Client-Side Biometric Feature Extraction and Encryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Biometric authentication in computing systems faces challenges such as the difficulty in changing compromised biometric attributes, security concerns due to intercepted measurements, and the inconvenience of carrying dedicated authentication devices, which hinder the realization of biometric authentication's convenience.
Innovation Solution
The solution involves extracting features from biometric measurements on a user's device without sending raw data, encrypting these features, and using a varying value between authentication attempts to create a unique encrypted value that cannot be reused, thus protecting against impersonation and accommodating measurement variations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If raw biometric measurements are sent to authentication server, then authentication can be performed, but security is compromised due to interception and reuse risks
Solution Approach 1:
The patent extracts only the essential features from raw biometric measurements rather than transmitting the complete raw data. The client device performs feature extraction locally, sending only the extracted features to the authentication server. This reduces the amount of sensitive data transmitted while maintaining authentication capability, thereby improving security without significantly impacting convenience.
Solution Approach 2:
The patent applies preliminary processing (feature extraction) on the client device before transmission. By pre-processing the biometric data locally and extracting relevant features beforehand, the system prepares the data in a secure format that maintains authentication reliability while minimizing security risks during transmission.
2Reliability
If biometric attributes are compromised, then security is breached, but the attributes cannot be changed like passwords
Solution Approach 1:
The patent segments the authentication system into multiple components: the client device that performs feature extraction, the transmitted feature data, and the authentication server that performs matching. This segmentation allows the system to maintain security even if one component is compromised, as the raw biometric attributes never leave the client device and cannot be changed, but the extracted features can be regenerated.
Solution Approach 2:
The patent introduces extracted features as an intermediary between the raw biometric attributes and the authentication server. These features serve as a secure intermediate representation that maintains the uniqueness of biometric attributes while preventing direct exposure of the original attributes, thereby enhancing security resilience.
3Device complexity
If deterministic encrypted values are used for authentication, then verification is simplified, but the values can be intercepted and reused for impersonation
Solution Approach 1:
The patent introduces dynamic elements into the authentication process by incorporating a salt value that varies between authentication attempts. The encrypted authentication value is generated as a function of both the extracted features and the salt, making each authentication attempt unique. This dynamic approach prevents replay attacks while maintaining verification simplicity through deterministic encryption of the combined input.
Solution Approach 2:
The patent changes the parameters used in encryption by introducing a variable salt component. Instead of using a fixed encryption input, the system varies the salt parameter for each authentication attempt, which transforms the encrypted output dynamically while maintaining the underlying deterministic encryption mechanism for verification.
4Reliability
If feature extraction is performed on client device, then security is improved by not sending raw data, but processing complexity increases
Solution Approach 1:
The patent replaces the mechanical transmission of raw biometric data with a computational approach featuring automated feature extraction algorithms. By substituting the simple data transmission mechanism with intelligent client-side processing, the system achieves enhanced data protection while the automated nature of the extraction reduces the perceived complexity for users.
Data Source
AI summary
Provided is a process that includes: receiving, with a first device, a request to authenticate a user; obtaining, with the first device, an unstructured-data authentication input; extracting, with the first computing device, a plurality of features of the unstructured-data authentication input to form a structured-data representation; determining, with the first device, a first instance of a value that deterministically varies; and determining, with the first device, a first encrypted value based on both the structured-data representation and the first instance of the value that deterministically varies; and sending, with the first device, the first encrypted value to a second computing device.