Multi-party computation authorization for secure resource access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing authentication methods for secure resources expose private data to potential threats by decrypting it for comparison, compromising security and privacy, and lack granular comparison capabilities.
Innovation Solution
Implementing Multi-Party Computation (MPC) using encrypted shares and keys, where computing nodes compare encrypted private data with reference encrypted data without access to decryption keys, ensuring security and computing a match score for access control.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If private data is decrypted for comparison during authentication, then authentication accuracy is improved, but security and privacy are compromised
Solution Approach 1:
The private data is segmented into multiple encrypted shares that are distributed across different computing nodes. Each node holds only a portion of the encrypted data, making it impossible for any single node to access the complete private information. The segmentation allows comparison operations to be performed on distributed encrypted shares without reconstructing the full private data, thus maintaining both authentication accuracy and security.
Solution Approach 2:
An MPC-based comparison protocol acts as an intermediary mechanism that enables authentication without direct exposure of private data. The protocol facilitates secure comparison between encrypted user data and reference data through cryptographic operations, allowing the system to determine authentication status without either party needing to see the actual private information in clear form.
2Object-affected harmful factors
If encrypted data is used for comparison, then security is improved, but comparison capability is reduced
Solution Approach 1:
The system transforms the comparison operation into a cryptographic parameter problem. Instead of comparing raw encrypted data directly, the MPC protocol converts the comparison task into evaluating cryptographic parameters (such as polynomial evaluations or homomorphic encryption operations) that can be performed on encrypted shares. This parameter transformation maintains security while enabling sophisticated comparison capabilities including exact matching, fuzzy matching, and threshold-based authentication.
3Object-affected harmful factors
If multiple computing nodes are used for MPC, then security is improved, but system complexity increases
Solution Approach 1:
The MPC-based authentication system is designed as a universal framework that can handle multiple authentication scenarios and data types through a single standardized protocol. The same MPC infrastructure supports exact matching, fuzzy matching, threshold authentication, and other comparison operations across different computing nodes. This universality reduces the need for node-specific implementations and simplifies the overall system architecture despite the distributed nature of the security mechanism.
Data Source
AI summary
Provided herein are system, devices and methods for applying Multi-Party Computation (MPC) to authenticate a user accessing a secure resource using a plurality of computing nodes. The computing nodes, each receiving a respective one of a plurality of encrypted shares created using a plurality of keys to encrypt private data captured by a client device used by the user accessing the secure resource, engage in a secure MPC to compare between the encrypted shares and reference encrypted private data copies also encrypted using the plurality of keys without decrypting the private data since the keys are not available to the computing nodes. The computing nodes compute a match score based on the comparison and transmit it to a controller of the secure resource configured to grant or deny the client device access to the secure resource based on the match score.