Biometric-PUF Key Generation to Prevent Key Recreation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing biometric-based cryptographic key generation systems are vulnerable to attacks where an attacker can recreate the cryptographic key using stolen biometric data, lacking sufficient security and uniqueness for different users.
Innovation Solution
A cryptographic key generator device that combines Physically Unclonable Function (PUF) responses with biometric data to create a biometrically locked PUF response (BLPR), which is used to generate a biometrically locked device unique key (BLDUK), ensuring the key is unique to a specific device and user, and is only generated when valid biometric data is supplied.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If biometric data is used to generate cryptographic keys, then user authentication is enabled, but the system becomes vulnerable to attacks where attackers can recreate keys using stolen biometric data
Solution Approach 1:
The patent combines two distinct authentication mechanisms - biometric verification and PUF-based cryptographic key generation - into a unified system. The biometric data serves as input to generate a challenge that is then provided to the PUF entity, creating a layered security approach where both biometric authentication and physical device uniqueness are required, thereby preventing key recreation from stolen biometric data alone
Solution Approach 2:
The PUF entity acts as an intermediary between the biometric data and the cryptographic key generation. Instead of directly using biometric data to generate keys (which is vulnerable), the system uses biometric data to create a challenge that is processed by the PUF entity, which then produces a response that seeds the key generation. This intermediary layer ensures that physical access to the device is required in addition to biometric authentication
2Ease of operation
If biometric templates are stored on the device, then authentication can be performed, but security is compromised as templates become targets for attacks
Solution Approach 1:
The patent extracts and removes the biometric template from the device's storage entirely. Instead of storing the template for later authentication comparisons, the system uses the biometric data only to generate a challenge for the PUF entity. The actual authentication verification is performed through the PUF response matching, not through template storage, thereby eliminating the security vulnerability of stored templates while maintaining authentication functionality
3Device complexity
If the same cryptographic key is used across multiple users, then system simplicity is maintained, but user-specific security and anonymity are compromised
Solution Approach 1:
The patent segments the cryptographic key generation process to be user-specific through the PUF mechanism. Each user's biometric data generates a unique challenge that produces a unique PUF response, which in turn seeds a unique cryptographic key. This segmentation ensures that each user has their own dedicated cryptographic key without requiring complex key management infrastructure, as the uniqueness emerges naturally from the PUF-response generation process
Data Source
AI summary
There is provided mechanisms for generating a cryptographic key for a user. The method is performed by a cryptographic key generator device. The method comprises authenticating the user using biometrics data read from the user using a biometrics reader. The method comprises obtaining, only when having authenticated the user, a PUF response from a PUF entity by providing a challenge based on biometrics response data to the PUF entity. The biometrics response data is a function of the biometrics data. The method comprises generating the cryptographic key using a cryptographic function and by seeding the cryptographic function with the PUF response.