Authentication System Biometric Matching Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In two-factor authentication systems like FIDO, the server may incorrectly determine that authentication is successful even if the client does not properly verify whether the matching information matches the registration information, especially when the client is compromised by malware.
Innovation Solution
An authentication system that includes a client and server configuration where the client calculates a concealed evaluation value indicating similarity between registration and matching information, and generates a signature only if the information matches, which is then verified by the server to ensure accurate authentication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If the server determines authentication success based solely on signature verification without confirming biometric matching, then the authentication process is faster and simpler, but the system becomes vulnerable to false authentication successes when the client is compromised
Solution Approach 1:
The server performs biometric matching verification before requesting the signature from the client. This preliminary action ensures that the server confirms the biometric information actually matches the registered template before proceeding to signature verification, preventing false authentication successes while maintaining efficient processing
Solution Approach 2:
The server implements a feedback mechanism where the client sends biometric matching results to the server, and the server verifies these results before accepting the signature. This feedback loop ensures that the server has confirmation of actual biometric matching rather than relying solely on client assertions
2Reliability
If the client performs comprehensive biometric matching verification, then authentication accuracy improves, but the device complexity and processing time increase
Solution Approach 1:
The server acts as an intermediary that performs the complex biometric matching verification. Instead of requiring the client device to perform comprehensive matching, the client sends biometric data to the server, and the server handles the complex comparison against registered templates, reducing client device complexity while maintaining high authentication accuracy
3Reliability
If the server verifies both biometric matching and signature, then authentication security improves, but the authentication process becomes more complex and time-consuming
Solution Approach 1:
The authentication process is segmented into distinct phases: biometric matching verification phase and signature verification phase. The server handles biometric verification first, then separately verifies the signature. This segmentation allows each verification to be performed independently and efficiently, reducing overall system complexity while maintaining high security through dual verification
Data Source
AI summary
Provided is an authentication system capable of preventing determination that authentication of a person to be authenticated succeeds even though determination as to whether matching information matches registration information is not performed when authentication using two factors is performed. A determination unit 43 determines whether or not the matching information matches the registration information. A signature generation unit 21 of a client 10 generates a signature based on the message by using a signature key. A signature determination unit 34 determines whether or not the signature is a correct signature by using a first verification key, a message, and the signature. When it is determined that the matching information matches the registration information and it is determined that the signature is the correct signature, the authentication determination unit 37 determines that the authentication succeeds.