Biometric Authentication with Asymmetric Key Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing online shopping applications rely on insecure password transmission, which can lead to compromised user credentials and increased risk of fraud, necessitating a more secure authentication method without complicating online transactions.
Innovation Solution
Implementing a biometric authentication system using asymmetric encryption key pairs, where a public key is stored on the server and a private key is securely stored on the device, accessible only through biometric verification, eliminating the need for password transmission and enhancing transaction security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If password transmission is used for authentication, then the authentication process is simple and compatible with existing systems, but security is compromised and user credentials are at risk
Solution Approach 1:
The authentication system is segmented into two parts: a public key stored on the server and a private key stored securely on the device. This segmentation allows the system to eliminate password transmission while maintaining compatibility with existing authentication infrastructures, resolving the contradiction between improved security and system complexity.
Solution Approach 2:
Asymmetric encryption key pairs serve as an intermediary mechanism between the user and the server. Instead of directly transmitting passwords, the system uses public-private key pairs where the public key mediates authentication requests and the private key securely verifies them on the device, eliminating the need for insecure password transmission.
2Reliability
If biometric authentication with asymmetric encryption is implemented, then security is enhanced and passwords are protected, but the authentication process becomes more complex
Solution Approach 1:
The device's biometric sensor and secure storage system automatically handle the authentication process. When a user provides biometric data, the system self-service retrieves the private key from secure storage, performs verification, and completes authentication without requiring the user to manually manage cryptographic keys or understand complex security protocols.
3Adaptability or versatility
If passwords are stored and transmitted for authentication, then existing systems remain compatible, but fraud risk increases and user credentials can be compromised
Solution Approach 1:
The vulnerable element (password) is extracted from the authentication process and replaced with asymmetric encryption. The public key is taken out and stored on the server for compatibility with existing systems, while the private key remains securely on the device, eliminating the transmission of sensitive credentials and reducing fraud risk.
4Reliability
If device-specific secrets are used for authentication, then fraud risk is reduced and security is improved, but key management becomes more complex
Solution Approach 1:
Different parts of the key management system have specialized functions optimized for their specific roles. The device's secure storage system is designed specifically for protecting the private key with biometric protection, while the server is designed for storing and managing public keys. This local quality specialization simplifies overall key management despite the enhanced security requirements.
Data Source
AI summary
Secure interactions between a client device executing an application and a remote server associated with the application are enabled without credentials such as passwords. The application may acquire an encryption key pair, store a first key of the pair on the client device, and secure access to it by associated biometric data. The second key of the pair is stored on the remote server in association with the user's account. Responsive to a request on the application for an action that requires authentication with the remote server, the user must input biometric data which, only if verified, enables access to use the first key. The first key is then used to encrypt authentication data for submission to the remote server. The server accesses the public key and uses it to decrypt the data and verify the source of the request. If verified, the server then authorizes the requested action.