Oblivious RAM Biometric Identification Protocol

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Current biometric identification protocols using remote storage systems face challenges in ensuring data confidentiality and privacy of access patterns, particularly due to high computational costs and inefficiencies in existing encryption methods like Bloom filters and cryptographic techniques.

Innovation Solution

Implementing an Oblivious RAM protocol with locality-sensitive hash functions to securely compare biometric data by projecting iris codes onto smaller sequences and using Oblivious RAM protocols to hide access patterns, allowing for efficient identification without revealing sensitive information.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If encryption is used to protect biometric data in remote storage, then data confidentiality is improved, but access patterns become visible and privacy is compromised

Engineering Contradiction:
Improvedata confidentialityVSAvoidprivacy of access patterns
Core Design Contradiction:
ReliabilityVSLoss of information

Solution Approach 1:

The patent introduces an intermediary mechanism (Oblivious RAM protocol) between the client and remote storage server that mediates access operations. This intermediary layer encrypts access patterns and prevents the server from observing which data items are being accessed, thereby protecting privacy while maintaining data confidentiality through layered encryption approaches.

Inventive Principle:
Principle #24Intermediary (Mediator)

2Measurement precision

If the entire database is downloaded to perform identification, then identification accuracy is improved, but computational cost and time increase significantly

Engineering Contradiction:
Improveidentification accuracyVSAvoidcomputation time
Core Design Contradiction:
Measurement precisionVSLoss of time

Solution Approach 1:

The patent extracts and processes only the necessary subset of data for identification tasks. By using cryptographic techniques and selective data retrieval, the system extracts only the relevant biometric data needed for comparison rather than downloading the entire database, thereby maintaining identification accuracy while reducing computational time and resource consumption.

Inventive Principle:
Principle #2Taking out (Extraction)

Solution Approach 2:

The patent performs preliminary processing and indexing of biometric data before actual identification queries. Data is pre-processed, hashed, and organized in an optimized structure that enables rapid retrieval and comparison during identification operations, eliminating the need to process the entire database during actual queries.

Inventive Principle:
Principle #10Preliminary action

3Productivity

If Bloom filters are used in identification protocols, then data retrieval efficiency is improved, but computational cost increases

Engineering Contradiction:
Improvedata retrieval efficiencyVSAvoidcomputation cost
Core Design Contradiction:
ProductivityVSUse of energy by moving object

Solution Approach 1:

The patent modifies the parameters and structure of filtering mechanisms by replacing traditional Bloom filters with alternative cryptographic approaches. The system changes the fundamental parameters of how data is filtered and retrieved, using different hash function families and cryptographic primitives that reduce computational overhead while maintaining retrieval efficiency through optimized data structures and algorithms.

Inventive Principle:
Principle #35Parameter changes

Data Source

PatentEP2779520B1A process for obtaining candidate data from a remote storage server for comparison to a data to be identified
Publication Date: 2019.01.16 IDEMIA IDENTITY & SECURITY FRANCE SAS
  • EP2779520B1 patent drawingFigure 1
  • EP2779520B1 patent drawingFigure 2
  • EP2779520B1 patent drawingFigure 3a~3b

AI summary

The invention presents a process for obtaining candidate reference data to compare to a data to be identified, implemented in a system comprising a client unit and a storage server comprising two databases, in which: - the first database comprises indexed memory blocks each comprising a corresponding encrypted indexed reference data, and - the second database comprises memory blocks indexed by all possible hash values obtained by a plurality of k indexed hash functions, and wherein each block contains a list of the indexes of the reference data which hashing by one of said hash function results in the hash value corresponding to said block, said process comprising the steps during which : - the client unit hashes the data to be identified with each of the plurality of hash functions, and reads the k memory blocks of the second database corresponding to the hash values thus obtained, - the client unit identifies indexes contained in at least t out of k read memory blocks, and - the client unit reads the memory blocks of the first database indexed by the identified indexes in order to obtain the corresponding indexed reference data, said data being candidate data to compare to the data to be identified, the steps of reading memory blocks of the databases being carried out by executing a protocol preventing the storage server from learning which memory blocks of the databases are read. Another object of the invention is a system for the secure comparison of data.