Secret Key Generation from Multiple Biometric Features
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional authentication systems are vulnerable to unauthorized access due to simple bypass of matching operations and potential misuse of stored pre-registered templates or features, lacking robust security measures to prevent illegitimate authentication.
Innovation Solution
Implementing a shared secret scheme that generates a secret key from multiple features of an input, requiring possession of a minimum number of shared keys to derive the secret key, and storing additional features alongside pre-registered features to enhance security, making it difficult for unauthorized users to gain access even if they access the database.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional Boolean matching operation is used for authentication, then the authentication process is simple and fast, but the system becomes vulnerable to bypass attacks and template theft
Solution Approach 1:
The patent segments the authentication process into multiple independent stages: feature extraction, secret key generation via shared secret scheme, challenge generation, response verification, and authentication decision. Each stage performs a specific function, transforming a single vulnerable Boolean matching operation into a multi-stage protocol that resists bypass attacks and template theft while maintaining operational efficiency
Solution Approach 2:
The patent performs preliminary actions by pre-generating multiple challenges during the authentication process before the final verification decision. The server generates a secret key from shared features, then uses this secret key to generate multiple challenges that the client must respond to. This preliminary generation of cryptographic material prevents attackers from bypassing authentication or misusing stored templates, as the actual verification depends on dynamic challenge-response pairs rather than static template matching
2Reliability
If pre-registered templates are stored for matching, then authentication can be performed, but unauthorized users may access and misuse these templates
Solution Approach 1:
The patent extracts the critical security function from the stored templates by using them solely for generating a secret key through a shared secret scheme, rather than for direct matching. The templates are 'taken out' from the authentication decision process and used only to establish a shared secret between client and server. The actual authentication then relies on challenge-response verification using this secret key, preventing unauthorized access to templates while maintaining operational simplicity
Solution Approach 2:
The patent introduces a secret key as an intermediary between the stored templates and the authentication verification process. The templates never directly participate in matching; instead, they serve as input to generate the secret key, which then mediates the challenge-response authentication. This intermediary layer protects the templates from direct access while enabling secure authentication operations
3Reliability
If multiple shared keys are generated from multiple features, then security against unauthorized access is improved, but the key management complexity increases
Solution Approach 1:
The patent merges multiple feature-derived keys into a single secret key through the shared secret scheme. Instead of managing multiple independent keys separately, the system combines them using a cryptographic construction where the secret key is derived from shared features between client and server. This merging approach maintains high security (requiring multiple shared features) while simplifying key management, as the secret key serves as a unified credential for all subsequent challenge-response operations
Data Source
AI summary
A method for secret sharing utilizing multiple features of an input includes: receiving a registration input; obtaining features from the registration input; generating a secret key and a plurality of shared keys according to a shared secret scheme; associating each of the plurality of shared keys with a respective feature of the registration input; generating a plurality of additional features associated with additional keys having a similar format as a shared key associated with a respective feature; storing the plurality of shared keys associated with respective features together with the plurality of additional keys associated with additional features; and encrypting an element to be protected by the secret key using the secret key.