Biometric Challenge-Response Key Recovery With High Error Tolerance
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing biometric-based challenge-response-pair (CRP) mechanisms for secure key generation and exchange are prone to errors due to stochasticity, sensitivity, and aging/drift issues, particularly in biological objects, and require multiple iterative hashing steps, making them computationally intensive and vulnerable to noise.
Innovation Solution
Innovative protocols that generate cryptographic keys using sequences of challenges and responses from unclonable physical objects like PUFs or biological objects, allowing key recovery with high bit error rates (BERs) up to 20% without additional error correcting codes, by selecting subsets of responses based on challenge-response pairs.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If multiple iterative hashing steps are used in biometric-based CRP mechanisms, then security is improved, but computational intensity increases and vulnerability to noise increases
Solution Approach 1:
The patent extracts only the essential cryptographic function from complex iterative hashing, using a single application of a cryptographic hash function H() on challenge-response pairs. This reduces computational intensity while maintaining security by relying on the inherent properties of PUFs and biometric data rather than multiple hashing iterations.
Solution Approach 2:
The patent uses ephemeral session keys generated from challenge-response pairs that are discarded after use, rather than relying on expensive, complex iterative hashing processes. Each session key is unique and short-lived, providing security without the computational overhead of multiple hashing steps.
2Ease of operation
If biometric data is stored and processed extensively, then authentication capability is improved, but storage of sensitive data increases and security risk increases
Solution Approach 1:
The patent extracts only the necessary biometric features through challenge-response pairs without storing complete biometric datasets. The system processes biometric data to generate cryptographic keys while minimizing storage requirements by keeping only essential authentication information.
Solution Approach 2:
The patent introduces challenge-response pairs as intermediaries between biometric data and stored information. Instead of storing raw biometric data, the system uses CRPs as mediators that enable authentication while protecting the underlying biometric information from direct storage and exposure.
3Reliability
If error correcting codes are added to handle high bit error rates, then reliability is improved, but device complexity increases
Solution Approach 1:
The patent enables the challenge-response mechanism to self-correct errors through the inherent properties of PUFs and biometric data. The system naturally tolerates bit errors by using multiple challenge-response pairs and selecting matching keys without requiring external error-correcting code mechanisms.
Solution Approach 2:
The patent changes the approach to error handling by adjusting the threshold for key matching and using statistical methods to identify valid challenge-response pairs. Instead of adding complex error-correcting codes, the system modifies parameters like matching thresholds and pair selection criteria to achieve robust error tolerance.
Data Source
AI summary
Methods for the encoding an encryption key for secure storage are disclosed. The methods rely on the use of unclonable, one-way functions, such as images of biological objects that may be measured according to challenges to result in responses. A biometric print of a biological object is measured with a set of n challenges resulting in n responses. The responses are an ordered sequence, with each response having a fixed position in the sequence. A key is generated of bit length n. A subset of m responses in the full set of n responses is selected, where the selected responses correspond to positions of 1s in the key. The response subset is stored. The key is then used, and deleted. A party wishing to re-generate the key generates the same set of challenges, measures the same biological object with the challenges a second time, and generates a second set of n responses. Responses in the stored subset of m responses will match responses in the second set of n responses at certain positions in second set of n responses. These matching positions correspond to 1s in the key. The non-matching positions correspond to 0s. Thus, comparison between the response sets recovers the key.