Authentication System Using Local Biometric Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional password-based authentication methods are insecure due to password leakage risks and user inconvenience, and biometric systems face security risks from data storage vulnerabilities.
Innovation Solution
An authentication system that uses a server to generate an authentication policy and challenge value, which is sent to a client to select an authenticator, prompting the user for identity verification, and generates a signature value using a private key, ensuring that the server does not store private user information.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If biometric information is stored in a database on the server, then authentication can be completed through matching comparison, but the server becomes a target for attacks and user private information may be leaked
Solution Approach 1:
The patent extracts the sensitive biometric data out of the server environment and stores it locally in the authenticator device. Only non-sensitive authentication results and tokens are stored on the server, eliminating the security vulnerability of storing raw biometric information centrally while maintaining authentication functionality.
Solution Approach 2:
The patent introduces an authenticator device as an intermediary between the user's biometric data and the server. The authenticator performs local matching comparison and acts as a secure mediator that never transmits raw biometric data to the server, thus protecting user information from server attacks while enabling remote authentication.
2Reliability
If password-based authentication is used, then account access can be controlled, but password leakage risks increase and user convenience decreases due to multiple passwords
Solution Approach 1:
The patent replaces the mechanical password entry system with a biometric authentication system using fingerprint, face, or iris recognition. This substitution eliminates the need for users to remember multiple passwords while maintaining secure account access control through unique biological characteristics.
Solution Approach 2:
The patent changes the authentication parameter from user-generated passwords to unique biological characteristics. This parameter change fundamentally improves both security (biometrics cannot be leaked or guessed like passwords) and convenience (no need to remember multiple complex passwords).
Data Source
AI summary
A working method includes: a client receives and parses an authentication request to obtain an application identifier, an authentication policy and a challenge value; generates a signature key identifier list according to the authentication policy; sends an identity information verifying instruction generated according to the challenge value, the application identifier and the signature key identifier list; an authenticator obtains a signature private key and a signature key identifier according to the signature key identifier list and the application identifier; generates a final challenge hash value according to the application identifier and the challenge value; generates a signature value according to the final challenge hash value, the preset authenticator identifier and the signature key identifier; sends the signature value to a server; the server receives the signature value and verifies the signature value, determines whether the verifying is successful, if yes, the verifying is successful; otherwise, the verifying is failed.