Decentralized Biometric Credential Storage via Vector Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current user authentication systems rely on centralized databases, making them vulnerable to security breaches and compromising user identities, as they require users to share personal information such as biometric data with third-party authorities.
Innovation Solution
A decentralized biometric credential storage system using distributed ledgers (blockchains) that allows users to control their identity data, with the Biometric Open Protocol Standards (BOPS) framework enabling secure and private identity management by encrypting and splitting biometric vectors across multiple devices, ensuring no single point of compromise.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If centralized databases are used for user authentication, then ease of operation is improved, but security and reliability deteriorate due to single point of compromise
Solution Approach 1:
The biometric data is divided into multiple cryptographic shares that are distributed across different devices (mobile device and server). No single location stores the complete biometric data, eliminating the single point of compromise while maintaining authentication functionality through share combination.
Solution Approach 2:
Cryptographic encryption and key management act as intermediaries between the user's biometric data and the authentication system. The system uses encrypted biometric shares and cryptographic protocols to enable secure authentication without direct exposure of raw biometric data in centralized databases.
2Ease of operation
If biometric data is stored in centralized databases, then ease of operation is improved, but loss of information worsens due to data breaches
Solution Approach 1:
The biometric template is segmented into multiple encrypted shares stored on different devices. Even if one share is compromised, the complete biometric information remains secure because reconstruction requires multiple shares from different locations.
Solution Approach 2:
Instead of storing a single copy of biometric data in a centralized database, the system creates multiple encrypted copies (shares) distributed across different devices. This distribution ensures that no single breach can expose the complete biometric information.
3Ease of operation
If biometric data is shared with third-party authorities, then ease of operation is improved, but harmful factors worsen due to unauthorized access and identity theft
Solution Approach 1:
The biometric data is segmented into encrypted shares that remain on user devices rather than being transmitted to third-party authorities. This segmentation prevents unauthorized access and identity theft while maintaining the ability to authenticate users through local share combination.
Solution Approach 2:
The system enables users to maintain control over their own biometric data through decentralized storage on their personal devices. Users authenticate themselves using their biometric shares locally without requiring third-party authorities to access or store their complete biometric information.
Data Source
AI summary
Secure communications are provided between a user computing device and a server computing device. An enrollment request is received from a user computing device that is configured via a distributed client software application and is processed. The enrollment request is usable to enroll the user computing device in a network and includes an encrypted partial initial biometric vector associated with a user. An authentication request is processed that is subsequently received that includes an encrypted partial second biometric vector and that is associated with a user of the user computing device. A comparison of the encrypted partial initial biometric vector and the encrypted partial second biometric vector is performed, and a value representing the comparison is generated and transmitted to the user computing device. The user computing device is authenticated where the value is above a minimum threshold.