Authentication system using secure multi-party computation

Patent metadata

Field	Value
Publication number	US-12095921-B2
Application number	US-202217872386-A
Country	US
Kind code	B2
Filing date	Jul 25, 2022
Priority date	Mar 24, 2017
Publication date	Sep 17, 2024
Grant date	Sep 17, 2024

Abstract

The invention is directed to a system that enables an authentication process that involves secure multi-party computation. The authentication process can be performed between a user device operated by a user and an access device. The user device and the access device may conduct the authentication process such that enrollment information and authentication information input by the user is not transmitted between the devices. Instead, the user device may determine and utilize obfuscated values associated with the authentication information. The user device may also determine an obfuscated authentication function that can be utilized to determine an authentication result without revealing enrollment information and authentication information associated with the user. The user can be authenticated based on the authentication result.

First claim

What is claimed is:

1. A method comprising:
determining, by a first device, an obfuscated circuit;
receiving, by the first device, a request for obfuscated authentication information;
sending, by the first device and via an oblivious transfer protocol, obfuscated values to a second device to enable the second device to translate authentication information input by a user to the second device into obfuscated authentication information;
receiving, by the first device, an obfuscated authentication result from the second device, wherein the obfuscated authentication result is determined by the second device evaluating the obfuscated circuit for the obfuscated authentication information; and
determining, by the first device, whether the user is authenticated based on the obfuscated authentication result.

2. The method of claim 1 , wherein determining the obfuscated circuit comprises:
determining, by the first device, enrollment information input by the user;
determining, by the first device, an authentication function that evaluates whether the user is authenticated based on the enrollment information and the authentication information;
determining, by the first device, a circuit representing the authentication function; and
obfuscating, by the first device, values of the circuit to determine the obfuscated circuit associated with the circuit.

3. The method of claim 2 , wherein the obfuscated circuit is valid for a set number of uses, and the first device is a mobile phone, and the second device is a point of sale terminal.

4. The method of claim 1 , wherein determining whether the user is authenticated based on the obfuscated authentication result comprises:
determining, by the first device, one or more non-obfuscated values associated with the obfuscated authentication result;
determining, by the first device, an authentication result based on the one or more non-obfuscated values; and
determining, by the first device, whether the user is authenticated based on the authentication result.

5. The method of claim 4 , wherein the authentication result indicates a degree to which the authentication information matches enrollment information.

6. The method of claim 1 , wherein the authentication information includes biometric information.

7. The method of claim 1 , wherein the obfuscated circuit comprises a plurality of connected logic gates, each of the plurality of connected logic gates are associated with a gate identifier, wherein the obfuscation values include the gate identifier.

8. The method of claim 1 , further comprising:
providing, by the first device to the second device, information associated with the obfuscated circuit.

9. The method of claim 8 , wherein the information associated with the obfuscated circuit comprises obfuscated values for logic gates in the obfuscated circuit and information indicating how the logic gates in the obfuscated circuit are connected to each other.

10. A method comprising:
receiving, by a second device, authentication information input by a user;
receiving, by the second device from a first device, information associated with an obfuscated circuit;
sending, by the second device, a request for obfuscated authentication information to the first device, the first device initiating a process with the second device, the process involving an oblivious transfer protocol between the first device and the second device;
receiving, by the second device via the oblivious transfer protocol, from the first device, obfuscated values to enable the second device to translate the authentication information into obfuscated authentication information;
evaluating, by the second device, the obfuscated circuit for the obfuscated authentication information to determine an obfuscated authentication result; and
sending, by the second device, the obfuscated authentication result to the first device, wherein the user is authenticated based on the obfuscated authentication result.

11. The method of claim 10 , wherein the first device and the second device communicate over a local network connection.

12. The method of claim 10 , wherein the obfuscated circuit comprises a plurality of connected logic gates are associated with a gate identifier.

13. A device comprising:
a processor; and
a computer-readable medium coupled to the processor, the computer-readable medium including code executable by the processor for performing operations comprising:
determining an obfuscated circuit;
sending a request for obfuscated authentication information;
sending, via an oblivious transfer protocol, obfuscated values to a second device, to enable the second device to translate authentication information input by a user to the second device into obfuscated authentication information;
receiving, an obfuscated authentication result from the second device, wherein the obfuscated authentication result is determined by the second device evaluating the obfuscated circuit for the obfuscated authentication information; and
determining whether the user is authenticated based on the obfuscated authentication result.

14. The device of claim 13 , wherein determining the obfuscated circuit comprises:
determining enrollment information input by the user;
determining an authentication function that evaluates whether the user is authenticated based on the enrollment information and the authentication information;
determining a circuit representing the authentication function; and
obfuscating values of the circuit to determine the obfuscated circuit associated with the circuit.

15. The device of claim 14 , wherein the obfuscated circuit is valid for a set number of uses.

16. The device of claim 13 , wherein determining whether the user is authenticated based on the obfuscated authentication result comprises:
determining one or more non-obfuscated values associated with the obfuscated authentication result;
determining an authentication result based on the one or more non-obfuscated values; and
determining whether the user is authenticated based on the authentication result.

17. The device of claim 16 , wherein the authentication result indicates a degree to which the authentication information matches enrollment information.

18. The device of claim 13 , wherein the authentication information includes biometric information.

19. The device of claim 14 , wherein the obfuscated circuit comprises a plurality of connected logic gates, each of the plurality of connected logic gates are associated with a gate identifier, wherein the obfuscation values include the gate identifier.

20. The device of claim 13 , wherein the operations further comprise:
providing, to the second device, information associated with the obfuscated circuit, wherein the information associated with the obfuscated circuit comprises obfuscated values for logic gates in the obfuscated circuit and information indicating how the logic gates in the obfuscated circuit are connected to each other.

Assignees

• Visa Int Service Ass

Inventors

• Wagner Kim R
• Sheets John F

Classifications

• G06F21/31 Primary

  User authentication · CPC title

• H04L2209/16

  Obfuscation or hiding, e.g. involving white box · CPC title

• H04L2209/50

  Oblivious transfer · CPC title

• H04L2209/46

  Secure multiparty computation, e.g. millionaire problem · CPC title

• H04L63/0861

  using biometrical features, e.g. fingerprint, retina-scan (cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231) · CPC title