Authentication Server ID Segmentation for Biometric Data Leakage Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing authentication systems using biological information face significant security risks due to the potential leakage of biological information and personal information, as they are not adequately protected against unauthorized access and encryption keys can be compromised.
Innovation Solution
An authentication server system that generates a unique third ID based on a combination of user and service provider, storing biological information and IDs in association without personal information, ensuring that personal information is encrypted and stored separately to minimize data breaches.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If biological information and personal information are stored together in the same database, then authentication functionality is improved, but security is worsened due to potential information leakage
Solution Approach 1:
The patent divides the database into two separate databases: a first database storing only biological information (feature values) and a second database storing personal information. This segmentation ensures that even if one database is compromised, the other remains protected, thus maintaining authentication functionality while reducing information leakage risk.
Solution Approach 2:
The patent introduces an intermediary component (the authentication server) that manages the separation between biological information and personal information. The server acts as a mediator that can perform authentication using biological information while preventing direct access to personal information, thus resolving the contradiction between authentication functionality and security.
2Object-affected harmful factors
If personal information is encrypted and stored in the same server, then security is improved, but vulnerability is worsened because encryption keys and encrypted data can be leaked simultaneously
Solution Approach 1:
The patent physically separates encrypted personal information and decryption keys into different servers. The first server stores encrypted personal information while the second server stores decryption keys. This segmentation ensures that even if one server is compromised, the other remains secure, thus improving reliability against simultaneous leakage while maintaining data protection.
3Object-affected harmful factors
If biological information is stored separately from personal information, then security is improved, but system complexity is worsened due to multiple databases and management servers
Solution Approach 1:
The patent makes the authentication server multi-functional by enabling it to perform both authentication operations (using biological information from the first database) and personal information management operations (accessing the second database). This universality reduces the need for additional dedicated servers, thus improving information leakage prevention while minimizing the increase in system complexity.
Data Source
AI summary
An authentication server includes a user registration unit, a service registration unit, and a storage unit. The user registration unit acquires a first ID that uniquely determines a user in a system and first biological information that is used for authentication of the user. The service registration unit processes a service registration request that is transmitted from a service provider of a service that the user wishes to use and that includes the first ID and a second ID that identifies the service provider. The service registration unit generates a third ID that is uniquely determined by a combination of the user and the service provider and transmits the third ID to the service provider. The storage unit stores the first biological information, the first ID, the second ID, and the third ID in association with each other.