Fingervein Desktop Access with Split Biometric Identity Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing access control systems in organizations rely heavily on password-based authentication, which is insecure, and integrating biometric systems is difficult due to privacy concerns and the need to replace or update existing infrastructure, posing deployment challenges and privacy risks.
Innovation Solution
A multimodal access control method and system that integrates biometric authentication with existing password-based systems by using a biometric scanner to capture fingervein patterns from multiple angles, encrypting and signing the data with a public and private key, and utilizing a separate biometric server for secure matching, ensuring privacy and compatibility with existing directory servers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If password-based authentication is used, then ease of operation is improved, but security is worsened
Solution Approach 1:
The authentication system is segmented into two independent parts: the existing password-based authentication (handled by the organization server) and the new biometric verification (handled by the biometric server). This allows the organization to maintain ease of operation with passwords while adding security through biometrics, without requiring users to change their authentication behavior significantly.
Solution Approach 2:
The patent merges password-based authentication and biometric authentication into a unified access control system. The organization server handles password verification and the biometric server handles fingerprint verification, and both must succeed for access to be granted. This combination maintains the ease of password entry while adding the security of biometric verification.
2Reliability
If biometric authentication is integrated into existing systems, then security is improved, but device complexity is worsened
Solution Approach 1:
The biometric server acts as an intermediary component between the user's fingerprint and the organization's authentication system. It receives encrypted biometric data from the scanner, performs verification against stored templates, and returns a simple verification result to the organization server. This intermediary approach adds security without significantly increasing the complexity of the existing organization server.
Solution Approach 2:
The system segments biometric processing into a separate, dedicated biometric server that handles only fingerprint verification. This isolation means the existing organization server and directory infrastructure remain unchanged, and the biometric component can be added independently, reducing the perceived complexity of integration.
3Adaptability or versatility
If biometric data is stored in the organization server, then authentication capability is improved, but privacy is worsened
Solution Approach 1:
The patent extracts biometric data handling from the organization server and places it in a separate biometric server. Biometric templates are stored only in the biometric server's secure database, not in the organization's directory server. This extraction eliminates the privacy risk of storing sensitive biometric data in general-purpose organization servers while maintaining authentication capability.
Solution Approach 2:
The biometric server serves as an intermediary that handles all biometric data processing and storage. It receives encrypted biometric images from scanners, converts them to templates, and stores them securely. The organization server never directly accesses or stores biometric data, only receiving verification results from the biometric server, thus protecting user privacy.
4Adaptability or versatility
If existing access control systems are replaced or updated, then functionality is improved, but ease of manufacture is worsened
Solution Approach 1:
The biometric server is designed as a universal component that can be integrated with any existing organization server or directory service (LDAP, Active Directory, etc.). It provides a standard verification interface that works with various authentication systems, allowing organizations to enhance their existing access control functionality without replacing their entire system.
Solution Approach 2:
The system performs preliminary biometric verification before granting access to organizational resources. The biometric server pre-verified the user's identity, and only then does the organization server proceed with authentication. This preliminary action allows the existing system to continue functioning as-is while adding enhanced security.
Data Source
AI summary
A method for controlling access of users to desktops, comprising: 1. a user enters a login; 2. an organization server verifies if the user is authorized to access the desktop, and returns a pseudo of the user; 3. the user scans a pattern of fingerveins of one finger with a biometric scanner comprising cameras at different angles; 4. a file corresponding to said images is encrypted by said biometric scanner (B) with a public key of a biometric server and signed with a private key of said biometric scanner, and sent to the desktop; 5. the desktop forwards said file to said biometric server; 6. the biometric server decrypts the file, verifies the signature of the biometric scanner, and matches the received images with reference images associated with said pseudo; 7. the biometric server decides if the recognition succeeded, failed, or if an additional scan is needed.