Biometric SSO Authentication Using Homomorphic Proxy Re-Encryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional single sign-on (SSO) systems expose biometric information to identity providers, compromising user privacy and lack user control over biometric data usage, and existing password-less solutions are inconvenient and insecure, especially when private keys are lost.
Innovation Solution
Implementing a method and system for biometric privacy using conditional homomorphic proxy re-encryption (CH-PRE) that encrypts biometric data at the user end, allowing authentication without decrypting at the identity provider, and using re-encryption keys to ensure secure and controlled access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If biometric information is stored in encrypted form using traditional encryption schemes, then security is improved, but it still needs to be decrypted for user authentication which exposes biometric information to the identity provider
Solution Approach 1:
The patent introduces a proxy re-encryption mechanism as an intermediary between the identity provider and the authentication process. The identity provider never decrypts the biometric information; instead, a proxy re-encryption key allows transformation of the encrypted biometric data into a form that can be authenticated without revealing the original biometric information to the identity provider.
Solution Approach 2:
The patent segments the authentication process into distinct cryptographic operations: initial encryption of biometric data, proxy re-encryption transformation, and final authentication verification. This segmentation allows the identity provider to participate in authentication without having access to the decrypted biometric information at any point.
2Ease of operation
If conventional SSO methods are used where identity providers have full access to biometric information, then authentication functionality is improved, but user privacy is compromised and user control over biometric data is lost
Solution Approach 1:
The proxy re-encryption mechanism acts as an intermediary that enables the identity provider to perform authentication operations without direct access to the user's biometric information. The re-encryption key serves as a mediator that transforms encrypted data without requiring decryption, thus maintaining both functionality and privacy.
Solution Approach 2:
The system performs preliminary encryption of biometric information using the user's public key before the authentication process begins. This preliminary action ensures that the biometric data remains encrypted throughout the authentication flow, and the proxy re-encryption capability is pre-configured to enable authentication without decryption.
3Reliability
If password-less authentication solutions are implemented, then security against phishing is improved, but convenience is reduced due to device type limitations and multiple master key copies are needed for resetting
Solution Approach 1:
The patent implements a universal authentication mechanism that works across different device types and authentication scenarios. The proxy re-encryption scheme provides a unified approach that maintains security while enabling cross-device functionality, eliminating the need for device-specific implementations and multiple master key copies.
4Measurement precision
If biometric information is exposed to identity providers for authentication, then authentication accuracy is improved, but user privacy and compliance with regulations like GDPR are compromised
Solution Approach 1:
The proxy re-encryption mechanism serves as an intermediary that enables authentication operations to be performed on encrypted biometric data without exposing the data to the identity provider. This maintains authentication accuracy by allowing proper comparison of biometric templates while preserving privacy through cryptographic transformation rather than direct exposure.
Data Source
Figure 1A
Figure 1B
Figure 2A
AI summary
The present disclosure provides biometric privacy in single sign-on with conditional homomorphic proxy re-encryption (CH-PRE). Conventional methods fail to provide authentication without revealing biometric data. In the present disclosure, when the user initiates a service request, a service provider redirects to an identify provider. Further, user encrypts biometrics using CH-PRE, creates ciphertext and submits to the identity provider for authentication. The identity provider uses template matching algorithms to compare the user submitted encrypted biometrics with stored templates. The identity provider then transforms authentication result into a new ciphertext using re-encryption key provided by the user and signs the resultant ciphertext. Further, the identity provider sends the re-encrypted authentication result along with the signature back to the service provider. Further, the service provider decrypts the resultant authentication result and verifies the authenticity by decrypting the homomorphically re-encrypted data using service provider private key, now having access to the authentication result.