Biometric Identity Verification Using Local Key Pair Generation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing identity verification methods, such as challenge-response security questions and alternative contact information, are vulnerable to unauthorized access due to the potential compromise of secret information, leading to security breaches in user accounts.
Innovation Solution
A biometric-based identity verification system that uses a user's personal device to collect and convert biometric data into cryptographic key pairs, with a random salt introduced to ensure privacy, allowing for secure account recovery without sharing actual biometric data, and utilizing a zero-knowledge probabilistic proof protocol to verify identity without revealing sensitive information.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional security credentials (passwords, security questions) are used for identity verification, then account access can be established, but the security is compromised when these credentials are lost, stolen, or guessed by unauthorized parties
Solution Approach 1:
The patent extracts the secret information from the verification process by using biometric data to generate cryptographic key pairs locally on the user's device. The actual biometric data never leaves the device, and only public keys are transmitted to the server. This eliminates the vulnerability of storing or transmitting secret credentials while maintaining secure verification through public-key cryptography and zero-knowledge proofs.
Solution Approach 2:
The patent introduces cryptographic key pairs as an intermediary between the biometric data and the verification process. The biometric data serves as seed material for generating public-private key pairs, where the public key acts as a mediator that can be shared for verification without exposing the private biometric information. This intermediary layer protects the original secret while enabling secure authentication.
2Measurement precision
If biometric data is collected and stored for verification, then identity verification accuracy is improved, but user privacy is compromised due to potential data breaches and unauthorized access to sensitive biometric information
Solution Approach 1:
The patent extracts only the essential verification capability from the biometric data by converting it into public keys locally on the user's device. The actual biometric data remains private and never leaves the device, while the public keys are transmitted to the server for verification. This extraction process maintains verification accuracy through cryptographic proof while eliminating privacy risks associated with storing or transmitting raw biometric data.
Solution Approach 2:
The patent creates a cryptographic copy (public key) from the biometric data that can be shared for verification purposes without revealing the original biometric information. The public key serves as a functional copy that enables authentication while the original private biometric data remains secure on the user's device. This copying mechanism allows verification accuracy without compromising privacy.
3Adaptability or versatility
If account recovery services use challenge-response security questions, then account recovery is enabled when normal login is unavailable, but security is weakened because answers to security questions can be discovered by unauthorized parties
Solution Approach 1:
The patent replaces the mechanical challenge-response system (security questions and answers) with a cryptographic system based on public-key infrastructure and zero-knowledge proofs. Instead of relying on memorized answers that can be guessed or discovered, the system uses mathematical cryptography where the user's biometric-generated private key provides unbreakable security. This substitution eliminates the vulnerability of security questions while maintaining account recovery capability through cryptographic verification.
4Loss of information
If public/private key pairs are generated from biometric data, then user privacy is protected as biometric data is not shared, but the system complexity increases due to cryptographic operations and key management
Solution Approach 1:
The patent implements self-service by enabling the user's device to autonomously generate cryptographic key pairs from biometric data using local cryptographic operations. The device itself performs the complex cryptographic transformations without requiring external cryptographic services or infrastructure. This self-service approach protects biometric privacy while managing complexity within the user's own device rather than requiring complex centralized cryptographic infrastructure.
Data Source
AI summary
A user device can verify a user's identity to a server while protecting user privacy by not sharing any personal data with any other device. To ensure user privacy and to allow multiple independent enrollments, the user device performs an enrollment process in which the user device locally collects and uses biometric data together with a random salt to generate a set of public/private key pairs from which biometric information cannot be extracted. The public keys and the salt, but not the biometric data, are sent to a server to store. To verify user identity, a user device can repeat the collection of biometric data from the user and the generation of public/private key pairs using the salt obtained from the server. If the device can prove to the server its possession of at least a minimum number of correct private keys, the user's identity can be verified.