Biometric Authentication via Distributed Shards and Signed Challenges
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current biometric authentication methods face security and privacy issues due to the need for plaintext storage of biometric templates, which can lead to vulnerabilities and inefficiencies, especially when scaling to millions of users, and result in loss of authentication credentials if devices are lost.
Innovation Solution
A privacy-preserving approach that generates shards from biometric data, distributes them across an array of servers for secure storage and processing, using multiparty computation to authenticate users without revealing intermediate values or biometric templates, allowing for revocation of credentials without re-engaging the transducer and maintaining security without communication between servers and clients.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If biometric templates are stored in plaintext in centralized databases, then authentication can be performed efficiently, but security and privacy are compromised as databases become vulnerable targets for hackers
Solution Approach 1:
The biometric template is divided into multiple shards that are distributed across multiple servers. Each shard alone is insufficient to reconstruct the biometric template, providing security while enabling efficient authentication through coordinated processing of shards across servers.
2Reliability
If biometric templates are stored locally on user devices, then privacy is improved, but authentication becomes impossible if the device is lost
Solution Approach 1:
The biometric template is segmented into shards distributed across multiple servers, with helper information stored locally. This allows authentication to proceed even if the local device is lost, as the helper information can retrieve the biometric template from the distributed shards.
Solution Approach 2:
Helper information acts as an intermediary between the locally stored biometric data and the distributed shards. It enables retrieval and reconstruction of the biometric template without requiring continuous local storage, solving the device loss problem.
3Reliability
If multiparty computation is used to compare biometric templates, then privacy is preserved, but computation and communication overhead becomes excessive for scaling to millions of users
Solution Approach 1:
The biometric template is divided into shards distributed across multiple servers. During authentication, only the necessary shards are retrieved and processed, significantly reducing computation and communication overhead compared to traditional multiparty computation while maintaining privacy preservation.
Solution Approach 2:
The biometric template is pre-divided into shards and distributed across servers during enrollment. This preliminary segmentation enables efficient authentication operations later, as the heavy computation of template division is performed only once during setup rather than during each authentication.
4Reliability
If shards are distributed across multiple servers, then security is improved, but system complexity increases
Solution Approach 1:
The biometric template is segmented into shards distributed across multiple servers, improving security. The system manages this complexity through structured storage arrangements and coordinated retrieval processes that balance security requirements with operational simplicity.
Data Source
AI summary
A system for using biometric data to authenticate a subject as an individual whose biometric data has been previously obtained. A second transducer has a digital electronic signal output characterizing a biometric of the subject; a second computing facility to receive the digital electronic signal; and an array of servers. These components implement processes including causing: generation of authentication shards from the digital electronic signal and distribution of the authentication shards to the array of servers; storing by a subset of the array of servers the authentication shards; performing a data exchange process using a subset of the authentication shards to develop authentication information relating to the subject; processing of the authentication information to synthesize a signed challenge of the subject; and processing of the synthesized signed challenge in a verification process to indicate whether the subject is authenticated as the individual. A related enrollment system is also provided.