Biometric-PUF Key Generation to Prevent Cross-Device Key Recreation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing biometric-based cryptographic key generation methods are vulnerable to attacks where an attacker can recreate the cryptographic key using stolen biometric data on a different device, and there is a need for more secure and unique key generation.
Innovation Solution
A cryptographic key generator device that combines device-unique properties of a PUF with person-unique biometric identification to create a biometrically locked PUF response, ensuring the cryptographic key is generated only on the correct device with the correct biometric input, using mechanisms like secure sketching and fuzzy extraction to recreate the key without storing it on the device.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If biometric data is used to generate cryptographic keys using secure sketching or fuzzy extraction, then key generation is enabled with tolerance for biometric variation, but the system becomes vulnerable to attacks where attackers can recreate keys on different devices
Solution Approach 1:
The system segments the key generation process into device-specific components. The PUF (physically unclonable function) provides device-unique characteristics that are segmented from the biometric data processing. This segmentation ensures that even if biometric data is replicated, the device-specific PUF response prevents key recreation on different devices.
Solution Approach 2:
The PUF acts as an intermediary between the biometric data and the cryptographic key generation. Instead of directly generating keys from biometric data alone, the system uses the PUF response as a mediating factor that binds the key generation to the specific device, preventing attackers from recreating keys on different devices.
2Speed
If cryptographic keys are generated and stored on the device, then quick access is enabled, but security is compromised as stored keys can be extracted by attackers
Solution Approach 1:
The system discards stored cryptographic keys and recovers them on-demand through the PUF-based generation process. Instead of storing keys for quick access, the system generates keys dynamically when needed, using the PUF response and biometric data as inputs. This eliminates the security vulnerability of stored keys while maintaining quick access through efficient regeneration.
Solution Approach 2:
The PUF-based system provides self-service for key generation. The device automatically generates cryptographic keys using its own unique PUF characteristics combined with biometric authentication, without requiring external key distribution or storage. This self-service approach eliminates key extraction vulnerabilities while maintaining fast access.
3Loss of time
If biometric templates are stored on the device for authentication, then authentication speed is improved, but security is reduced as templates can be stolen and used for impersonation
Solution Approach 1:
The system extracts and removes the biometric template storage from the device. Instead of storing templates on the device for quick authentication, the system uses helper data that can assist in biometric verification without containing the actual template. This extraction eliminates the security risk of template theft while maintaining authentication functionality.
Solution Approach 2:
Helper data serves as an intermediary between the stored biometric information and the authentication process. The helper data enables verification without exposing the actual biometric template, preventing template theft and impersonation attacks while maintaining fast authentication through efficient comparison processes.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
There is provided mechanisms for generating a cryptographic key for a user. The method is performed by a cryptographic key generator device. The method comprises authenticating the user using biometrics data read from the user using a biometrics reader. The method comprises obtaining, only when having authenticated the user, a PUF response from a PUF entity by providing a challenge based on biometrics response data to the PUF entity. The biometrics response data is a function of the biometrics data. The method comprises generating the cryptographic key using a cryptographic function and by seeding the cryptographic function with the PUF response.