Asymmetric Key Generation via Biometric Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current authentication systems, such as RSA SecurID, are vulnerable to cyber attacks due to the use of symmetric keys, which can be stolen or compromised, leading to unauthorized access to corporate networks, and lack a secure integration of user identity with data protection, allowing hackers to hijack user actions and transactions.
Innovation Solution
A decentralized and non-deterministic system that generates asymmetric keys and passcodes using biometric authentication and physical randomness, stored on secure devices, ensuring that each user's key is distinct from the backend server's key, making it mathematically intractable to derive one from the other, and requiring hackers to breach each device individually.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If symmetric keys are used for authentication, then authentication can be performed, but the keys can be stolen or compromised leading to unauthorized access
Solution Approach 1:
The patent transitions from symmetric key authentication to asymmetric key authentication. Each user has a unique key pair (public key and private key) where the private key never leaves the secure element. The authentication mechanism uses the public key for verification while the private key remains protected in hardware, making it mathematically infeasible to derive the private key from the public key or stolen authentication tokens.
Solution Approach 2:
The authentication system is segmented into distinct components: the secure element (hardware token) that generates and protects the private key, the public key stored on the server, and the authentication protocol that connects them. This segmentation isolates the vulnerable private key generation and storage to a dedicated secure hardware component, preventing centralized points of failure.
2Ease of operation
If centralized authentication servers are used, then authentication can be managed, but a single breach can compromise all users
Solution Approach 1:
The authentication authority is segmented between the centralized server (which stores public keys and verifies authentication) and distributed secure elements (which generate and protect private keys locally). This segmentation ensures that compromising the centralized server does not expose any private keys, as each user's cryptographic credentials are independently generated and protected in separate hardware tokens.
Solution Approach 2:
The public key acts as an intermediary between the user's secure element and the centralized authentication server. The server verifies authentication requests using the public key without ever having access to the private key, creating a secure mediation layer that prevents direct exposure of sensitive credentials.
3Ease of operation
If passwords are used for access, then users can remember them, but they are difficult to remember when having many different passwords and susceptible to theft
Solution Approach 1:
The secure element automatically generates authentication codes based on the private key and current time, eliminating the need for users to manually create, remember, or type passwords. The device performs self-service authentication by presenting cryptographic proofs that the server can verify, replacing human-cognitive password management with automated cryptographic operations.
4Reliability
If asymmetric keys are generated and stored on secure devices, then security is enhanced, but the system complexity increases
Solution Approach 1:
The authentication system incorporates feedback mechanisms where the server responds to authentication requests with verification results, and the secure element adjusts its behavior based on server responses (e.g., rate limiting, lockout policies). This feedback loop enables sophisticated security policies to be enforced through simple protocol exchanges, reducing the need for complex local decision-making logic in the secure element.
Data Source
AI summary
Methods and systems are provided for performing a secure transaction. In an embodiment, users register biometric and/or other identifying user information. A private encryption key is generated from the biometric information and/or other user information and/or information obtained from a unpredictable physical process and are stored in a secure area of a device and a public key is transmitted to the blockchain network which acts as a service provider. In some embodiments, the execution and integrity of transactions by using transaction signatures, based on visual images is disclosed. In an embodiment, a blockchain network verifies and executes the transaction.