Secure Enclave Biometric Authentication via Virtualization Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current operating systems have a large attack surface, making them vulnerable to security breaches, and existing security measures like Intel SGX provide limited protection for biometric data, which is essential for secure authentication.
Innovation Solution
A computing device with hardware virtualization support and secure enclaves, such as Intel SGX, secures biometric data by encrypting it within a virtualization-protected memory buffer, ensuring it cannot be accessed by unauthorized software or hardware, and verifies its origin from a trusted biometric sensor, thus enhancing user privacy and security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If Intel SGX is used to provide secure enclave support, then confidentiality and integrity of biometric data are improved, but the attack surface is not sufficiently reduced and the trusted computing base is expanded
Solution Approach 1:
The patent extracts the biometric data processing functionality into a separate secure enclave environment that is isolated from the main operating system. The enclave contains only the essential code needed for biometric authentication, removing unnecessary components from the trusted computing base. This extraction allows the system to maintain high security for biometric data while minimizing the overall attack surface by having a smaller, more focused trusted computing base.
2Ease of operation
If facial recognition is used for biometric authentication, then ease of operation is improved, but false acceptance rates and false rejection rates are higher compared to other biometric methods
Solution Approach 1:
The patent merges multiple biometric authentication methods within the secure enclave environment. The system can combine facial recognition with other biometric factors such as fingerprint or iris recognition, allowing the advantages of each method to complement each other. This combination enables the system to maintain ease of operation through facial recognition while improving measurement precision by incorporating more accurate biometric verification methods, thereby reducing both false acceptance and false rejection rates.
Data Source
AI summary
Technologies for end-to-end biometric-based authentication and locality assertion include a computing device with one or more biometric devices. The computing device may securely exchange a key between a driver and a secure enclave. The driver may receive biometric data from the biometric sensor in a virtualization-protected memory buffer and encrypt the biometric data with the shared key. The secure enclave may decrypt the biometric data and perform a biometric authentication operation. The computing device may measure a virtual machine monitor (VMM) to generate attestation information for the VMM. A secure enclave may execute a virtualization report instruction to request the attestation information. The processor may copy the attestation information into the secure enclave memory. The secure enclave may verify the attestation information with a remote attestation server. If verified, the secure enclave may provide a shared secret to the VMM. Other embodiments are described and claimed.