Multiuser Authentication with Biometric and TPM Key Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing authentication systems for multiuser devices fail to securely protect the integrity of private data, allowing unauthorized access and compromising sensitive information when multiple users share a device.
Innovation Solution
Implementing a security infrastructure with cryptographic keys, biometric units, and trusted platform modules (TPMs) to encrypt and decrypt data at the device level, ensuring each user's data is accessed only by authorized individuals using unique key pairs and biometric verification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If multiple users share a device without individual encryption, then device accessibility and ease of operation are improved, but data security and privacy protection deteriorate
Solution Approach 1:
The system divides the device's data space into separate encrypted containers, each assigned to a specific user. Each container is encrypted with unique cryptographic keys, physically isolating user data even though it resides on the same physical device. This segmentation allows multiple users to access the device while maintaining individual data security.
Solution Approach 2:
The system implements user-specific encryption keys and security credentials stored in local secure enclaves on the device. Each user's data is protected by their own cryptographic credentials stored in hardware security modules, ensuring that security properties are localized to each user's data space rather than applying a uniform security model to all users.
2Reliability
If individual user encryption is implemented, then data security and privacy are improved, but device complexity and resource consumption increase
Solution Approach 1:
The system automatically manages cryptographic key generation, storage, and rotation without requiring manual user intervention. Security credentials are automatically provisioned to users, and encryption/decryption operations are transparently handled by the system's security module. This self-service approach reduces operational complexity while maintaining strong security.
Solution Approach 2:
The system introduces a security module or trusted execution environment as an intermediary layer between users and their data. This intermediary automatically handles cryptographic operations, key management, and access control decisions, simplifying the overall system architecture by centralizing security functions rather than distributing complexity across all application layers.
3Reliability
If cryptographic key management is implemented for each user, then unauthorized access prevention is improved, but processing overhead and authentication time increase
Solution Approach 1:
The system pre-generates and stores cryptographic key pairs and security credentials during user registration and device setup. Public keys and encryption parameters are pre-configured for each user, and security credentials are provisioned in advance. This preliminary setup eliminates the need for complex real-time key generation during authentication, reducing authentication time while maintaining security.
Data Source
AI summary
The present disclosure discloses encrypting a folder stored on a user device based on utilizing a symmetric key; encrypting, based on utilizing a public key associated with the user device, the symmetric key to determine a single-encrypted symmetric key; transmitting, to a biometric unit available to the user device, a request to capture biometric information; verifying the biometric information based on a comparison of the biometric information with stored biometric information; selectively transmitting, to a trusted device located on the user device and based on successful verification of the biometric information, an encryption request to encrypt the single-encrypted symmetric key based on utilizing a trusted key that is generated by the trusted device, thereby determining a double-encrypted symmetric key; and storing the single-encrypted symmetric key and the double-encrypted symmetric key in a memory. Various other aspects and techniques are contemplated.