Biometric Authenticated Key Exchange Using Hash Functions
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Password authenticated key exchange (PAKE) is limited to implementations where two parties share an exact secret, making it ineffective when only noisy, low-entropy data such as biometric data is available.
Innovation Solution
A biometric authenticated key exchange (BAKE) scheme is developed, allowing two entities to agree on a secret session key using biometric data sets, even when they share only noisy, low-entropy information, by generating and exchanging sets of information based on public parameters and biometric data, and computing a session key through hash functions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If password authenticated key exchange (PAKE) is used, then secure key exchange between two parties is achieved, but it requires the parties to share an exact secret which is not feasible when only noisy biometric data is available
Solution Approach 1:
The patent transforms the exact secret requirement into a tolerance-based matching system by introducing parameters such as similarity thresholds and error margins. The biometric authentication system allows for approximate matching of biometric templates within defined parameter ranges, enabling reliable authentication even when biometric data varies slightly across different samples.
Solution Approach 2:
The patent introduces intermediary components including biometric template matching algorithms and similarity computation mechanisms that act as mediators between the noisy biometric input and the authentication decision. These intermediaries process and normalize biometric data, extracting stable features that enable reliable comparison without requiring exact matches.
2Reliability
If traditional authentication methods requiring exact secrets are used, then security is maintained, but usability deteriorates when users provide biometric data that naturally varies
Solution Approach 1:
The patent implements dynamic authentication thresholds and adaptive matching criteria that adjust based on the specific biometric modality and environmental conditions. The system dynamically selects appropriate similarity thresholds and weighting parameters to balance security and usability, allowing legitimate users with naturally varying biometric data to authenticate successfully while maintaining security against impostors.
Solution Approach 2:
The system changes operational parameters such as matching thresholds, similarity metrics, and decision boundaries based on the type of biometric data and security requirements. This allows the same authentication framework to accommodate different biometric modalities (fingerprints, facial recognition, iris) with their inherent variability characteristics.
3Ease of operation
If biometric data with noise and variations is accepted for authentication, then usability and ease of access are improved, but security and reliability may be compromised
Solution Approach 1:
The patent applies partial matching where complete exact matching of all biometric features is not required. Instead, the system identifies and matches critical feature subsets that are sufficient for authentication, tolerating variations in non-critical features. This approach maintains security by focusing on distinctive features while allowing natural variations in less important biometric characteristics.
Solution Approach 2:
The system incorporates feedback mechanisms where authentication decisions and failure rates are continuously monitored and used to adjust matching parameters. The feedback loop enables the system to learn from actual usage patterns and refine its tolerance parameters, improving both security and usability over time by adapting to the specific characteristics of the user population and environmental conditions.
Data Source
AI summary
A method includes receiving a first biometric data set representative of a first biometric sample provided by a user and public parameters. The method includes generating a first set of exchange information based thereon and communicating it to a system server. The method includes receiving a second set of exchange information based on the public parameters and a second biometric data set representative of a second biometric sample and is symmetric with respect to the first set of exchange information. The method includes computing a session key for the communication session by applying a first hash function based on a hash key to a subset of the second set of exchange information and a second hash function based on a projected key to a subset of the first set of exchange information. The method includes using the session key in communications during the communication session.