Biometric Signature Encryption Using Segmented Keys
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing electronic signature methods face challenges in securely linking biometric data to electronic data records, ensuring integrity, and preventing misuse, particularly in environments where computing power is limited and security is a concern.
Innovation Solution
A method involving a signature creation unit with a non-readable memory storing a key for encryption, bidirectional communication with a data-processing device, and using a signature detection process random value to encrypt biometric data, with optional secure storage and checksum formation to ensure integrity and prevent unauthorized decryption.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If multiple encryption steps and asymmetric key pairs are used to secure biometric data, then security is improved, but device complexity and computing power requirements increase
Solution Approach 1:
The patent segments the encryption process into distinct phases: first encrypting biometric data with a symmetric key in the signature creation unit, then encrypting the symmetric key itself with an asymmetric key pair. This segmentation allows each encryption layer to serve a specific security function while keeping the overall system manageable and suitable for implementation in resource-constrained devices.
Solution Approach 2:
The patent performs preliminary encryption of biometric data with a symmetric key before transmission or storage. This preliminary action ensures that even if the data is intercepted, it remains protected, and the more computationally intensive asymmetric encryption is only applied to the smaller key material, reducing overall computing requirements.
2Ease of operation
If biometric data is decrypted for verification purposes, then verification capability is improved, but risk of misuse and unauthorized decryption increases
Solution Approach 1:
The patent introduces a checksum as an intermediary verification mechanism. Instead of decrypting biometric data for verification, the system encrypts the biometric data with a key, then encrypts that key with a public key and attaches a checksum. Verification is performed by decrypting the key material with the corresponding private key and verifying the checksum, never requiring decryption of the actual biometric data.
Solution Approach 2:
The patent replaces the mechanical approach of decrypting biometric data for verification with a cryptographic substitution approach. The verification process uses public-key cryptography and checksum validation instead of direct biometric data decryption, eliminating the security risk while maintaining verification capability.
3Reliability
If a private key is stored in the signature creation unit for encryption, then security is improved, but vulnerability to unauthorized access increases
Solution Approach 1:
The patent employs asymmetric cryptography with distinct public and private keys. The private key remains securely stored in the signature creation unit and never leaves the device, while the public key is freely distributed for encryption and verification operations. This asymmetry ensures that even if the public key is compromised, the private key remains protected, maintaining security while reducing vulnerability.
Data Source
Figure 1
Figure 2a
Figure 2b
AI summary
A method for electronic signatures comprising a signature creation unit (111) with an externally non-readable memory (112) and a data processing device (109). A biometric characteristic of a natural person who is to electronically sign a data record (100) is captured, and a biometric data record (104) and a signature capture process random value (106) are generated. The generated biometric data record (104) is encrypted using the generated signature capture process random value (106), the encrypted biometric data is transmitted to the data processing device (109), a checksum (105) is calculated on the encrypted biometric data and the data record (100) in the data processing device (109), and the checksum (105) is transmitted from the data processing device (109) to the signature creation unit (111).Alternatively, the electronic data set (100) is transferred from the data processing device (109) to the signature creation unit (111), and a checksum (105) is generated in the signature creation unit (111). The signature capture process random value (106) is encrypted using the checksum (105), and the result of the encryption is encrypted using the key (122, 123) and transferred to the data processing device (109).