Binding Biometric Metadata to Hardware via PUF Enrollment
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Authentication systems relying on biometric data are vulnerable to forgery and data exposure, and existing methods fail to securely link intrinsic hardware characteristics with authentication protocols, particularly in handling sensitive and non-sensitive metadata.
Innovation Solution
An authentication system that generates an enrollment token or public key based on intrinsic device characteristics, incorporating sensitive metadata through hash functions, utilizing a zero knowledge proof mechanism for verification, and employing fuzzy extraction to manage noisy PUF outputs, ensuring the device's authenticity without exposing sensitive data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If biometric data is stored and used for authentication, then authentication capability is improved, but vulnerability to forgery and data exposure increases
Solution Approach 1:
The patent extracts sensitive biometric data from the authentication flow by using it only during enrollment to generate a device binding key. The actual authentication process uses only non-sensitive metadata and the binding key, eliminating the need to store or transmit sensitive biometric data after enrollment. This extraction of sensitive information from the ongoing authentication process resolves the contradiction by maintaining authentication capability while removing vulnerability to forgery and data exposure.
Solution Approach 2:
The patent introduces a device binding key as an intermediary that links the device's intrinsic properties to the authentication process. This binding key is generated during enrollment by processing biometric data through a PUF, and then used to verify authentication requests without requiring the actual biometric data. The binding key serves as a mediator that enables authentication while preventing direct exposure of sensitive biometric information.
2Reliability
If PUF output is used for authentication, then device uniqueness is improved, but handling of noisy output becomes more difficult
Solution Approach 1:
The patent applies preliminary action by performing a challenge-response protocol during device enrollment where the PUF is queried with specific challenges and the responses are stored as expected values. During subsequent authentication, the same challenges are issued and responses are compared against the stored expected values. This preliminary characterization of the PUF's behavior allows the system to handle noisy output by comparing against known good responses rather than requiring exact matches.
Solution Approach 2:
The patent implements feedback mechanisms through the challenge-response protocol where the system issues challenges, receives responses from the PUF, and uses these responses to generate binding keys and verify authentication. The feedback loop allows the system to adapt to the noisy nature of PUF output by using the response to confirm device identity while filtering out noise through the structured challenge-response interaction.
3Reliability
If metadata is incorporated into PUF input, then authentication robustness is improved, but complexity of the protocol increases
Solution Approach 1:
The patent merges the PUF challenge-response mechanism with metadata processing by incorporating metadata into the challenge or response processing steps. Rather than creating separate protocols for PUF authentication and metadata verification, the system combines these functions by processing metadata through the same PUF-based binding key generation and verification process. This merging approach improves authentication robustness while minimizing the increase in protocol complexity.
Data Source
AI summary
A system, device, and method for binding metadata, such as information derived from the output of a biometric sensor, to hardware intrinsic properties by obtaining authentication-related metadata and combining it with information pertaining to a root of trust, such as a physical unclonable function. The metadata may be derived from a sensor such as a biometric sensor, the root of trust may be a physical unclonable function, the combination of the metadata and root of trust information may employ a hash function, and output from such a hash process may he used as an input to the root of trust. The combined information can he used in interactive or non-interactive authentication.