Methods and systems for secure authentication and / or identification of users

Abstract

A computer-implemented method comprising: receiving, at a first point in time, a first data set from a user and upon receipt of the first data set: performing feature extraction on the first data set to obtain a first feature vector, generating a first integer vector representation of the first feature vector, generating, using the first integer vector representation and a master key, a user-specific key, and sending, to a remote server, a user ID together with the user-specific key.

Description

[0001] Methods and systems for secure authentication and / or identification of users FIELD Embodiments described herein relate to methods and systems for secure authentication and / or identification of users. BACKGROUND The ability to successfully identify and / or authenticate users is a crucial requirement in enabling online transactions to be carried out in a secure manner. One way of achieving this is to utilise a trusted server for securely storing enrolled biometric readings (templates) from users and computing distances between the enrolled biometric readings and biometric readings that are freshly produced / submitted during the authentication / identification process. If the computed distance is less than or equal to an acceptance threshold T, then the user is considered to be successfully authenticated and / or identified. The use of a trusted server nevertheless imposes a heavy cost, both in terms of the real estate needed to house the server, and in ensuring the server is physically secure and well-maintained. Being able to host biometric-based services on the cloud offers a more attractive alternative, as it reduces the need to purchase servers, land etc. and instead enables a more lightweight, subscription-based service to be adopted instead. The biometric matching approach used in the conventional model, however, requires that the server first decrypt user biometrics before distances are computed between them. Such an approach is not acceptable from a security perspective for cloud-based servers, since cloud-based servers are considered to be at greater risk of being compromised. The compromise of data during computation (i.e. whilst it is unencrypted) could lead to leakage of user biometrics, i.e. highly sensitive information. Moreover, cloud-based servers may try to read and use the data in an unauthorised manner. It is desirable, therefore, to provide a means for supporting computation of distances between user biometrics in a privacy preserving manner, so as to support cloud hosted biometric authentication and / or identification services.

[0002] 14294052-1 SUMMARY According to a first aspect of the present invention, there is provided a computer- implemented method comprising: receiving, at a first point in time, a first data set from a user; upon receipt of the first data set: performing feature extraction on the first data set to obtain a first feature vector; generating a first integer vector representation of the first feature vector; generating, using the first integer vector representation and a master key, a user-specific key; and sending, to a remote server, a user ID together with the user-specific key.The first data set may comprise biometric data.Generating the integer vector representation of the first feature vector may comprise: computing the norm of the first feature vector; dividing each value in the first feature vector by the norm; and rounding or scaling the values of the first feature vector into integer values. The method may further comprise: receiving, at a later point in time, a second data set; upon receipt of the second data set: performing feature extraction on the second data set to obtain a second feature vector; generating a second integer vector representation of the second feature vector; generating an encrypted version of the second integer vector representation using the master key; and sending, to the remote server, the encrypted version of the second integer vector representation. The method may further comprise: sending, to the remote server, the user ID together with the encrypted version of the second integer vector representation.The second data set may comprise biometric data.Generating the second integer vector representation of the second feature vector may

[0003] 14294052-1 comprise: computing the norm of the second feature vector; dividing each value in the second feature vector by the norm; androunding or scaling the values of the second feature vector into integer values.According to a second aspect of the present invention, there is provided a computer- implemented method comprising: receiving, at a server, from a user, a user-specific key and a user ID, the user-specific key being generated using (i) an integer vector representation of a first featurevector and (ii) a master key; receiving, at the server, from the user, an encrypted vector and a claimed userID, wherein the vector is encrypted using the master key; processing, by the server, the encrypted vector using the user-specific key to obtain an output value; determining, by the server, whether the output value is equal to or less than a predetermined threshold; and in the event the output value is less than or equal to the threshold, authenticating the claimed user ID as being the same as the user ID. According to a third aspect of the present invention, there is provided a computer- implemented method comprising: (i) receiving, at a server, from a client device, a plurality of ciphertexts, whereineach ciphertext is generated by encrypting the same vector using a different respective master secret key, each ciphertext being accompanied by a label indicating a respective user; (ii) retrieving from storage, by the server, a user-specific key corresponding to the user indicated by the label accompanying a first one of the ciphertexts; (iii) processing, by the server, the first one of the ciphertexts using the user- specific key to obtain an output value; (iv) in the event the output value is less than or equal to a predetermined threshold, determining that the user indicated by the label accompanying the first ciphertext is a user operating the client device; (v) in the event the output value is greater than the threshold, retrieving asecond user-specific key corresponding to the user indicated by the label accompanying a second one of the ciphertexts and processing, by the server, the second one of the ciphertexts using the second user-specific key to obtain a second output value; and

[0004] 14294052-1 (vi) in the event the second output value is less than the threshold, determining that the user indicated by the label accompanying the second ciphertext is the user operating the client device.In the event the second output value is greater than the threshold, the method maycomprise repeating steps (ii) and (iii) for further ciphertexts and their correspondinguser-specific key, until the output value obtained is less than the threshold or else a predetermined number of user-specific keys have been retrieved.Each dataset may comprise an image of a user’s face.According to a fourth aspect of the present invention, there is provided a computer- implemented method comprising: receiving, at a first point in time, a first data set from a user; performing feature extraction on the first data set to obtain a first feature vector; generating a binary vector representation ^ of the first feature vector;receiving a mask for the first data set; generating a binary vector representation MaskA of the mask for the first data set; generating, using the first binary vector representation MaskAand a first mastersecret key msk a user-specific key;applying the binary vector representation MaskA of the mask to the binaryvector representation A of the first feature vector to obtain a masked template vector^^^^^^^; generating a second user-specific key using the masked template vector ^^^^^^^and a second master secret key; generating an inverse vector ^^^^of the binary vector representation MaskA; generating a third user-specific key using the inverse vector ^^^^and a third master secret key; generating a hamming vector ^^^^^^^^by replacing all zero entries in the masked template vector ^^^^^^^with -1; generating a fourth user-specific key using the hamming vector ^^^^^^^^and a fourth master secret key; and sending, to a remote server, a user ID together with the first user-specific key, the second user-specific key, the third user-specific key and the fourth user-specific key.

[0005] 14294052-1 The method may further comprise: receiving, at a later point in time, a second data set from the user; performing feature extraction on the second data set to obtain a second feature vector; generating a binary vector representation B of the second feature vector;receiving a mask for the second data set; generating a binary vector representation MaskBof the mask for the second data set; encrypting the binary vector representation MaskB with the first master secretkey; applying the binary vector representation MaskBto the binary vectorrepresentation B of the second feature vector to obtain a second masked templatevector ^^^^^^^; encrypting the second masked template vector ^^^^^^^with the second master secret key; obtaining an inverse vector ^^^^of the second binary vector representation MaskB; encrypting the inverse vector ^^^^with the third master secret key; obtaining a hamming vector ^^^^^^^^by replacing all zero entries in the masked template vector ^^^^^^^with -1; encrypting the hamming vector ^^^^^^^^with the fourth master secret key; and sending, to the remote server, the encrypted binary vector representation MaskB of the mask for the second data set, the encrypted masked template vector ^^^^^^^, the encrypted inverse vector ^^^^and the encrypted hamming vector ^^^^^^^^. The method may further comprise: sending, to the remote server, the user ID together with the encrypted second binary vector representation MaskB of the mask for the second data set, the encrypted masked template vector ^^^^^^^, the encrypted inverse vector ^^^^and the encrypted hamming vector ^^^^^^^^. The method may further comprise: applying one or more shifts to the binary vector representation MaskBand / or thebinary vector representation B of the second feature vector, wherein each shift

[0006] 14294052-1 represents a shift in relative alignment of the second data set and the mask for the second data set; for each shift, generating a new version of each of the encrypted binary vector representation MaskB of the mask for the second data set, the encrypted masked template vector ^^^^^^^, the encrypted inverse vector ^^^^and the encrypted hamming vector ^^^^^^^^; and sending the new version of each of the encrypted binary vector representation MaskBof the mask for the second data set, the encrypted masked template vector ^^^^^^^, the encrypted inverse vector ^^^^and the encrypted hamming vector ^^^^^^^^to the remote server. According to a fifth aspect of the present invention, there is provided a computer- implemented method comprising: (i) receiving, at a server, from a client enrolment device used to enrol a user with the server, a user ID, a first user-specific key, a second user-specific key, a third user-specific key and a fourth user-specific key; the first user-specific key being generated at the client enrolment device using a binary vector representation MaskA of a first mask and a first master secret key, the second user-specific key being generated at the client enrolment device using a second master secret key and a masked template vector ^^^^^^^obtained by applying the binary vector representation MaskAto a binary vector representation of a first data set A; the third user-specific key being generated at the client enrolment device using a third master secret key and an inverse vector ^^^^of the binary vector representation MaskA; the fourth user-specific key being generated at the client enrolment device using a fourth master secret key and a hamming vector ^^^^^^^^obtained by replacing all zero entries in the masked template vector ^^^^^^^with -1; (ii) receiving, at the server, from a client authentication device used in authenticating the user with the server, a first encrypted vector, a second encrypted vector, a third encrypted vector, and a fourth encrypted vector, the first encrypted vector being generated at the client authentication device byencrypting a binary vector representation MaskB of a second mask using the firstmaster secret key; the second encrypted vector being generated at the client authentication device by encrypting a masked template vector ^^^^^^^using the second master secret key,

[0007] 14294052-1 the masked template vector ^^^^^^^being obtained by applying the binary vector representation MaskB of the second mask to a binary vector representation of a second data set B; the third encrypted vector being generated at the client authentication device by encrypting an inverse vector ^^^^of the binary vector representation MaskBusing the third master secret key; the fourth encrypted vector being generated at the client authentication device by encrypting a hamming vector ^^^^^^^^using the fourth master secret key, the hamming vector ^^^^^^^^obtained by replacing all zero entries in the masked template vector ^^^^^^^with -1; processing each encrypted vector using a respective one of the user-specific keys to return a respective inner product; calculating the value of a distance metric between the first data set when masked by the first mask and the second data set when masked by the second mask as a function of the inner products; and determining, whether the output value is equal to or less than a predeterminedthreshold; and in the event the output value is less than or equal to the threshold, authenticating the user by the server. The method may further comprise: receiving, at the server, from the client authentication device, a plurality of sets of encrypted vectors, each set of encrypted vectors comprising a first encrypted vector, a second encrypted vector, a third encrypted vector and a fourth encrypted vector, wherein for each set of encrypted vectors: the first encrypted vector in the set is generated at the client authentication device by applying a respective shift to the binary vector representation of the MaskB ofthe second mask to obtain a shifted binary vector representation of the MaskB, andencrypting the shifted binary vector representation of the MaskB using the first master secret key; the second encrypted vector is generated at the client authentication device byapplying the respective shift to the binary vector representation of the second data set B to obtain a shifted binary vector representation of the second data set, applying theshifted binary vector representation of the MaskB to the shifted binary vectorrepresentation of the second data set to obtain a masked template vector ^^^^^^^for the respective shift, and encrypting the masked template vector ^^^^^^^using the

[0008] 14294052-1 second master secret key; the third encrypted vector is generated at the client authentication device by encrypting an inverse vector ^^^^of the shifted binary vector representation MaskBusing the third master secret key; andthe fourth encrypted vector is generated at the client authentication device by replacing all zero entries in the masked template vector ^^^^^^^for the respective shiftwith -1 to obtain a hamming vector ^^^^^^^^ and encrypting the hamming vector^^^^^^^^using the fourth master secret key; the method further comprising, for one or more of the sets of encrypted vectors: processing each encrypted vector within the set using a respective one of the user-specific keys to return a respective inner product; calculating the value of a distance metric between the first data set when masked by the first mask and the second data set when masked by the second mask as a function of the inner products; and determining, whether the output value is equal to or less than a predetermined threshold; and in the event the output value is less than or equal to the threshold for one of thesets of encrypted vectors, authenticating the user by the server. According to a sixth aspect of the present invention, there is provided a computer- implemented method comprising: (i) receiving and storing, at a server, for each one of a plurality of users, a first user-specific key, a second user-specific key, a third user-specific key and a fourth user-specific key; wherein for each user: the first user-specific key is generated using a binary vector representation MaskAof a first mask and a first master secret key of the user; the second user-specific key is generated using a second master secret key of the user and a masked template vector ^^^^^^^obtained by applying the binary vector representation MaskAto a binary vector representation of a first data set A; the third user-specific key is generated using a third master secret key of the user and an inverse vector ^^^^of the binary vector representation MaskA; and the fourth user-specific key is generated using a fourth master secret key of the user and a hamming vector ^^^^^^^^obtained by replacing all zero entries in the masked template vector ^^^^^^^with -1; (ii) receiving, by the server, from a client device, for each one of the users, a

[0009] 14294052-1 group of ciphertexts, each group being accompanied by a label indicating the respective user, each group of ciphertexts comprising: a first ciphertext generated by encrypting a binary vector representation MaskBof a mask using the first master secret key of the respective user; a second ciphertext generated by encrypting a masked template vector ^^^^^^^using the second master secret key of the respective user, the masked template vector ^^^^^^^being obtained by applying the binary vector representation MaskB of the first mask to a binary vector representation of a data set B; a third ciphertext generated by encrypting an inverse vector ^^^^of the binary vector representation MaskBusing the third master secret key of the respective user; and a fourth ciphertext generated by encrypting a hamming vector ^^^^^^^^using the fourth master secret key of the respective user, the hamming vector ^^^^^^^^obtained by replacing all zero entries in the masked template vector ^^^^^^^with -1; (iii) selecting a first one of the groups of ciphertexts; (iv) retrieving the user-specific keys for the user indicated by the label accompanying the first group of ciphertexts; (v) processing each ciphertext in first group of ciphertexts using a respective one of the retrieved user-specific keys to return a respective inner product; (vi) calculating the value of a distance metric as a function of the inner products; and (vii) determining, whether the output value is equal to or less than a predetermined threshold; (viii) in the event the output value is less than or equal to the threshold, determining that the user indicated by the label accompanying the first group of ciphertexts is the user operating the client device.In the event the output value is greater than the predetermined threshold, the methodmay comprise repeating steps (iii) to (viii) for one or more groups of ciphertexts, untilthe output value obtained is less than the threshold or else a predetermined number ofgroups of ciphertexts have been selected.The method may further comprise: (ii) receiving, by the server, from a client device, for each one of the users, aplurality of groups of ciphertexts, each plurality of groups being accompanied by thelabel indicating the respective user, each group of ciphertexts in each of the plurality of

[0010] 14294052-1 groups comprising a first ciphertext, a second ciphertext, a third ciphertext, and a fourth ciphertext; wherein for each group of ciphertexts in the plurality of groups received from a user: the first ciphertext in the respective group is generated by applying a respectiveshift to the binary vector representation of the MaskB of the second mask to obtain ashifted binary vector representation of the MaskB, and encrypting the shifted binary vector representation of the MaskB using the first master secret key of the respective user; the second ciphertext is generated by applying the respective shift to the binaryvector representation of the second data set B to obtain a shifted binary vector representation of the second data set, applying the shifted binary vector representationof the MaskB to the shifted binary vector representation of the second data set to obtaina masked template vector ^^^^^^^for the respective shift, and encrypting the maskedtemplate vector ^^^^^^^ using the second master secret key of the respective user;the third ciphertext is generated by encrypting an inverse vector ^^^^of theshifted binary vector representation MaskB using the third master secret key of therespective user; andthe fourth encrypted vector is generated by replacing all zero entries in themasked template vector ^^^^^^^ for the respective shift with -1 to obtain a hammingvector ^^^^^^^^ and encrypting the hamming vector ^^^^^^^^ using the fourth mastersecret key; the method comprising: (iii) selecting, from a first one of the plurality of groups of ciphertexts, a first one of the groups of ciphertexts; (iv) retrieving the user-specific keys for the user indicated by the labelaccompanying the first one of the plurality of groups of ciphertexts;(v) processing each ciphertext in first group of ciphertexts using a respectiveone of the retrieved user-specific keys to return a respective inner product;(vi) calculating the value of a distance metric as a function of the inner products; and (vii) determining, whether the output value is equal to or less than a predetermined threshold; (viii) in the event the output value is less than or equal to the threshold, determining that the user indicated by the label accompanying the first one of theplurality of groups of ciphertexts is the user operating the client device.14294052-1 In the event the output value is greater than the predetermined threshold, the methodmay comprise repeating steps (iii) to (viii) for one or more other groups of ciphertexts inthe first one of the plurality of groups of ciphertexts.In the event the output value is greater than the predetermined threshold for each ofthe one or more other groups of ciphertexts in the first one of the plurality of groups of ciphertexts, the method may comprise: selecting, from a second one of the plurality of groups of ciphertexts, a first one of the groups of ciphertexts; and repeating steps (iii) to (viii) for one or more groups of ciphertexts in the secondone of the plurality of groups of ciphertexts.Each user-specific key may be generated as a function of its respective master secretkey.The user specific key sk may be generated by computing ^^ = ^ + ^^^, where:^^is the first integer vector representation of the first feature vector; uis a vector of length ^ + ^ with elements sampled uniformly at random from^^, where n and q are predefined values and k is the length of the first feature vector;and ^is a matrix ^^^ where ^^ is the identity matrix of size ^ × ^ and S is an n x kmatrix of random values.The first master secret key may comprise a tuple (u1, S);The second master secret key may comprise a tuple (u2, S);The third master secret key may comprise a tuple (u3, S); andThe fourth master secret key may comprise a tuple (u4, S);wherein: u1 is a first vector of length ^ + ^ with elements sampled uniformly at randomfrom ^^; u2 is a second vector of length ^ + ^ with elements sampled uniformly atrandom from ^^; u3 is a third vector of length ^ + ^ with elements sampled uniformly at randomfrom ^^, 14294052-1u4 is a fourth vector of length ^ + ^ with elements sampled uniformly at randomfrom ^^; ^is an n x k matrix of random integer values, ^^, where n and q are predefinedvalues and k is the length of the first feature vector.The first user-specific key ^^^ may be generated by computing ^^^ = ^^ + ^^^^;The second user-specific key ^^^ may be generated by computing ^^^ = ^^ + ^^^^;The third user-specific key ^^^ may be generated by computing ^^^ = ^^ + ^^^^;The fourth user-specific key ^^^ may be generated by computing ^^^ = ^^ + ^^^^; where: ^^′ is the binary vector representation MaskA of the first mask;^^′ is the masked template vector ^^^^^^^; ^^′ is the inverse vector ^^^^; ^^′ is the hamming vector ^^^^^^^^; ^is a matrix , where ^^ is the identity matrix of size ^ × ^. Each master secret key may be derived in part from a combination of the same rootkey and a respective unique label using a Key Derivation Function.Each data set may comprise an image captured by a camera of a client device.Each image may be an image of a user’s eye. The mask applied to the respectiveimage may be such as to isolate the user’s iris in the image.According to a seventh aspect of the present invention, there is provided a computer-readable storage medium comprising computer executable instructions that when executed by a computer will cause the computer to carry out a method according to any one of the first, second, third, fourth, fifth and sixth aspects of the invention. According to an eight aspect of the present invention, there is provided a computer system configured to carry out a method according to any one of the first, second, third, fourth, fifth and sixth aspects of the invention. 14294052-1 BRIEF DESCRIPTION OF DRAWINGS Embodiments of the invention will now be described by way of example with reference to the accompanying drawings in which: Figure 1 shows an example system according to an embodiment, comprising a client device and cloud-based server; Figure 2 shows a flow-chart of steps carried out by the client device as part of an enrolment process; Figure 3 shows steps carried out by an enrolled user when seeking to authenticate themselves to the cloud-based server;Figure 4 shows a sequence of steps as carried out by the cloud-based server in orderto authenticate the user of the client device; Figure 5 shows a sequence of steps as carried out by the client device in order for the cloud-based server to identify the user from among a plurality of users to have previously enrolled with the server; Figure 6 shows a sequence of steps as carried out by the cloud-based server in order to identify the user of the client device;Figure 7 shows an image of a user’s eye, together with a mask for capturing abiometric image of the user’s iris;Figure 8 shows a flow-chart of steps carried out by a client device as part of anenrolment process; Figure 9 shows a flow-chart of steps carried out by the cloud-based server as part of an enrolment process; Figure 10 shows steps carried out by an enrolled user when seeking to authenticate themselves to the cloud-based server;Figure 11 shows an example of how the relative alignment between the user’s eye and14294052-1the image mask as shown in Figure 7 may shift for different image acquisitions;Figure 12 shows a sequence of steps as carried out by the server device in order forthe cloud-based server to authenticate a user from among a plurality of users to havepreviously enrolled with the server;Figure 13 shows steps carried out by an enrolled user when seeking to identifythemselves to the cloud-based server; andFigure 14 shows a sequence of steps as carried out by the cloud-based server in orderto identify the user of the client device. DETAILED DESCRIPTION Embodiments described herein enable a matching distance between two sets of biometric data to be captured in a privacy preserving manner and are well suited to support cloud-based authentication and identification solutions. Embodiments described herein are based on so called ‘functional inner product encryption’, an example of which is the lattice based functional inner product encryption(IPE) scheme described in “Cheon J. et al., “Lattice-Based Secure BiometricAuthentication for Hamming Distance”, in proceedings of ACISP 2021, J. Baek and S.Ruj (Eds.), LNCS 13083, pp. 653–672, 2021” (referred to in the following as “Cheon, J.et al.”). Such schemes allow the inner product of two vectors to be calculated in a privacy preserving way. More specifically, one of the vectors is turned into a “user- specific key”. The user-specific key has the property that even if an adversary can read it, they would be unable to obtain any information about the vector from which it was generated. The second vector is simply encrypted, so as to provide its confidentiality protection. The functional inner product encryption scheme is able to take the user- specific key and the encrypted vector, and obtain from these the inner product of the two underlying vectors. It is important to note that this computation does not require decryption of the underlying vectors; a computer may perform this computation without any ability to decrypt the underlying vectors, or indeed obtain any information about them besides the inner product.A first embodiment in which the approach proposed in Cheon, J. et al is adapted foruse in an authentication protocol will now be described with reference to Figures 1 to 6. 14294052-1The present embodiment is applicable to authentication protocols that rely onbiometrics such as facial biometrics, where the biometrics can be represented asfloating point vectors and the differences between the biometrics calculated as thecosine distance between those vectors.Figure 1 shows an example system for implementing the protocol according to the firstembodiment. The system comprises a client device 101 and a cloud-based server 103 that are in communication with one another over a network. The server 103 may be used to authenticate or identify a user of the client device 101. Having authenticated and / or identified the user, the server may facilitate access to one or more services forthe user, either by providing those services directly itself, or providing confirmation toother devices or servers of the user’s authentication / identity. In order to perform user authentication or identification, the user of the client device must first enrol with the server. Figure 2 shows a flow-chart of steps carried out by the client device in order to complete the enrolment. Beginning in step S201, the client device receives, from the user, a template data set. The template data set will serve as a reference data set for use in authenticating / identifying the user at a later point in time. The template data set may comprise a set of biometric data specific to the user. For example, the template data set may comprise an image of part of the user’s body, such as their face or fingerprint, or a recording of the user’s voice. In step S203, the client device performs feature extraction on the template data set. Feature extraction may be carried out using one of a number of known techniques inthe art. For example, one or more trained machine learning algorithms may be used toobtain an embedding of the template data set that is unique to the template data set and which provides a lower-dimensional representation of that data. The embedding may define a reduced set of features that is able to summarize information of interest in the template data whilst removing other irrelevant data.Having performed feature extraction, the client device now outputs a vector ^ of floatingpoint values that represent the extracted features. The client device then performs the following steps:(i) computes the norm (magnitude) ||^|| of the feature vector ^;(ii) divides each value in the vector ^ by the norm ||^||; and(iii) scales or rounds each value in the vector to an integer value. 14294052-1The vector of floating point values is next presented as a vector of integers ^’ (stepS205).In step S207, the client device generates a master secret key msk and stores the keysecurely on the device. The master secret key msk may be stored in association with auser ID for the user in question. The master secret key must be unique anddistinguished from any key previously used for a particular set of scheme parameters. The master secret key consists of two variables:(i) A vector ^ of length ^ + ^ with elements sampled uniformly at random from ^^(ii) An (^ + ^) × ^ matrix ^ = ^^^ where ^^ is the identity matrix of dimension ^ × ^and ^ is an ^ ^ ^ matrix with sampled randomly from ^^ using the DiscreteGaussian distribution with width parameter ^.Here, the values ^ and ^ are underlying parameters of the encryption scheme and canbe selected based on the required security level of the scheme; ^ is the length ofvectors ^ and ^ (more specifically, the number of elements in each vector ^ and ^) andis a pre-defined parameter from the biometric scheme (the number of features captured from each user’s face). ^^is understood to mean integer values mod ^; for the presentscheme, this means integers ^ in the range –^ / 2 < ^ <= ^ / 2. It will be appreciatedthat arithmetic is carried out by adding / multiplying the integers and then taking the remainder after dividing by ^. Next, in step S209, the client device generates a user-specific key using the mastersecret key msk and the vector ^’. The user-specific key ^^ is found by computing ^^ =^ + ^^′, where ^ is the matrix from the master secret key. The user-specific key^^ will be a vector of length ^ integer values mod ^, where ^ = ^ + ^. .In step S211, the client device forwards the user-specific key and user ID to the cloud- based server. The user ID serves to associate the key with the particular user, and may comprise the user’s name, email address or phone number, for example. It will be understood here that standard security measures are adopted to preserve the integrity, authenticity and confidentiality of the data transmitted from the client device to the cloud-based server. For example, encryption and signatures are adopted as part of the 14294052-1 network protocol. It will be further understood that the received user key and ID are securely stored on the cloud-based server i.e. integrity protected. With the clientdevice having forwarded the user-specific key and user ID to the cloud-based server,enrolment is now complete. Figure 3 shows steps carried out by an enrolled user when seeking to authenticate themselves to the cloud-based server at a later point in time. The user begins by inputting a new data set that corresponds to that used as the template data set during enrolment (step S301). For example, in the event that enrolment was carried out based on an image of the user’s face, the user may provide a new facial image, by taking a photo of themselves with a camera of the client device. As part of this process, the client device may prompt the user to provide the necessary set of input data.In step S303, the client device performs feature extraction on the input data set, in thesame way as when performing feature extraction on the template data set in step S203 of Figure 2.In step S305, the client device proceeds to generate a vector ^ of floating point valuesthat represent features extracted from the newly input data set. As was the case inenrolment, the client device computes the norm (magnitude) ||^|| of the feature vector^, divides each value in the vector ^ by the norm ||^||, performs scaling and roundingof the values into integers, and outputs the vector of floating point values as a vector ofintegers ^’.Having calculated the vector y’, the client device now generates a ciphertext byencrypting the vector y’ using the master secret key msk (step S307) and forwards thevector ^^ = ^^^^^^(^^) to the cloud-based server, together with the user ID (stepS309). It will be appreciated here that the master secret key msk used for encryptingthe vector y’ must be the same master secret key as was used during the enrolmentphase; further detail of how to ensure that the client device can ensure it selects thecorrect master secret key is provided later on below. Figure 4 shows a sequence of steps as carried out by the cloud-based server in order to authenticate the user of the client device. As shown in Figure 4, in order to perform authentication, the cloud-based server must first be in possession of the user-specific key and user ID from the user. It will be appreciated that receiving the user-specific 14294052-1 key and the user ID forms part of the stage of enrolment described with reference to Figure 2 above. Having received user key and ID, these are securely stored in the cloud-based server (step S401). Authentication commences in step S403, in which the cloud-based server receives from the client device the vector ^’, as generated in step S307 of Figure 3. Onreceiving this data, the cloud-based server retrieves the user specific key sk associatedwith the user’s claimed ID from the secure storage. In step S405, the cloud-basedserver processes the received vector Y’ using the user specific key sk. By virtue of theuser specific key sk being derived from the master secret key msk and x’, the result ofprocessing the vector Y’ with the user specific key sk is to return the inner product of x’and y’. The output value is then converted back into floating point value representationby re-scaling (step S407). The re-scaled value is equal to the inner product of x and y,divided by ||^|| ||^||, which is the cosine similarity between ^ and ^. The cosinedistance can then be simply calculated by the cloud-based server as the cosinesimilarity value subtracted from 1. In step S409, the cloud-based server determines whether the cosine distance ascalculated in step S407 is below or equal to a predefined threshold. In the event thecosine distance is below or equal to the threshold distance, the user is authenticated (step S411). The server may then go on to perform another operation, such as providethe user with an authentication token or physical access to a room. If the cosinedistance is found to be above the threshold, the user is not authenticated.As discussed above, when processing the received ciphertext (encrypted vector) withthe user specific key ^^, the same master secret key msk must have been used togenerate both the user secret key and the ciphertext. If different master secret keyshave been used, then the inner product that is output will be incorrect. It is alsoimportant for the security of the scheme that a master secret key is only used for asingle user secret key generation (i.e. user enrolment). Hence, not only must themaster secret key msk be unique for each user, but if ever that user was to enrol again(needing a new user-specific key generation) then a new master secret key will also need to be generated for that user. The same master secret key can, however, be used for multiple encrypt operations (i.e. user authentications).It follows that unique master secret keys must be used each time a user secret key isgenerated, but that when performing an authentication, the same master secret key as 14294052-1 was used for enrolment will need to be selected. In the case where the client deviceused for enrolment and authentication is unique to a particular user (e.g. the clientdevice is that user’s personal mobile phone), these requirements may be met by storing the master secret key on the client device and using that master secret key whenever the client device is used for authenticating the user. In other embodiments, the client device may need to serve multiple users. For example, the client device may comprise an authentication terminal at building or site entry. In this case, the client device may store all master secret keys, and retrieve the one associated with the claimed user at authentication. Storing all master secret keys for multiple users may,however, become impractical if the number of users is very large. There is also apotential key management problem, in that each new enrolment will require a securedistribution of the generated master secret key to all trusted clients. A solution to thisproblem is to derive all master secret keys from a common root key. Here, each specific master secret key can be derived from a combination of the root key with a unique (public) label using a suitable Key Derivation Function (KDF). This means that a trusted client need only store one root key, but can generate master secret keys as and when needed for authentication. As noted above, the master secret key consists of two variables:(i) A vector ^ of length ^ + ^ with elements sampled uniformly at random from ^^(ii) An (^ + ^) × ^ matrix ^ = ^^^ ^ where ^^ is the identity matrix of dimension ^ × ^and ^ is an ^ ^ ^ matrix with sampled randomly from ^^ using the DiscreteGaussian distribution with width parameter ^.One way to ensure uniqueness of the master key each time it is generated is to use anew matrix ^ (or equivalently ^) for each user secret key generation. However, a morepreferable approach is to use a different vector ^ each time, with the matrix ^ beinggenerated once in a setup stage and then reused for all enrolments. Using a differentvector ^ each time is sufficient to ensure uniqueness, and is more efficient as thevector ^ is significantly smaller than ^ and only requires uniformly random sampling,which is simple to accomplish with common KDFs. The matrix ^ can be stored alongwith the root key on all devices that need to perform enrolments or authentications. It is recommended that a NIST approved KDF from Reference 1 (“Recommendation for Key Derivation Using Pseudorandom Functions”, NIST Special Publication 800, NIST SP 800-108r1-upd1, Lily Chen, Computer Security Division, Information Technology 14294052-1 Laboratory , August 2022”) is selected for this purpose (e.g. “KDF in Counter Mode”based on HMAC as the Pseudo Random Function (PRF) – see “The Keyed-HashMessage Authentication Code (HMAC)”, FIPS PUB 198-1 FEDERAL INFORMATION PROCESSING STANDARDS PUBLICATION, Information Technology Laboratory, National Institute of Standards and Technology, Gaithersburg, MD 20899-8900, July2008). To ensure collisions are unlikely (i.e. to ensure each vector ^ is indeed unique),the root key should be of size 256 bits for the selected security parameter of 128-bits, and a hash function with input length at least 256 bits should be selected (e.g. SHA-256). The remaining question is then how to manage the labels used to identify eachuser, and in turn identify which master secret key is to be retrieved for that particularuser. The user IDs themselves provide a natural choice of labels and make sense inthe context of authentication, as the authentication process is attempting to confirm a user ID, and hence the user ID must be known or presented during authentication in any case. However, other options may make sense, such as a simple sequence number, or a combination of user ID and sequence number to allow for multiple enrolments by the same user. Such options would require the label to be stored somehow by the user after enrolment, and presented at authentication. Accordingly, by using the root key in conjunction with the user’s unique ID / label and the KDF, it is possible to derive a master secret key for each user without the need to permanently store each user’s master secret key on the client device. When seeking to authenticate a user, the client device can use the label associated with that user(e.g. the user ID) to ensure that when encrypting the vector y’ the correct master secretkey is selected i.e. the same master secret key as was originally used in generating that user’s user-specific key during the enrolment phase. In addition to authenticating a user, the techniques described herein may also be utilised in identifying a user from one of a plurality of different users. Regardless of whether the cloud-based server performs the step of authenticating the user of the client device, or identifying that user, the user will perform the same process of enrolment as shown in Figure 2. It is possible that multiple different users will be enrolled with the cloud-based server and the server will identify the particular user from among the plurality of users to have previously enrolled.An embodiment in which the cloud-based server is used to identify the user of the clientdevice will now be described with reference to Figures 5 and 6. Figure 5 shows a sequence of steps as carried out by the client device in order for the cloud-based 14294052-1 server to identify the user from among the plurality of users to have previously enrolledwith the server. Here, steps S501 to S505 reproduce steps S301 to S305 exactly. Instep S507, the client device performs a similar operation to step S303, but rather thanencrypting the vector ^’ with a single master secret key, the client device nowgenerates a ciphertext for each one of the master secret keys stored on the device; that is, the client device generates a respective vector Y’ using each master secret key stored on the device. The client device further associates each one of the generatedvectors Y’ with a label identifying the respective master secret key. In step S509, theclient device sends the vectors Y’ to the cloud-based server together with theassociated labels. Figure 6 shows a sequence of steps as carried out by the cloud-based server in order to identify the user of the client device. In step S601, the server receives the encryptedvectors ^’ from the client device, together with the associated labels. In step S603, theserver selects one of the encrypted vectors ^’ and using the label, retrieves frommemory the user-specific key sk associated with that user (i.e. the user whose mastersecret key was used to encrypt the vector ^’). The user-specific key is itself stored bythe server in conjunction with the user ID as supplied during enrolment. In step S605,the server processes Y’ using the user-specific key, so as to return the inner product ofx’ and y’. The output value is then converted back into floating point valuerepresentation by re-scaling (step S607) to return the cosine similarity between x and y.The cosine distance between x and y may then be computed as before as the cosinesimilarity subtracted from 1.The cosine distance is compared with a predefined threshold (step S609). In step S611, if the cosine distance is less than or equal to the threshold, the server is able toidentify the user is that whose user-specific key was retrieved in step S603.Conversely, if the cosine distance is above the threshold, the server is able to deducethat the user-specific key sk used to process the vector Y’ is not the same key as wasoriginally generated using the vector x’ during enrolment (see step S207 of Figure 2).Following this, the server is able to determine that the user is a different user from thatassociated with the user-specific key sk retrieved in step S603. The server may thenselect a new one of the encrypted vectors ^’, together with the corresponding userspecific key (step S613) and proceed through steps S605 to S609 using the newlyselected user-specific key to process the vector Y’, The process may repeat until suchtime as the server returns a positive result in step S609. The user is then found tohave the identity associated with the successful user-specific key.14294052-1The need to encrypt the vector ^’ with each one of the master secret keys means thatthe above identification approach may not be applicable where the pool of users is especially large i.e. where there are a large number of users to have enrolled with the server, and where a respective encrypted vector must be generated each time theserver needs to identify an individual one of those users from that pool. Nevertheless,the above approach may still be suitable in certain scenarios, such as “watchlist” applications. If the watchlist is small (e.g. a few hundred users) and the labels are simple sequence numbers, then the client device may produce the required ciphertexts / encrypted vectors ^’ for all possible labels / users without undue overhead.Accordingly, through use of the functional inner product encryption described above, cosine distances may be computed between biometrics represented as vectors of floating point numbers in a privacy preserving manner by a single cloud-based server. By proceeding in this way, the server (or other adversary) is unable to learn raw user templates, through observation or via trying to reverse engineer any data stored by the cloud-based server. The cloud server may be used to perform the distance computations to support authentication and / or identification use cases, without risk of the server either learning the raw data and using it in an unauthorised manner, or leaking raw data in case of compromise during computation.The methods as discussed above are applicable in authentication schemes in whichthe biometrics (e.g. facial biometrics) can be represented as floating point vectors and the differences between them calculated as the cosine distance between those vectors.However, some authentication protocols may involve additional processing steps thatnecessitate a different approach. As an example, we can consider an iris-matchingtechnique. Referring to Figure 7, the enrolment phase of the iris-matching techniqueincludes capturing a template image 701 of a user’s eye(s), together with a mask 703,and converting both the template image and the mask into binary vectors. The maskvector is used to remove bits from the template vector during matching calculations, toensure that only useful (discriminative) bits of the template are made use of.Authentication may be carried out by determining the Hamming distance between the masked template 705 and a newly captured image of the user’s iris, again with themask applied to it. Here, the authentication scheme must accommodate the fact thatthe input data set used in enrolment comprises a combination of two vectors, namely the vector corresponding to the underlying template image and the vectorcorresponding to the applied mask; likewise, the input image used for authenticating / 14294052-1identifying the user will comprise a combination of these two vectors.In what follows, an embodiment will be described in which matching is performed in aprivacy preserving manner by computation of hamming distances between thesedifferent input vectors. The described embodiment extends the approach described inCheon J., et al. to support a commonly applied iris matching process. More broadly,the described embodiment facilitates the use of inner product encryption (IPE) inauthentication / identification protocols where the data sets being compared with oneanother include both an underlying template vector and a mask vector.The following notation will be used:• During Enrolment, a template vector A and a mask vector MaskA are captured.• During Authentication, a template vector B and a mask vector MaskB are captured.• The inner product between two vectors A and B is denoted ^^,^^.• The Hamming Distance between two vectors A and B is denoted ^^(^, ^).• ⊕ denotes XOR (Exclusive-OR).• ⋀ denotes AND.• denotes NOT.• ‖⋯ ‖ denotes the L1 norm, which is the sum of the entries of the vector. For binaryvectors, this is equivalent to the number of non-zero entries.• ℓ(^) denotes the number of elements in the vector A. Note that in the describedimplementations, each vector will have the same length, with that length being known by both the client and server. It will be appreciated that for binary vectors: ^‖^ ⊕ ^‖ = ^^(^, ^)^ ‖^ ⋀ ^‖ = ^^,^^^ Hamming distances can be calculated as inner products with some pre-processing of the vectors involved, as shown in Cheon, J. et al. If all “0” elements are replaced with -1, then it can be shown that ^^(^, ^) =(ℓ(^) − ^^,^^)⁄ 2.Based on the above, the following distance metric is used by the matching algorithm: 14294052-1‖(^ ⊕ ^)⋀^^^^ ⋀^ ‖^^ ^ ^ ^^^^ In order to utilise the IPE approach described in Cheon, J. et al., the vectors A, MaskA,B and MaskBneed to be pre-processed into vectors for which the application of inner products alone will be sufficient to calculate the distance d. Moreover, any innerproduct can only involve a vector pre-processed from A and / or MaskA, together with avector pre-processed from B and / or MaskB. It is not possible, for example, to use innerproducts where one of the input vectors is a combination of A and B; this is becausesuch combinations of vectors will not be available at enrolment or authentication(enrolment can only access vectors related to A and MaskA, and authentication canonly access vectors related to B and MaskB. This presents a challenge in that thenumerator in the above expression has no simple or obvious way of being calculated from vector inner products whilst also complying with these other constraints.The solution to the above problem resides in determining that the distance d can bewritten instead as: ^^(^, ^^^^^), (^, ^^^^^)^ =‖(^⋀^^^^^) ⊕ (^⋀^^^^^)‖ − ‖(^⋀^^^^^)⋀¬^^^^^‖ − ‖(^⋀^^^^^)⋀¬^^^^^‖ The proof of the above statement can be verified by writing out truth tables for the twoexpressions and showing equivalence. Note that this form of the distance d satisfies allthe constraints as discussed above. Each individual term in the expression involvesjust A and / or MaskA, or B and / or MaskB. These terms are combined using XORs orANDs, which correlate to hamming distances (which can be computed as inner products) and inner products respectively.It will be appreciated that the specific formulation for ^^(^, ^^^^^), (^, ^^^^^)^ aboveis a Boolean formula that may be written in many equivalent ways; for example, theformula may be modified by making use of equivalents such as ^ ⊕ ^ ≡ (^ ∧ ¬^) ∨(¬^ ∧ ^); or ^ ∨ (^ ∨ ^) ∧ (^ ∨ ¬^)) ≡ ^ ∨ (¬^ ∧ ^). As such, using theembodiments described herein, and in particular, by calculating the different vectorsdescribed below, it will be possible to formulate a host of different Boolean formulaethat satisfy the conditions needed to utilise the IPE approach described in Cheon. 14294052-1 As in the example shown in Figures 1 to 6, the process commences with an enrolment phase in which the user provides the cloud server with a reference biometric template and associated ID (e.g. user’s name), which it can use to later authenticate and / oridentify the user. Figure 8 shows the steps carried out in the enrolment phase in thepresent embodiment. As before, the user may capture their biometric reading on aclient device (step S801), which then performs feature extraction on the biometricreading to keep features of interest, and remove irrelevant data (step S803). Havingperformed feature extraction, the client device now outputs a binary vector A thatrepresent the extracted features (step S805).In step S807, the client device captures a mask that is to be applied to the templatedata set and similarly generates a binary vector representation of that mask MaskA(step S809). At this stage, the biometric consists of the binary vectors A and MaskA.In steps S811 to S815, the client device determines the following vectors:^^^^^^^ = ^⋀^^^^^ (the template vector with mask applied)^^^^ = “inverse” of the mask vector) and^^^^^^^^ where ^^^^^^^^ is the vector obtained by replacing all 0 entries in the vector^⋀^^^^^with −1. In step S817, having obtained the vectors ^^^^^^^^^^^, ^, ^^^^ and ^^^^^^^^ , theclient device generates four master secret keys, msk1, msk2, msk3, msk4 and storesthese securely on the device. Each of the generated master secret keys must be unique and distinguished from any other previously used for a particular set of schemeparameters. Each master secret key msk is obtained using the same approach asdescribed above in step S207 of Figure 2, the master secret key being a tuple (u, S),where u is a vector of length m of random integer values mod q and S is an n x k matrixof random integer values mod q. As before, the values m, n and q are underlyingparameters of the encryption scheme and can be selected based on the requiredsecurity level of the scheme; k is the length of vectors ^, ^^^^ ^^^^^^ ^^^^, ^ , ^ and^^^^^^^^. Next, in step steps S819 to S825, the four master secret keys are used to generate respective user-specific keys for each one of the vectors ^^^^^^^^^^^, ^, ^^^^ and^^^^^^^^ . The client device then forwards the user-specific keys together with the14294052-1 user ID to the server (step S827).Figure 9 shows the steps carried out by the server as part of the enrolment process.Here, the server receives the user-specific keys and the user ID (step S901) and stores them in memory (step S903). It is assumed here that suitable security measures are adopted to preserve the integrity and confidentiality of the data transmitted from the client device to the server (e.g. encryption and signatures are adopted as part of the network protocol) and that the received user keys and user ID are securely stored on the server in terms of integrity protection.Figure 10 shows steps carried out by the user during the authentication phase. Theuser captures a fresh biometric data set on the client device (step S1001), which thenperforms feature extraction on that data set (step S1003). The client device outputs abinary vector B0 that represents the extracted features (step S1105). In step S1007,the client device captures a mask that is to be applied to the input data set and generates a binary vector representation of that mask MaskB0 (step S1009). At thisstage, the biometric consists of the binary vectors B0 and MaskB0.In step S1011, the client device determines a number of shifts n to be applied to themask. The shifts accommodate the fact that the mask applied to the input template during enrolment may not perfectly align with the mask that is applied to the input template during authentication. This can be further understood with reference to Figure 11. Figure 11A shows the same sequence of images as shown in Figure 7, namely a template image 701 of a user’s eye(s) captured during the enrolment phase, a mask703 and the masked template 705 that results from applying the mask 703 to thetemplate image 701. Figure 11B shows another template image 1101 captured during the authentication phase, together with a new mask template 1103 and the result 1105of applying the mask 1103 to the template image 1101. In this case, the alignmentbetween the mask 1103 and the image template 1101 is shifted relative to that of the mask 703 and the image template 701; that is, the mask 1103 is shifted a distance ^^ in the vertical direction relative to the image template 1101. Applying the different shifts to the mask during enrolment or authentication increases the likelihood of reproducing the same alignment between the mask 1103 and image template 1101 forthe authentication phase as between the mask 703 and image template 701 in theenrolment phase; this in turn can help mitigate against false negatives where the person seeking authentication is genuine but cannot be verified owing to a difference in 14294052-1the alignment between the mask and template. (Although the shift ^^ in Figure 11Brepresents a shift in the vertical direction, shifts may also be obtained in the horizontal direction either in addition to, or alternatively from, the vertical direction).As discussed further below, during authentication, the distance metric ^ may becalculated for each one of the shifts of A and MaskA (i.e. image template 701 and mask703) against B and MaskB (i.e. image template 1101 and mask 1103). The obtaineddistances d can then be compared with the threshold T, and if any of the distances arewithin that threshold distance, the matching algorithm will output a match. Typically, the shifts can be implemented as simple bit-shifts of the vectors as used in common computing languages.Referring again to Figure 10, in step S1013, a first shift i = 0 is selected. In stepsS1015 to S1023, the client device determines the following vectors:^^(the original template vector) ^^^^^^(the mask vector) ^^^^^^^^ = ^^⋀^^^^^^ (the template vector with mask applied)^^^^^ = “inverse” of the mask vector) and^^^^^^^^^ where ^ ^^^^^^^^ is the vector obtained by replacing all 0 entries in the vector^^⋀^^^^^^with −1.(It will be appreciated that for ^ = 0, the vectors ^^ and ^^^^^^ are the same ones ^^and ^^^^^^as obtained in steps S1005 and S1009, respectively).The four vectors ^^^^^^ , ^ ^^^^^^^ , ^ ^^^^ and ^^^^^^^^^are encrypted, respectively,with the keys msk1, msk2, msk3 and msk4 used to generate the first, second, third andfourth user-specific keys. In step S1025, the client device proceeds with the next shift by incrementing the valueof i, following which steps S1015 to S1023 are repeated with the new shift applied tothe vectors. The process will repeat for each shift 0 ≤ ^ ≤ ^ − 1, resulting in a totalnumber of 4n encrypted vectors being generated, there being four encrypted vectorsgenerated for each shift n. The encrypted vectors are in turn forwarded to the server (step S1119). Similarly to the enrolment phase, it is assumed that the data is sent 14294052-1 securely to the server and integrity protected.Figure 12 shows steps carried out by the server during the authentication stage.Having received the 4n encrypted vectors ^^^^ ^^^^^^ ^^^^^^^^^^ ^^ , ^^ , ^^ and ^^where (0 ≤ ^ ≤ ^ − 1) from the user, together with the user ID (step S1201), the serverretrieves from storage the four user-specific keys corresponding to the user ID (stepS1203). In step S1205, the server sets i = 0, and in step S1207 computes the distancemetric di as:((ℓ^^^^^ ^^^^^^^ ^^^^^^^ ^^^^^^ ^^^ ^^^^^^ ^^^^^^ − ^^ , ^^ )^ 2) − 〈^ , ^^ 〉 − ^^^ , ^ ^ The above formulation for d follows directly from the Boolean formula set out earlier.As formulated in this way, the distance metric di can be calculated using inner products, where each inner product involves processing an encrypted vector (e.g. ^^^^^^^^^witha user secret key (e.g. ^^^^^^^^) using the Inner Product Encryption scheme. Theinner product encryption scheme is able to take the user-specific key and the encryptedvector, and obtain from these the inner product of the two underlying vectors. As in theembodiment shown in Figures 1 to 6, this computation does not require decryption ofthe underlying vectors; a computer may perform this computation without any ability to decrypt the underlying vectors, or indeed obtain any information about them besides the inner product.If the distance di is found to be less than or equal to a predetermined threshold (stepS1209) the user is authenticated (step S1211). Otherwise, the server increments thevalue i and applies the next shift, with steps S1207 and S1209 being repeated untileither the calculated distance metric difor one of the shifts is found to be less than orequal to the predetermined threshold, or the total number of shifts n is complete withoutthe distance metric di having satisfied the threshold criterion; in this case,authentication fails and the user is blocked from accessing the server (step S1215). As in the example shown in Figure 6, the present embodiment can also be used to support user identification, rather than authentication. Here, the steps carried out inenrolling the user remain the same (see Figures 8 and 9).Figure 13 shows the steps carried out by the client device if performing useridentification. Here, the client device carries out a similar sequence of steps to that14294052-1shown in Figure 10, the difference being that a respective set of four master secretkeys msk1, msk2, msk3, msk4 is retrieved for each user m = 1,…w, where w is the totalnumber of enrolled users, and steps S1015 to S1023 are for each one ofthose sets of master secret keys (steps S1319 to S1327 in Figure 13). In more detail,each user m enrolled with the server will have a set of four master secret keys used togenerate the vectors ^^^^ ^^^^^^ ^^^ ^^^^^^^^ , ^ , ^ and ^ for that user. The clientdevice will generate these four vectors for each shift for each user. Thus, in the eventthat a number of shifts n are used for each user, and the total number of enrolled usersis w, the client device will perform 4n encryptions for each one of the users and send atotal of 4nw encrypted vectors / ciphertexts to the server. As in the embodiment ofFigure 5, when sending each set of 4n encrypted vectors to the server, the clientdevice includes a label identifying the user associated with the respective set ofencrypted vectors (step S1331).Figure 14 shows the steps carried out by the server as part of the identificationprocess. The server receives the encrypted vectors ^^^^^^ , ^^^^^^^^, ^^^^^ and ^^^^^^^^^for each user, and uses the associated labels to match each set of encrypted vectors with the respective user’s set of four user-specific keys msk1, msk2,msk3, and msk4 (step S1401). In step S1403, the server selects a first user m = 1 fromamong those who have enrolled with the server and in step S1405, the server retrievesthe set of four user-specific keys and the associated set of encrypted vectors it hasreceived for the user m = 1. In step S1407, the server selects the first shift i = 0 andusing the selected user-specific keys, together with the encrypted vectors for i = 0,computes the distance metric di (step S1409). In step S1413, if the value of di is foundto be less than or equal to the predetermined threshold (step S1411), the server is ableto identify the selected user m as the one to have generated the binary vectorrepresentation of features B0(see step S1005 of Figure 10). Otherwise, the serverincrements the value i and applies the next shift (step S1415), with steps S1409 toS1411 being repeated until either the calculated distance metric difor one of the shifts is found to be less than or equal to the predetermined threshold, or the total number ofshifts n is complete without the distance metric di having satisfied the thresholdcriterion. In the latter case, it is determined that the user m is not the correct user. Instep S1417, it is determined whether there are other enrolled users yet to beconsidered (i.e. if m = w); if not, the next user m = m + 1 is selected. The steps S1405to S1415 are then repeated using the user-specific keys associated with that other14294052-1 user. The process will continue to repeat until such time as a user is identified forwhom the computed distance metric di for one of the shifts is found to be equal to orless than the predetermined threshold, or all enrolled users have been considered without a positive identification having taken place. As in the embodiment of Figure 5, it will be appreciated that the need to encrypt the vectors with each set of master-secret keys each time an identification process is carried out means that this approach may not be applicable where the pool of users is especially large. However, the approach may still be suitable in watchlist applicationswhere there are a comparatively small number of users enrolled with the server.Thus, embodiments described herein enable an iris matching metric to be computed between biometrics represented as binary vectors together with associated binary masks in a privacy preserving manner by a single Cloud Server. This is performed in such a way that the server (or an adversary) is not able to learn raw user templates, through observation or via trying to reverse engineer any data stored by the server. Inparticular, embodiments described herein provide privacy of data not only during restand in transit, but also now during computation (when compared against conventional approaches). Embodiments can also offer better runtime performance than alternative privacy preserving schemes based on technologies such as Homomorphic Encryption and Multi-Party Computation. Embodiments described herein are based on lattice- based ‘functional inner product encryption’ and are thus considered to be quantum safe. Implementations of the subject matter and the operations described in this specification can be realized in digital electronic circuitry, or in computer software, firmware, or hardware, including the structures disclosed in this specification and their structuralequivalents, or in combinations of one or more of them. Implementations of the subjectmatter described in this specification can be realized using one or more computer programs, i.e., one or more modules of computer program instructions, encoded on computer storage medium for execution by, or to control the operation of, data processing apparatus. Alternatively or in addition, the program instructions can be encoded on an artificially generated propagated signal, e.g., a machine-generatedelectrical, optical, or electromagnetic signal that is generated to encode information fortransmission to suitable receiver apparatus for execution by a data processing apparatus. A computer storage medium can be, or be included in, a computer- readable storage device, a computer-readable storage substrate, a random or serial 14294052-1 access memory array or device, or a combination of one or more of them. Moreover, while a computer storage medium is not a propagated signal, a computer storage medium can be a source or destination of computer program instructions encoded in an artificially generated propagated signal. The computer storage medium can also be, or be included in, one or more separate physical components or media (e.g., multiple CDs, disks, or other storage devices). While certain embodiments have been described, these embodiments have been presented by way of example only and are not intended to limit the scope of the invention. Indeed, the novel methods, devices and systems described herein may be embodied in a variety of forms; furthermore, various omissions, substitutions and changes in the form of the methods and systems described herein may be made without departing from the spirit of the invention. The accompanying claims and their equivalents are intended to cover such forms or modifications as would fall within the scope and spirit of the invention. 14294052-1

Claims

CLAIMS 1. A computer-implemented method comprising: receiving, at a first point in time, a first data set from a user; upon receipt of the first data set: performing feature extraction on the first data set to obtain a first feature vector; generating a first integer vector representation of the first feature vector; generating, using the first integer vector representation and a master key, a user-specific key; and sending, to a remote server, a user ID together with the user-specific key.

2. A computer-implemented method according to claim 1, wherein the first data set comprises biometric data.

3. A computer-implemented method according to claim 1 or 2, wherein generating the integer vector representation of the first feature vector comprises: computing the norm of the first feature vector; dividing each value in the first feature vector by the norm; and rounding or scaling the values of the first feature vector into integer values.

4. A computer-implemented method according to any one of the preceding claims, further comprising: receiving, at a later point in time, a second data set; upon receipt of the second data set: performing feature extraction on the second data set to obtain a second featurevector; generating a second integer vector representation of the second feature vector;generating an encrypted version of the second integer vector representationusing the master key; andsending, to the remote server, the encrypted version of the second integer vector representation.

5. A computer-implemented method according to claim 4, comprising: sending, to the remote server, the user ID together with the encrypted version of the second integer vector representation.

6. A computer-implemented method according to claim 4 or 5, wherein the second data 14294052-1set comprises biometric data.

7. A computer-implemented method according to any one of claims 4 to 6, whereingenerating the second integer vector representation of the second feature vectorcomprises: computing the norm of the second feature vector; dividing each value in the second feature vector by the norm; androunding or scaling the values of the second feature vector into integer values.

8. A computer-implemented method comprising: receiving, at a server, from a user, a user-specific key and a user ID, the user- specific key being generated using (i) an integer vector representation of a first feature vector and (ii) a master key; receiving, at the server, from the user, an encrypted vector and a claimed userID, wherein the vector is encrypted using the master key; processing, by the server, the encrypted vector using the user-specific key to obtain an output value; determining, by the server, whether the output value is equal to or less than a predetermined threshold; and in the event the output value is less than or equal to the threshold, authenticating the claimed user ID as being the same as the user ID.

9. A computer-implemented method comprising: (i) receiving, at a server, from a client device, a plurality of ciphertexts, whereineach ciphertext is generated by encrypting the same vector using a different respectivemaster secret key, each ciphertext being accompanied by a label indicating arespective user; (ii) retrieving from storage, by the server, a user-specific key corresponding tothe user indicated by the label accompanying a first one of the ciphertexts; (iii) processing, by the server, the first one of the ciphertexts using the user-specific key to obtain an output value; (iv) in the event the output value is less than or equal to a predeterminedthreshold, determining that the user indicated by the label accompanying the firstciphertext is a user operating the client device;(v) in the event the output value is greater than the threshold, retrieving a second user-specific key corresponding to the user indicated by the label accompanying a second one of the ciphertexts and processing, by the server, the 14294052-1second one of the ciphertexts using the second user-specific key to obtain a secondoutput value; and (vi) in the event the second output value is less than the threshold, determiningthat the user indicated by the label accompanying the second ciphertext is the useroperating the client device.

10. A computer-implemented method according to claim 9, wherein: in the event the second output value is greater than the threshold, the method comprises repeating steps (ii) and (iii) for further ciphertexts and their corresponding user-specific key, until the output value obtained is less than the threshold or else apredetermined number of user-specific keys have been retrieved.

11. A computer-implemented method according to any one of the preceding claims,wherein each dataset comprises an image of a user’s face.

12. A computer-implemented method comprising: receiving, at a first point in time, a first data set from a user; performing feature extraction on the first data set to obtain a first feature vector; generating a binary vector representation ^ of the first feature vector;receiving a mask for the first data set; generating a binary vector representation MaskA of the mask for the first dataset; generating, using the first binary vector representation MaskA and a first mastersecret key msk a user-specific key;applying the binary vector representation MaskA of the mask to the binaryvector representation A of the first feature vector to obtain a masked template vector^^^^^^^; generating a second user-specific key using the masked template vector^^^^^^^ and a second master secret key;generating an inverse vector ^^^^ of the binary vector representation MaskA;generating a third user-specific key using the inverse vector ^^^^and a third master secret key; generating a hamming vector ^^^^^^^^by replacing all zero entries in the masked template vector ^^^^^^^with -1; generating a fourth user-specific key using the hamming vector ^^^^^^^^and afourth master secret key; and14294052-1sending, to a remote server, a user ID together with the first user-specific key,the second user-specific key, the third user-specific key and the fourth user-specific key.

13. A computer-implemented method according to claim 12, further comprising: receiving, at a later point in time, a second data set from the user; performing feature extraction on the second data set to obtain a second feature vector; generating a binary vector representation B of the second feature vector;receiving a mask for the second data set; generating a binary vector representation MaskB of the mask for the seconddata set; encrypting the binary vector representation MaskB with the first master secretkey; applying the binary vector representation MaskB to the binary vectorrepresentation B of the second feature vector to obtain a second masked templatevector ^^^^^^^; encrypting the second masked template vector ^^^^^^^ with the second mastersecret key; obtaining an inverse vector ^^^^of the second binary vector representation MaskB; encrypting the inverse vector ^^^^with the third master secret key; obtaining a hamming vector ^^^^^^^^by replacing all zero entries in the masked template vector ^^^^^^^with -1; encrypting the hamming vector ^^^^^^^^with the fourth master secret key; and sending, to the remote server, the encrypted binary vector representation MaskB of the mask for the second data set, the encrypted masked template vector ^^^^^^^, the encrypted inverse vector ^^^^and the encrypted hamming vector ^^^^^^^^.

14. A computer-implemented method according to claim 13, comprising: sending, to the remote server, the user ID together with the encrypted second binary vector representation MaskBof the mask for the second data set, the encrypted masked template vector ^^^^^^^, the encrypted inverse vector ^^^^and the encrypted hamming vector ^^^^^^^^. 14294052-115. A computer-implemented method according to claim 13 or 14, further comprising: applying one or more shifts to the binary vector representation MaskB and / or thebinary vector representation B of the second feature vector, wherein each shiftrepresents a shift in relative alignment of the second data set and the mask for the second data set; for each shift, generating a new version of each of the encrypted binary vector representation MaskBof the mask for the second data set, the encrypted masked template vector ^^^^^^^, the encrypted inverse vector ^^^^and the encrypted hamming vector ^^^^^^^^; and sending the new version of each of the encrypted binary vector representation MaskB of the mask for the second data set, the encrypted masked template vector ^^^^^^^, the encrypted inverse vector ^^^^and the encrypted hamming vector ^^^^^^^^to the remote server.

16. A computer-implemented method comprising: (i) receiving, at a server, from a client enrolment device used to enrol a user with the server, a user ID, a first user-specific key, a second user-specific key, a third user-specific key and a fourth user-specific key; the first user-specific key being generated at the client enrolment device using a binary vector representation MaskA of a first mask and a first master secret key, the second user-specific key being generated at the client enrolment deviceusing a second master secret key and a masked template vector ^^^^^^^ obtained byapplying the binary vector representation MaskA to a binary vector representation of afirst data set A; the third user-specific key being generated at the client enrolment device usinga third master secret key and an inverse vector ^^^^ of the binary vectorrepresentation MaskA; the fourth user-specific key being generated at the client enrolment deviceusing a fourth master secret key and a hamming vector ^^^^^^^^ obtained byreplacing all zero entries in the masked template vector ^^^^^^^with -1; (ii) receiving, at the server, from a client authentication device used inauthenticating the user with the server, a first encrypted vector, a second encrypted vector, a third encrypted vector, and a fourth encrypted vector, the first encrypted vector being generated at the client authentication device byencrypting a binary vector representation MaskB of a second mask using the firstmaster secret key; 14294052-1the second encrypted vector being generated at the client authentication device by encrypting a masked template vector ^^^^^^^using the second master secret key, the masked template vector ^^^^^^^being obtained by applying the binary vector representation MaskBof the second mask to a binary vector representation of a seconddata set B;the third encrypted vector being generated at the client authentication device byencrypting an inverse vector ^^^^ of the binary vector representation MaskB using thethird master secret key; the fourth encrypted vector being generated at the client authentication device by encrypting a hamming vector ^^^^^^^^using the fourth master secret key, the hamming vector ^^^^^^^^obtained by replacing all zero entries in the masked template vector ^^^^^^^with -1; processing each encrypted vector using a respective one of the user-specific keys to return a respective inner product; calculating the value of a distance metric between the first data set when masked by the first mask and the second data set when masked by the second mask as a function of the inner products; and determining, whether the output value is equal to or less than a predetermined threshold; and in the event the output value is less than or equal to the threshold, authenticating the user by the server.

17. A computer-implemented method according to claim 16, comprising:receiving, at the server, from the client authentication device, a plurality of sets of encrypted vectors, each set of encrypted vectors comprising a first encrypted vector, a second encrypted vector, a third encrypted vector and a fourth encrypted vector, wherein for each set of encrypted vectors: the first encrypted vector in the set is generated at the client authentication device by applying a respective shift to the binary vector representation of the MaskB ofthe second mask to obtain a shifted binary vector representation of the MaskB, andencrypting the shifted binary vector representation of the MaskB using the first master secret key; the second encrypted vector is generated at the client authentication device byapplying the respective shift to the binary vector representation of the second data set B to obtain a shifted binary vector representation of the second data set, applying theshifted binary vector representation of the MaskB to the shifted binary vector14294052-1representation of the second data set to obtain a masked template vector ^^^^^^^for the respective shift, and encrypting the masked template vector ^^^^^^^using the second master secret key; the third encrypted vector is generated at the client authentication device byencrypting an inverse vector ^^^^of the shifted binary vector representation MaskBusing the third master secret key; andthe fourth encrypted vector is generated at the client authentication device byreplacing all zero entries in the masked template vector ^^^^^^^for the respective shiftwith -1 to obtain a hamming vector ^^^^^^^^ and encrypting the hamming vector^^^^^^^^using the fourth master secret key; the method further comprising, for one or more of the sets of encrypted vectors: processing each encrypted vector within the set using a respective one of theuser-specific keys to return a respective inner product; calculating the value of a distance metric between the first data set when masked by the first mask and the second data set when masked by the second mask as a function of the inner products; and determining, whether the output value is equal to or less than a predetermined threshold; and in the event the output value is less than or equal to the threshold for one of thesets of encrypted vectors, authenticating the user by the server.

18. A computer-implemented method comprising: (i) receiving and storing, at a server, for each one of a plurality of users, a firstuser-specific key, a second user-specific key, a third user-specific key and a fourthuser-specific key; wherein for each user: the first user-specific key is generated using a binary vectorrepresentation MaskA of a first mask and a first master secret key of the user;the second user-specific key is generated using a second master secretkey of the user and a masked template vector ^^^^^^^obtained by applying the binaryvector representation MaskA to a binary vector representation of a first data set A;the third user-specific key is generated using a third master secret keyof the user and an inverse vector ^^^^ of the binary vector representation MaskA; andthe fourth user-specific key is generated using a fourth master secretkey of the user and a hamming vector ^^^^^^^^obtained by replacing all zero entries in the masked template vector ^^^^^^^with -1; 14294052-1(ii) receiving, by the server, from a client device, for each one of the users, a group of ciphertexts, each group being accompanied by a label indicating therespective user, each group of ciphertexts comprising:a first ciphertext generated by encrypting a binary vector representation MaskBof a mask using the first master secret key of the respective user;a second ciphertext generated by encrypting a masked template vector^^^^^^^ using the second master secret key of the respective user, the maskedtemplate vector ^^^^^^^being obtained by applying the binary vector representationMaskB of the first mask to a binary vector representation of a data set B;a third ciphertext generated by encrypting an inverse vector ^^^^ of the binaryvector representation MaskB using the third master secret key of the respective user;and afourth ciphertext generated by encrypting a hamming vector ^^^^^^^^usingthe fourth master secret key of the respective user, the hamming vector ^^^^^^^^obtained by replacing all zero entries in the masked template vector ^^^^^^^with -1; (iii) selecting a first one of the groups of ciphertexts; (iv) retrieving the user-specific keys for the user indicated by the label accompanying the first group of ciphertexts; (v) processing each ciphertext in first group of ciphertexts using a respectiveone of the retrieved user-specific keys to return a respective inner product; (vi) calculating the value of a distance metric as a function of the inner products; and (vii) determining, whether the output value is equal to or less than a predetermined threshold; (viii) in the event the output value is less than or equal to the threshold,determining that the user indicated by the label accompanying the first group ofciphertexts is the user operating the client device.

19. A computer-implemented method according to claim 18, wherein: in the event the output value is greater than the predetermined threshold, themethod comprises repeating steps (iii) to (viii) for one or more groups of ciphertexts,until the output value obtained is less than the threshold or else a predeterminednumber of groups of ciphertexts have been selected.

20. A computer-implemented method according to claim 18 or 19, comprising: (ii) receiving, by the server, from a client device, for each one of the users, a 14294052-1plurality of groups of ciphertexts, each plurality of groups being accompanied by thelabel indicating the respective user, each group of ciphertexts in each of the plurality ofgroups comprising a first ciphertext, a second ciphertext, a third ciphertext, and a fourth ciphertext; wherein for each group of ciphertexts in the plurality of groups received from a user: the first ciphertext in the respective group is generated by applying a respectiveshift to the binary vector representation of the MaskB of the second mask to obtain ashifted binary vector representation of the MaskB, and encrypting the shifted binary vector representation of the MaskB using the first master secret key of the respective user; the second ciphertext is generated by applying the respective shift to the binaryvector representation of the second data set B to obtain a shifted binary vector representation of the second data set, applying the shifted binary vector representationof the MaskB to the shifted binary vector representation of the second data set to obtaina masked template vector ^^^^^^^for the respective shift, and encrypting the maskedtemplate vector ^^^^^^^ using the second master secret key of the respective user;the third ciphertext is generated by encrypting an inverse vector ^^^^of theshifted binary vector representation MaskB using the third master secret key of therespective user; andthe fourth encrypted vector is generated by replacing all zero entries in themasked template vector ^^^^^^^ for the respective shift with -1 to obtain a hammingvector ^^^^^^^^ and encrypting the hamming vector ^^^^^^^^ using the fourth mastersecret key; the method comprising: (iii) selecting, from a first one of the plurality of groups of ciphertexts, a first one of the groups of ciphertexts; (iv) retrieving the user-specific keys for the user indicated by the labelaccompanying the first one of the plurality of groups of ciphertexts;(v) processing each ciphertext in first group of ciphertexts using a respective one of the retrieved user-specific keys to return a respective inner product; (vi) calculating the value of a distance metric as a function of the inner products; and (vii) determining, whether the output value is equal to or less than a predetermined threshold; (viii) in the event the output value is less than or equal to the threshold, 14294052-1determining that the user indicated by the label accompanying the first one of theplurality of groups of ciphertexts is the user operating the client device.

21. A computer-implemented method according to claim 20, wherein: in the event the output value is greater than the predetermined threshold, themethod comprises repeating steps (iii) to (viii) for one or more other groups ofciphertexts in the first one of the plurality of groups of ciphertexts.

22. A computer-implemented method according to claim 21, wherein in the event theoutput value is greater than the predetermined threshold for each of the one or moreother groups of ciphertexts in the first one of the plurality of groups of ciphertexts, the method comprises: selecting, from a second one of the plurality of groups of ciphertexts, a first one of the groups of ciphertexts; and repeating steps (iii) to (viii) for one or more groups of ciphertexts in the secondone of the plurality of groups of ciphertexts.

23. A computer-implemented method according to any one of the preceding claims,wherein each user-specific key is generated as a function of its respective mastersecret key.

24. A computer-implemented method according to claim 23 as dependent on any oneof claims 1 to 10, wherein the user specific key sk is generated by computing ^^ =^ + ^^^, where:^^is the first integer vector representation of the first feature vector; uis a vector of length ^ + ^ with elements sampled uniformly at random from^^, where n and q are predefined values and k is the length of the first feature vector;and ^is a matrix ^^^ where ^^ is the identity matrix of size ^ × ^ and S is an n x kmatrix of randomvalues.

25. A computer-implemented method according to claim 23 as dependent on any oneof claims 12 to 22, wherein: the first master secret key comprises a tuple (u1, S);the second master secret key comprises a tuple (u2, S); 14294052-1the third master secret key comprises a tuple (u3, S); and the fourth master secret key comprises a tuple (u4, S); wherein: u1 is a first vector of length ^ + ^ with elements sampled uniformly at randomfrom ^^; u2 is a second vector of length ^ + ^ with elements sampled uniformly atrandom from ^^; u3 is a third vector of length ^ + ^ with elements sampled uniformly at randomfrom ^^, u4 is a fourth vector of length ^ + ^ with elements sampled uniformly at randomfrom ^^; ^is an n x k matrix of random integer values, ^^, where n and q are predefinedvalues and k is the length of the first feature vector.

26. A computer-implemented method according to claim 25, wherein: the first user-specific key ^^^ is generated by computing ^^^ = ^^ + ^^^^; the second user-specific key ^^^ is generated by computing ^^^ = ^^ + ^^^^; the third user-specific key ^^^ is generated by computing ^^^ = ^^ + ^^^^; the fourth user-specific key ^^^ is generated by computing ^^^ = ^^ + ^^^^; where: ^^′ is the binary vector representation MaskA of the first mask;^^′ is the masked template vector ^^^^^^^; ^^′ is the inverse vector ^^^^; ^^′ is the hamming vector ^^^^^^^^; ^is a matrix , where ^^ is the identity matrix of size ^ × ^.

27. A computer-implemented method according to any one of the preceding claims, wherein each master secret key is derived in part from a combination of the same rootkey and a respective unique label using a Key Derivation Function.

28. A computer-implemented method according to any one of the preceding claims, wherein each data set comprises an image captured by a camera of a client device.

29. A computer-implemented method according to claim 28, wherein each image is an image of a user’s eye, and the mask applied to the respective image is such as to 14294052-1isolate the user’s iris in the image.

30. A computer-readable storage medium comprising computer executable instructions that when executed by a computer will cause the computer to carry out a method according to any one of the preceding claims.

31. A computer system configured to carry out a method according to any one of the preceding claims.

32. A computer system comprising: a client device configured to carry out a method according to any one of claims1 to 7, 12 to 15 and 21 to 29; anda server device configured to carry out a method according to any one of claims8 to 11 and 16 to 20.14294052-1

Images