Method and device for privacy protection biometric authentication, and electronic device

Patent metadata

Field	Value
Publication number	US-12256012-B2
Application number	US-202418605868-A
Country	US
Kind code	B2
Filing date	Mar 15, 2024
Priority date	Jan 13, 2022
Publication date	Mar 18, 2025
Grant date	Mar 18, 2025

Abstract

A method and an apparatus for privacy protection biometric authentication and an electronic device. The method comprises the following steps: constructing a corresponding a biological data template according to a biological information data set input by a user when registering; generating a pair of public key and private key by asymmetric cryptography technology; generating encrypted biological data by a secret sharing solution and OKVS technology according to the biological data template and the private key; sending the public key and the encrypted biological data to a server; recovering the private key by OKVS technology according to the biological data input by the user during authentication and the encrypted biological data; constructing a signature according to the recovered private key and the corresponding public key; sending the signature to the server, so that the server verifies the user according to the public key and the signature.

First claim

What is claimed is:

1. A method for privacy protection biometric authentication, which is applied to a client and comprising:
constructing a biological data template according to a biological information data input by a user when registering;
generating a pair of public key and private key by asymmetric cryptography technology; generating encrypted biological data by a secret sharing solution and OK VS (Oblivious Key-Value Store) technology according to the biological data template and the private key;
sending the public key and the encrypted biological data to a server;
recovering the private key by OKVS technology according to the biological information data input by the user during authentication and the encrypted biological data;
constructing a signature according to the recovered private key and the corresponding public key; and sending the signature to the server, so that the server verifies the user according to the public key and the signature;
wherein said generating encrypted biological data by the secret sharing solution and the OKVS technology according to the biological data template and the private key comprises:
sharing the private key as a corresponding number of secret shares of the private key according to a number of feature points in the biological data template; and
generating the encrypted biological data by the OKVS technology according to the biological data template and the secret shares of the corresponding private key, comprising: selecting an OKVS technology randomly, adopting biological data as a key, taking the secret shares of the private key as values for encryption, and obtaining encrypted biological data; and
wherein OKVS (Oblivious Key-Value Store) is a cryptographic protocol, and KVS (Key-Value Store) includes two algorithms: Encode algorithm and Decode algorithm, wherein an input of the Encode algorithm is a set of key-value pairs {(K I , V i )}, and if execution of the Encode algorithm 1s successful, an output of the Encode algorithm is a data structure S that stores key-value information; and wherein an input of the Decode algorithm is the data structure S that stores key information and a key k i , and an output of the Decode algorithm is a value v i corresponding to the key k i ,

S
/

⊥

←

Encode
(

{

(

k
1

,

v
1

,

)

,

(

k
2

,

v
2

)

⁢

…
⁢

(

k
n

,

v
n

)

}

)

⁢

v
i

←

Decode
(

S
,

k
i

)

where ⊥ represents a termination symbol output when execution of the Encode algorithm is failed.

2. The method according to claim 1 , wherein said constructing a biological data template according to a biological information data input by a user when registering comprises:
preprocessing the biological information data;

extracting features of the preprocessed biological information feature set to obtain biological feature data according to a type of biological information in the biological information data;
quantifying biological feature information according to a category corresponding to the biological feature data; and
constructing the corresponding biological feature template according to the quantified biological feature data.

3. The method according to claim 1 , wherein said recovering the private key by OKVS technology according to the biological data input by the user during authentication and the encrypted biological data comprises:
constructing a verification template according to the biological information data input by the user during verification;
decrypting the encrypted biological data by the OK VS technology according to the verification template to obtain a plurality of secret shares of the private key, wherein a number of the secret shares of the private key is greater than a predetermined number; and
recovering the private key according to the secret shares of the private key.

4. A method for privacy protection biometric authentication, which is applied to a server, comprising:
receiving a public key sent by a client, wherein the public key is generated by the client using asymmetric cryptography technology;
acquiring encrypted biological data, wherein the encrypted biological data is sent by the client or generated by the server by using a secret sharing solution and (Oblivious Key-Value Store) OKVS technology according to a biological data template and a private key, wherein the private key is generated by the client by using the asymmetric cryptography technology, and the biological data template is constructed by the client according to a biological information data input by a user when registering;
storing the public key and the encrypted biological data;
receiving a signature sent by the client, wherein the signature is constructed by the client according to a recovered private key and a corresponding public key, and the recovered private key is obtained by recovering the private key by the client according to biological data input by the user during verification by using the OKVS technology; and
verifying the user according to the public key and the signature;
wherein said generating encrypted biological data by the secret sharing solution and the OKVS technology according to the biological data template and the private key comprises:
sharing the private key as a corresponding number of secret shares of the private key according to a number of feature points in the biological data template; and
generating the encrypted biological data by the OKVS t

Assignees

• Univ Zhejiang
• Zju Hangzhou Global Scientific And Tech Innovation Center

Inventors

• Zhang Bingsheng
• Wang Zhigao
• Ren Kui

Classifications

• H04L9/3247

  involving digital signatures · CPC title

• H04L9/0825 Primary

  using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates · CPC title

• H04L9/085

  Secret sharing or secret splitting, e.g. threshold schemes · CPC title

• H04L9/3231 Primary

  Biological data, e.g. fingerprint, voice or retina (network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861) · CPC title

• G06F21/64

  Protecting data integrity, e.g. using checksums, certificates or signatures · CPC title