ordering of the entry to test from the database.

[0058] The identical type of permutation, with the identical constraints, but ideally different random values, are also applied by every mix successively, as indicated by the ellipsis 41 between the nodes, until and including the final node, node ,s.

[0059] As has been described earlier, it is believed that these two types of permutation transformation, when applied in the manner described here, do not change the hamming distance between the two vectors being compared. Again, and for the removal of any doubt, the same bit positions are inverted in each vector and the same rearrangement of position orders is applied to each vector, as will be appreciated. Such operations can be performed by each of 5 nodes, successively, and the hamming distance of the two output vectors it is believed will not be changed, as will be appreciated.

[0060] Turning now to Figures 3A and 3B, a detailed combination block and flowchart diagram of the functionality of an exemplary overall encrypted biometric identity system is described in accordance with aspects of the present invention.

[0061] Referring now to Figure 3A, and more specifically to box 305, it can here be said “forming at least two biometric scans by scanning at least aspects of at least two persons” to mean capturing from at least two people what here can be called “biometric scans,” to mean whatever sensor and / or scanner technology(s) can be used, with pre- and post-processing, as will be understood, to capture biometric information from people, such as for instance but without limitation from the group arteries, veins, capillaries, skin surface features, ear and other body part shapes, genetic information, facial features, gate, typing pattern, and so forth, as will be understood.

[0062] Referring next to box 310, it can here be said “encrypting biometric scans as ordered bits” to mean any way to obscure the underlying what can here be called “plaintext” of a scan, that is the raw data or processed forms of it. For example, encryption, such as for a re-encryption mix or the like and / or coding of whatever type and / or various combinations of the two. What can here be called “ordered bits” are any way to assign ordering or at least partial ordering to information bits related to biometric scan data, such as the position in a vector, a number attribute of an item in a set, and / or any other way to at least roughly identify bit positions, whether ordered or not.

[0063] Referring to box 315, it can here be said “the encryption so that the bits can be inverted by nodes while encrypted” to mean that one or more bits that are in an encrypted form by virtue of being part of the plaintext of an encrypted scan can be inverted. Here a bit can be said to be “inverted” to mean: that if it is one, then it becomes zero; however, if it is zero, then it becomes one. Here a “node” is a party or a computer or another entity that is performing one of typically more than one roles in a cryptographic protocol. For instance, as an example, the nodes of a mix each perform their own mixing permutations ideally without sharing that information with other nodes.

[0064] Referring to box 320, it can here be said “the encryption so that the bits can be permuted by nodes while encrypted” to mean that the encryption allows a transformation, without mainly decrypting, that rearranges the order of the bits, ideally arbitrarily but under the control of the entity doing the transformation.

[0065] Referring to box 325, it can here be said “processing of the encrypted biometric scans by inverting at least roughly unpredictable corresponding bits in at least two encrypted scans” to mean that the encrypted biometrics are acted on by at least one computer and that at least potentially a transformation is made that unpredictably inverts at least two bits, where the bits occupy the same position in the ordering (or the same position in whatever scheme, as mentioned). It can here be said “processing” to mean acting on the encrypted biometric scans with at least one computer to produce from at least one input at least one output. Also, here it can said “roughly unpredictably” to means a random choice, such as that of a cryptographic key, that is unknown at least to some parties and may or may not be made with perfectly uniform probability, as will be understood to be impossible in the limit and expensive to approach in practice and potentially unnecessary for the present purposes.

[0066] Referring to box 330, it can here be said “processing of the encrypted biometric scans by reordering bits at least roughly unpredictably with at least roughly the same permutation in at least two of the encrypted scans” to mean that the bits of at least two encrypted biometrics are rearranged, that is permuted, in essentially if not exactly the same manner and that the permutation is essentially hard for other parties to predict. The “reordering bits” again “roughly unpredictably” to mean that the permutation is like a cryptographic key: it may not be chosen with perfect probability distribution and / or perfect secrecy, but it still is hard to predict for the imagined purposes of an adversary.

[0067] Referring to box 335, it can here be said “computing at least a bound on the hamming distance between at least two biometric scans after processing, so that the hamming distance between the at least two scans is at least bounded” to mean that the number of bit positions whose values differ (i.e., the first is one and the second position is zero or vice versa) between the two biometric scans is revealed or proven to be below a certain number, at least roughly speaking or with reasonable probability, as will be understood. For convenience, it will be pointed out that the “hamming distance” is usually defined to be the number of ones in the bitwise exclusive-or of two bit vectors.

[0068] Referring to box 340, it can here be said “so that the biometric scan cleartext remains significantly hidden” to indicate that the value of the biometric scan before encryption, what can here be referred to conventionally as the “cleartext” of the scan, does not become public, though some small amounts of information and statistics may leak and / or be revealed about it.

[0069] Referring to Figure 3B and starting with box 360, it can here be said “processing, against a candidate, at least portions of a database of encrypted scan information, to check for a match with any database entry” to mean that it is checked whether the candidate biometric scan, which is in encrypted form, is contained in a database of ideally encrypted biometric scans. Here, the term “candidate” can be used to indicate a biometric scan, such as one received from the front end scanners and / or otherwise supplied, that is to be tested for presence in a larger set of such biometric scans. The larger set of biometric scans, which can here be referred to as a “database,” contains plaintext scans ideally only in encrypted form, as will be appreciated.

[0070] Referring to box 365, it can here be said “adding the candidate to the database if the distance is adequate in all tests” to mean that a candidate biometric scan, presumably in encrypted form, has been tested against all or at least almost enough for almost all of the biometric identities in the database, as mentioned, with the system conclusion that the person behind the candidate identity is not in and should be added to the database, then ideally the encrypted biometric would be added in among those in the database. The term “match” can be used here to mean that a subject encrypted identity, such as the candidate, is close enough, such as in hamming distance in some example schemes, to a second subject that the two encrypted biometrics are considered related to the same person.

[0071] Referring to box 370, it can here be said “mixing the database by at least one node and using the mixed database for at least one test” to mean that the encrypted biometrics stored as the “database” as mentioned earlier with reference to the present figure, can be rearranged in an order that is essential random or key-like and essentially unknown to an adversary. This is believed to hide which earlier matches might relate to which subsequent matches.

[0072] Referring to box 375, it can here be said “front-end mixing at least one scanner output to provide at least one candidate for test” to mean that at least one biometric scan is sent through a mix network to the present system, checking and / or database; the effect is that which scanner was involved in collecting which biometric scan would be hidden by the mix nodes and typically require compromise or collusion of all the nodes to determine the correspondence. The term “front-end mixing” can be used here to refer to mixing that at least is positioned to at least obscure from view which scanner supplies which candidate.

[0073] Referring to box 380, it can here be said “the biometric scan encryption being suitable for reencryption mixing” to mean that the type(s) of encryption, including related cryptographic transformations, used in re-encryption mixing, in all its variations, some of which are mentioned as included here by reference, are apple to the cleartext biometric scan in order to form the encrypted biometric.

[0074] Referring to box 385, it can here be said “scanning at least one eye of a person and performing roughly at least one fourier transform to develop a biometric scan” to mean that frequency-domain version of a spatial-domain image makes up the cleartext biometric.

[0075] Turning now to Figure 4A-E, combination block and flowchart diagrams showing the functionality of an exemplary inventive overall encrypted biometric identity system are described in accordance with aspects of the disclosure.

[0076] Referring now to Figure 4A, and more specifically to box 405, it can here be said “encrypting biometric information” to mean that plaintext biometric scan data is encrypted to form encrypted biometric information, by whatever cryptographic technique that at least makes the plaintext difficult to see or learn without the corresponding cryptographic keys.

[0077] Referring to box 410, it can here be said “comparing the encrypted biometric information from at least two potentially different persons for match while the biometric information is encrypted” to mean that comparison of encrypted biometric information is possible and can yield a “match” to indicate that the two encrypted biometrics are from the same person.

[0078] Referring to box 415, it can here be said “so that the biometric information remains significantly hidden” to mean that even though the at least two images can be compared meaningfully, the actual underlying cleartext biometric information remains at least to a practical extent protected from view by the encryption.

[0079] Referring now to Figure 4B, and more specifically to box 425, it can here be said “demonstrating a match to parties that arc unable to decrypt the biometric information” to mean that entities that do not have access to the cryptographic keys needed to decrypt the biometric plaintext can be convinced of whether or not there is a match, as described earlier with reference to Figure 3. Put differently, a public proof of sorts is made related to the match, even though the encrypted biometrics are not publicly decryptable to the extent that the public can recover the biometric plaintext. Referring now to Figure 4C, and more specifically to box 445, it can here be said “storing the encrypted biometric information” to mean that the encrypted biometric information can be retained in a digital form for later testing additional candidate encrypted biometrics.

[0080] Referring now to Figure 4D, and more specifically to box 455, it can here be said “rearranging the encrypted biometric information unpredictably while still allowing computing matches” to mean that when the biometric information is stored the order and / or position of the individual components related to different people can be rearranged to an ordering and / or positioning that is essentially impractical to predict.

[0081] Referring now to Figure 4E, and more specifically to box 465, it can here be said “submitting the biometric information over a mix network so that which scanner submitted which biometric information is hidden” to mean that which of plural biometric scanners obtained the plaintext biometric information related to a particular candidate encrypted biometric can at least be obscured from public view by the submission of the related information through a mix network.

[0082] Turning now to Figure 5A-B, combination block and flowchart diagrams of an exemplary inventive overall encrypted biometric identity system, system components, and their respective functionalities are described in accordance with aspects of the disclosure.

[0083] Referring now to Figure 5A, and more specifically to box 510, it can here be said “encrypting biometric information obtained from at least two persons” to mean that biometric information, such as in digital form, that has been obtained from potentially two different persons, can each be separately encrypted to form two encrypted pieces of biometric information. The information obtained from each person is encrypted by the application of cryptographic transformations, no matter whether unkeyed or how keyed.

[0084] Referring to box 520, it can here be said “with the biometric information still encrypted, comparing the encrypted biometric information of the at least two persons to determine whether the biometric information encrypted matches for those two persons” to mean that the biometric information contained within at least two respective separate pieces of information encrypted information is tested and / or compared to obtain an indication of whether the two correspond to the same person or to different persons. The information that is encrypted, the biometric information, is tested to see if it matches, which would mean that the two persons are at least likely to be the same as their biometric information is close enough.

[0085] The means to accomplish the encrypting of biometric information is described above in connection with Figure 1. Likewise, the means for comparing the encrypted biometric information to determine if matching occurs is described above in connection with Figure 1. It should also be understood that the same means for encrypting and comparing is capable of performing the further functionalities described below in connection with the encrypting of the biometric information, e.g., hiding of the biometric information, allowing a match to be demonstrated, etc.

[0086] Referring now to Figure 5B, and more specifically to box 550, it can here be said “means for obtaining the biometric information from respective portions of the bodies of the at least two persons” to mean any apparatus that can obtain information from the physical presence of persons that can be considered biometric. The biometric information can come from various parts of the body of the person, such as eyes, finger, hands, ears or even vocal cords.

[0087] Referring to box 550, the obtaining means can be one or more of a fingerprint scanner, an iris scanner, a retina scanner, a facial feature scanner, a vein pattern scanner, an anatomic geometry scanner, and a skin surface pattern scanner. The biometric scanning can be of various aspects of persons. Examples include fingerprint ridge patterns, iris patterns, images of the retina, facial feature geometry , patterns of blood vessels and the like in parts of the body, the size and / or shape of various parts of a body such as bones and soft tissues, and ridge patterns and the like of the skin on other portions of the body than the finger tips.

[0088] Referring to box 560, it can here be said “the comparing for match keeps the biometric information obtained from the at least two persons hidden but allows anyone to verify a match” to mean that, although the biometric information is encrypted, and presumably is not readily useful in identifying either one of the persons, nevertheless it can be rendered in a form that allows anyone viewing it to test whether or not there has been a match, that is the two are the same person. ” When the biometric information is encrypted and when it is compared does not reveal the cleartext biometric information. The means for accomplishing this is found in connection with the system of Figure 1 and more particularly the comparison 20.

[0089] Referring to box 565, it can here be said “the comparing includes demonstrating a match to parties that are unable to decrypt the encrypted biometric information” to mean that the match is shown, at least to some level of convincingness, such as based on certain cryptographic assumptions and / or certain probabilities or the like — while the information remains encrypted. Put differently, for definiteness and to remove any doubt, the encrypted biometric information is not decrypted to allow testing or comparison; rather, it is tested or compared while still encrypted. A zero knowledge or minimum disclosure proof technique can be applied to convince a party and / or the decryption allows the plaintext to convince.

[0090] Referring to box 570, it can here be said “a database for storing the encrypted biometric information” to mean that the encrypted biometric information is stored in at least some digital or discretized form, as will be understood; moreover, the individual items of information, each corresponding to encrypted biometrics from ideally a different person, are retrievable mainly separately. ” The biometric information scanned and then encrypted can be retained in a digital form along with other such information in a structure sometimes referred to as a database or any other structure for storing such information.

[0091] Referring to box 575, it can here be said “the encrypting including unpredictable rearranging of the encrypted biometric information while still allowing testing the encrypted biometric information for matching” to mean that the encryption includes keyed permutations of portions of the encrypted biometric information that can be taken to be included as part of the encryption of the cleartext biometric information, as will be understood.” The encryption can include rearranging and / or permuting in accordance with key information, as will be understood, to be a part of the encryption; however, the matching of the encrypted biometrics can, it is believed, still be conducted with such encryption applied.

[0092] Referring to box 580, it can here be said “the mix network configured to receive the biometric information from a scanner and to hide the biometric information travelling from the scanner so that which scanner submitted which biometric information is substantially hidden” to mean that the mix network provides “send anonymity” for the scan messages being sent in from scanners; features of such a network include hiding which entry point and / or network address sent which message, but also in some examples, at what time or order particular messages were sent. The network address, entry node, path through the network and / or even timing of the message can be hidden or obscured by the mix network.

[0093] Turning now to Figure 6A-B, combination block and flowchart diagrams of method steps employed as part of an exemplary inventive overall encrypted biometric identity system are described in accordance with aspects of the disclosure. More particularly, Figures 6A-6B describe the functionality performed by the means of the system described in Figures 5A-5B. Since this functionality is already described in Figure 5A-5B, it is not replicated other than to depict the sequence of steps used to practise the invention, as well as further limitations on the broad steps found in boxes 610 and 620.

[0094] Referring now to Figure 6A, box 610 describes the step of “encrypting biometric information obtained from at least two persons” to mean any way to encode and / or otherwise encrypt biometric information that is obtained from more than one person. Box 620 describes the step, with the biometric information still encrypted, of comparing the biometric information of the at least two persons that is encrypted to determine whether the biometric information that was encrypted does match.

[0095] Referring now to Figure 6B, Box 630 says “obtaining the biometric information from portions of the bodies of the at least two persons” to mean that the information is obtained by scanning the persons.

[0096] Box 635 describes different kinds of scanning to obtain the biometric information, e.g., one or more of fingerprint scanning, iris scanning, retina, facial feature, vein pattern, anatomic geometry, or skin texture scanning is used to obtain the biometric information.

[0097] Box 640 describes the encrypting step and comparing step as keeping the biometric information hidden.

[0098] Box 645 further limits the comparing step as including demonstrating a match to parties that are unable to decrypt the encrypted biometric information.

[0099] Box 650 refers to the step of storing the encrypted biometric information in a database.

[0100] Box 655 describes a further limitation on the encryption wherein the encrypting includes rearranging the encrypted biometric information to be unpredictable while still allowing comparing of the biometric information encrypted for what can here be called “matching” and / or “distance determination.”

[0101] Box 660 describes the step of submitting the biometric information obtained from the at least two persons over a mix network so that which source provided the biometric information is at least hidden from those without access to at least some of the keys and / or other secrets of the mix nodes.

[0102] Referring to box 665, it can here be said “the source is a scanner” to mean that the cleartext biometric scan information is from a device that can perform scanning.

[0103] Turning now to Figure 7A-C, combination block and flowchart diagrams of the functionality of an exemplary inventive overall encrypted biometric identity system are described in accordance with aspects of the disclosure. These figures not only describe a system that has the described functionalities but they also describe a method that includes the transforming steps and filtering out steps to reduce the number of transformations when testing a new candidate for matching purposes.

[0104] Referring now to Figure 7 A, and more specifically to box 710, it can here be said

[0105] “transforming, using a first transformation, items in the database to produce at least database subset cleartext vectors” to mean any way to select a subset of the bits of a collection of items from the database and the same subset from one or more candidate vectors. Referring to box 720, it can here be said “transforming, using the first transformation, at least a new candidate to produce at least a candidate subset cleartex vector” to mean decrypting the encrypted candidate, after the first encryption but leaving the second transformation, to reveal at least the subset of hamming distance or other bits.

[0106] Some such example publications related to searching for search in Hamming distance space and its variations are hereby are incorporated by reference in their entirety to the same extent as if each individual publication, patent or patent application was specifically and individually indicated to be incorporated by reference in its entirety in their entirety by reference as if copied here in the present application: Norouzi, Mohammad, Ali Punjani, and David J. Fleet. "Fast exact search in hamming space with multi-index hashing. "IEEE transactions on pattern analysis and machine intelligence 36.6 (2013): 1107-1119. Qin, Jianbin, et al. "Generalising the pigeonhole principle for similarity search in hamming space. "IEEE Transactions on Knowledge and Data Engineering 33.2 (2019): 489-505. And Jiang, Zhansheng, et al. "Fast nearest neighbour search in the hamming space." MultiMedia Modeling: 22nd International Conference, MMM 2016, Miami, FL, USA, January 4-6, 2016, Proceedings, Part I 22. Springer International Publishing, 2016.

[0107] Referring to box 730, it can here be said “filtering out from further matching for the at least new candidate at least substantially those database items whose subset vectors are at least unlikely to match because of a larger number of differences in the subset cleartext vectors” to mean any way to rank and / or prioritise and / or otherwise evaluate the matching of the candidate with the various vectors for the particular subset so as to reduce at least the likelihood of searching for matches among those that differ most.

[0108] Referring to box 740, it can here be said “so that the number of transformations to test a new candidate is reduced” to mean that by in effect pruning or not pursuing those vectors or portions of the vector database that appear to be less likely to result in matches, the amount of such pursuing is reduced as is the amount of biometric cleartext of the database that would, it is believed, be revealed.

[0109] Referring now to Figure 7B, and more specifically to box 750, it can here be said “transforming by the first transformation a later candidate and filtering out with at least database subset vectors that have been previously processed by the first transformation” to mean that at least some database subset vectors that have been decrypted are used with at least more than one candidate.

[0110] Referring to box 760, it can here be said “changing from a first to a second transformation after a number of candidates” to mean that the subsets of the vectors in the database that are used with more than one candidate ideally would not be used indefinitely but rather would be changed from the first to at least a second subset. Referring to box 770, it can here be said “permuting the database before changing to a second transformation” to mean that from time to time, and ideally for each small number of different transformations, the items in the database are at least potentially re-arranged ideally in an unpredictable random order, such as by composition of permutations supplied by various nodes in a mixing configuration 17, as will be understood.

[0111] Referring now to Figure 7C, and more specifically to box 789, it can here be said “mix nodes each deleting random subsets of items before outputting the items so as to unpredictably reduce the number of items” to mean, for example, that each mix node in a series in effect deletes a randomly chosen subset of the items it receives by not including them in its output, so as to randomly prune and reduce the amount of work and / or size of the database but while keeping hidden at least from any single entity the subset of input items ultimately pruned.

[0112] All manner of variations, substitutions, alternates are anticipated. As just one non-limiting example, two different types of scans can be combined in the same system and at match between at least one of the types of scans can be regarded as a match between the two persons.

[0113] ★ ★ ★ ★ ★

Claims

What is claimed is:

1. A system for biometric identification using encrypted biometric information, comprising: means for encrypting biometric information obtained from at least two candidate persons; and with the biometric information still encrypted, means for comparing the encrypted biometric information of the at least two candidate persons to determine whether the encrypted biometric information matches for those two candidate persons.2 The biometric identification system of claim 1, further comprising: means for obtaining the biometric information from respective portions of the bodies of the at least two persons.3 The biometric identification system of claim 2, wherein: the obtaining means comprises one or more of a fingerprint scanner, an iris scanner, a retina scanner, a facial feature scanner, a vein pattern scanner, an anatomic geometry scanner, and a skin surface pattern scanner.4 The biometric identification system of claim 1, wherein: the means for comparing for match keeps the cleartext biometric information obtained from the at least two persons hidden but allows anyone to verify a match from decrypted information.5 The biometric identification system of claim 1, wherein: the means for comparing comprises demonstrating a match to parties that are unable to decrypt the encrypted biometric information.6 The biometric identification system of claim 1, further comprising: a database for storing the encrypted biometric information.7 The biometric identification system of any one of the preceding claims wherein: the means for encrypting includes unpredictable rearranging of the encrypted biometric information while still allowing comparison of the encrypted biometric information for matching and / or the means for encrypting includes unpredictable inverting of the same portions of the encrypted biometric information while still allowing comparison of the encrypted biometric information for matching.8 The biometric identification system of any one of the preceding claims, further comprising: a mix network, the mix network configured to receive the biometric information from a scanner and to hidethe biometric information travelling from the scanner, so that which scanner submitted which biometric information is substantially hidden.

9. The biometric identification system of any one of the preceding claims, further comprising: storing plural encrypted items of biometric scan information in a database and rearranging the items in a substantially unpredictable order.

10. A method of biometric identification using encrypted biometric information comprising: encrypting biometric information obtained from at least two persons; and with the biometric information still encrypted, comparing the encrypted biometric information of the at least two persons to determine whether the encrypted biometric information matches.

11. The method of claim 10, further comprising: obtaining the biometric information from substantially the same portion of the bodies of the at least two persons.

12. The method of claim 10, wherein: one or more of fingerprint scanning, iris scanning, retina, facial feature, vein pattern, anatomic geometry, or skin texture scanning is used to obtain the biometric information.

13. The method of claim 10, wherein: the encrypting step and comparing step keeps the biometric information hidden.

14. The method of claim 10, wherein: the comparing step comprises demonstrating a match to parties that are unable to decrypt the encrypted biometric information.

15. The method of claim 10, further comprising: storing the encrypted biometric information in a database.

16. The method of claim 10, wherein: the encrypting comprises rearranging the encrypted biometric information substantially unpredictably while still allowing comparison of the encrypted biometric information for matching.

17. The method of claim 10, further comprising: submitting the biometric information obtained from the at least two persons over a mix network so that which source provided which biometric information is substantially hidden.

18. The method of claim 17, wherein: the source is a scanner.

19. A biometric identification system with a database of existing scan data and with new scan data available from time to time having the following functionalities: transforming, using a first transformation, items in the database to produce at least database subset cleartext vectors; transforming, using the first transformation, at least a new candidate to produce at least a candidate subset cleartex vector; filtering out from further comparison for the at least new candidate at least substantially those database items whose subset vectors are at least unlikely to match because of a larger number of differences in the subset cleartext vectors; and so that the number of transformations to test a new candidate is reduced.

20. The biometric identification system of claim 19, comprising: transforming by the first transformation a later candidate and filtering out with at least database subset vectors that have been previously processed by the first transformation.

21. The biometric identification system of claim 19, comprising: changing from a first to a second transformation after transforming a number of candidates with the first transformation.

22. The biometric identification system of claim 21, comprising: permuting the database before changing to a second transformation.

23. The biometric identification system of claim 19, wherein mix nodes each delete random subsets of items before outputting the items so as to unpredictably reduce the number of items.

Images