Authentication Server Segmentation for Biometric Security

Solution Overview

Problem

Existing authentication systems using biological information are vulnerable to irreversible security breaches due to the leakage of biological information and personal information, as encrypting personal information alone does not prevent the exposure of decryption keys.

Innovation Solution

An authentication system that stores biological information without personal information, using unique IDs to associate users with service providers, ensuring that even if information is leaked, personal information remains secure by not being directly stored with biological data.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Productivity

If personal information is encrypted and stored in the same server as biological information, then data storage efficiency is improved, but security is worsened because both encrypted text and decryption keys could be leaked simultaneously

Engineering Contradiction:

Improvedata storage efficiencyVSAvoidsecurity

Core Design Contradiction:

ProductivityVSReliability

Solution Approach 1:

The patent divides the authentication system into three separate servers: a biological information management server storing only biological information, a personal information management server storing only personal information, and an authentication server coordinating between them. This segmentation ensures that even if one server is compromised, the other servers remain secure and cannot be used to decrypt the leaked information.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The authentication server acts as an intermediary that receives authentication requests, obtains biological information from the biological information management server, retrieves corresponding personal information from the personal information management server using the authenticated user ID, and delivers the personal information to the requester. This mediator architecture ensures that no single server holds both decryption capabilities and encrypted data.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Device complexity

If biological information and personal information are stored together in the same database, then system complexity is reduced, but security is worsened due to irreversible identity theft risk from information leakage

Engineering Contradiction:

Improvesystem complexityVSAvoidsecurity

Core Design Contradiction:

Device complexityVSReliability

Solution Approach 1:

The patent divides the authentication system into three separate servers: a biological information management server storing only biological information, a personal information management server storing only personal information, and an authentication server coordinating between them. This segmentation ensures that even if one server is compromised, the other servers remain secure and cannot be used to decrypt the leaked information.

Inventive Principle:

Principle #1Segmentation

3Reliability

If only biological information is stored without personal information, then security is improved, but data utility is worsened as personal information cannot be retrieved for service provision

Engineering Contradiction:

ImprovesecurityVSAvoiddata utility

Core Design Contradiction:

ReliabilityVSAdaptability or versatility

Solution Approach 1:

The authentication server acts as an intermediary that receives authentication requests, obtains biological information from the biological information management server, retrieves corresponding personal information from the personal information management server using the authenticated user ID, and delivers the personal information to the requester. This mediator architecture ensures that no single server holds both decryption capabilities and encrypted data.

Inventive Principle:

Principle #24Intermediary (Mediator)

Data Source

PatentEP4134847B1Authentication server, authentication system, authentication server control method, and storage medium

Publication Date: 2025.12.03 NEC CORP

Figure 1
Figure 2
Figure 3

AI summary

There is provided an authentication server that enables more secure authentication using biological information. The authentication server includes a user registration unit, a service registration unit, and a storage unit. The user registration unit acquires a first ID that uniquely determines a user in a system and first biological information that is used for authentication of the user. The service registration unit processes a service registration request that is transmitted from a service provider of a service that the user wishes to use and that includes the first ID and a second ID that identifies the service provider. The service registration unit generates a third ID that is uniquely determined by a combination of the user and the service provider and transmits the third ID to the service provider. The storage unit stores the first biological information, the first ID, the second ID, and the third ID in association with each other.