Biometric SSO Authentication Using Homomorphic HMAC Encryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional single sign-on (SSO) authentication methods expose users' biometric information to identity providers, leading to privacy concerns and limited user control over data usage, as biometric data is often decrypted for authentication, making it susceptible to breaches and unauthorized sharing.
Innovation Solution
A method and system using homomorphic hash-based message authentication code (HMAC) encrypt biometric data with Fully Homomorphic Encryption (FHE) to authenticate users without revealing biometric information, leveraging homomorphic operations for secure authentication without decryption, and employing trusted decryption protocols to verify the authenticity of the authentication result.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If biometric data is stored in encrypted form using traditional encryption schemes, then security is improved, but the biometric information still needs to be decrypted for user authentication, exposing it to identity providers and leading to privacy concerns
Solution Approach 1:
The system performs preliminary encryption of biometric data using Fully Homomorphic Encryption (FHE) before the data is stored or transmitted to the identity provider. This encryption is done in advance so that the biometric data remains encrypted throughout the authentication process, eliminating the need for decryption at the identity provider and thus protecting user privacy while maintaining security
Solution Approach 2:
The patent introduces homomorphic encryption as an intermediary mechanism that allows the identity provider to perform authentication operations on encrypted biometric data without being able to decrypt or access the actual biometric information. This intermediary encryption layer enables the identity provider to work with encrypted data as if it were plaintext, while actually maintaining strong privacy protection
2Ease of operation
If biometric information is transmitted to identity provider for authentication, then authentication functionality is improved, but user control over data usage is reduced and susceptibility to breaches increases
Solution Approach 1:
Homomorphic encryption serves as an intermediary that enables the identity provider to perform authentication operations on encrypted biometric data without accessing the actual biometric information. The identity provider can compare encrypted biometric data with encrypted templates and determine authentication results, all while the data remains encrypted, thus maintaining functionality while reducing breach risk
Solution Approach 2:
The patent changes the cryptographic parameter from traditional encryption (which requires decryption) to Fully Homomorphic Encryption (which allows computation on encrypted data). This parameter change in the encryption scheme enables the identity provider to work with encrypted biometric data directly, performing authentication operations without needing to decrypt or access the actual biometric information, thus maintaining functionality while enhancing privacy protection
Data Source
Figure 1A
Figure 1B
Figure 2A
AI summary
The present disclosure provides biometric single sign-on authentication via homomorphic hash based message authentication code (HMAC). Conventional methods fails to provide authentication without revealing biometric data. In the present disclosure, when the user initiates a service request, a service provider redirects to an identify provider for authentication. Further, user captures and encrypts his/her biometrics using homomorphic HMAC, creating ciphertext. User submits his/her encrypted biometrics to the identity provider for authentication. The identity provider uses template matching algorithms to compare the user submitted encrypted biometrics (fingerprint, iris) with stored templates. The identity provider then transmits authentication result and the corresponding proof of authentication. Further, the service provider re-computes the authentication tag based on the received decrypted authentication result and the secret nonce. Finally, the service provider provides the requested service to the client machine, only if the re-computed authentication tag matches with the associated decrypted proof.