On-Device Biometric Token Authentication Against User Impersonation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing authentication methods relying on device credentials are vulnerable to unauthorized access, allowing third parties to impersonate legitimate users in remote communications, as they lack direct verification of the user's identity.
Innovation Solution
Implement on-device identity verification by matching captured biometric information with stored biometric information associated with a trusted identification credential, generating a cryptographically signed authentication token to confirm the user's identity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If device credentials are used for authentication, then authentication simplicity is maintained, but security against impersonation deteriorates
Solution Approach 1:
The authentication system is segmented into two distinct components: device credentials (stored on the device) and biometric credentials (stored securely on the device). This segmentation allows the system to maintain simplicity through automated device credential verification while enhancing security through biometric verification of the actual user's identity, preventing impersonation even if device credentials are compromised.
Solution Approach 2:
Biometric data serves as an intermediary verification layer between the device credentials and the authentication outcome. The system first verifies device credentials, then uses biometric matching as an intermediary step to confirm the user's identity before granting full authentication, thereby preventing impersonation while maintaining operational simplicity.
2Measurement precision
If biometric verification is performed on the device, then user identity verification accuracy is improved, but device processing requirements increase
Solution Approach 1:
Biometric data is collected and processed in advance during device setup or enrollment phases. The system performs preliminary biometric template creation and storage securely on the device, so that during actual authentication, only comparison operations are needed, reducing real-time processing requirements while maintaining high verification accuracy.
Solution Approach 2:
Instead of storing raw biometric data, the system creates and stores simplified biometric templates or feature extracts as copies. These templates contain the essential verification information in a compressed format that requires minimal processing power for comparison, thereby reducing device complexity requirements while preserving identity verification accuracy.
Data Source
AI summary
This document describes systems and techniques for authenticating a user by matching a trusted identification credential with on-device identity verification in generating an authentication token. For example, a request to verify an identity of a current user of the first communications device is received from a second communications device. A trusted identification credential associated with stored biometric information of a designated user is accessed. A sensor of the first communications device is used to collect captured biometric information of the current user. A verification is performed to determine if the captured biometric information matches the stored biometric information. Responsive to determining that the captured biometric information matches the stored biometric information, an authentication token is generated including a cryptographically signed assertion that includes the nonce received from the second communications device and an assertion confirming the match between the captured biometric information and the stored biometric information.