Homomorphic Encryption Vector Range Validation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing homomorphic and functional encryption systems in biometric authentication are vulnerable to malicious attacks where encrypted vectors with values outside the allowed range cause distance computations to wrap around, leading to false positive authentication successes.
Innovation Solution
Implementing a method that computes distance functions on homomorphic and functional encrypted vectors while detecting whether the vectors have elements outside the allowed range, using modular arithmetic and inner product validation with randomly chosen encrypted vectors to ensure accurate authentication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If modular arithmetic is used for distance computations on encrypted vectors, then computational efficiency and privacy preservation are improved, but vulnerability to wrap-around attacks increases when vectors contain values outside the allowed range
Solution Approach 1:
The patent applies preliminary action by performing range validation on encrypted vectors before executing distance computations. The server checks whether vector elements fall within the expected range using homomorphic operations prior to the main authentication calculation, preventing wrap-around attacks from affecting the result.
Solution Approach 2:
The patent introduces an intermediary validation mechanism that acts as a mediator between the encrypted vector input and the distance computation. This intermediary layer performs range checking using homomorphic operations, ensuring that only valid vectors proceed to the authentication calculation, thus isolating the main computation from attack vectors.
2Measurement precision
If the modulus p is set to a large value to accommodate biometric vector computations, then computational accuracy is improved, but the ability to detect wrap-around attacks decreases
Solution Approach 1:
The patent segments the authentication process into distinct phases: first performing range validation using homomorphic operations, then executing the distance computation. This segmentation allows the system to maintain large modulus values for computational accuracy while separately addressing security through validation, preventing wrap-around issues from compromising either aspect.
Solution Approach 2:
The patent implements feedback by using the range validation results to determine whether to proceed with authentication. The validation step provides feedback about the validity of input vectors, allowing the system to reject malicious inputs before they can cause wrap-around attacks, thus maintaining both accuracy and security.
3Loss of information
If homomorphic encryption is used for biometric authentication, then privacy preservation is improved, but detection of malicious encrypted vectors becomes more difficult
Solution Approach 1:
The patent applies self-service by enabling the encrypted vectors to validate themselves through homomorphic range checking operations. The vectors essentially check their own validity against the expected range using the public key, allowing the system to detect malicious inputs while maintaining privacy - no additional decryption or external validation is needed.
Solution Approach 2:
The patent uses the homomorphic encryption scheme's mathematical properties (analogous to color changes) to detect malicious vectors. By performing range validation operations on encrypted data, the system can detect whether vectors are within expected ranges, effectively changing the state of validation from invisible to detectable while preserving the encrypted form of the data.
Data Source
AI summary
Embodiments may provide distance computations on homomorphic and/or functional encrypted vectors while detecting whether the resulting distance has wrapped around due to the vectors having elements not in an allowed range. A method of user authentication processing may comprise receiving and storing enrollment information from a client computer system, the enrollment information comprising a template of authentication data and at least one additional encrypted vector, receiving an additional template to be used to authenticate the user from the client computer system, authenticating the user using the received additional template using the stored template and the stored at least one additional encrypted vector, and determining that authentication is successful when the received additional template matches the stored template and is valid based on the stored at least one additional encrypted vector.