Deriving cryptographic keys from biometric parameters

Patent metadata

Field	Value
Publication number	US-2016105285-A1
Application number	US-201414514312-A
Country	US
Kind code	A1
Filing date	Oct 14, 2014
Priority date	Oct 14, 2014
Publication date	Apr 14, 2016
Grant date	—

Abstract

One feature pertains to a biometric cryptographic technique that exploits synthetic fingerprints or other synthetic biometric information. In one aspect, biometric parameters are obtained from a user and compared to a database of biometric templates to identify templates that most closely match the biometric parameters of the user. The database includes several authentic templates for the user and a much larger number of templates derived from synthetic biometric information (e.g. a million or more synthetic templates) not associated with the user. A set of candidate cryptographic keys are obtained based on the templates that most closely match the biometric parameters from the user. The candidate cryptographic keys are applied to access information secured with a valid cryptographic key of the user to identify a key that gains access, thus decrypting data and authenticating the user. In addition to decryption and authentication, digital signatures can be obtained using techniques described herein.

First claim

What is claimed is:

1 . A method for biometric processing, comprising:
obtaining biometric parameters from a user; comparing the biometric parameters to a database of biometric data objects to identify biometric data objects that most closely match the biometric parameters from the user, wherein the database includes at least one authentic biometric data object for the user and a larger number of synthetic biometric data objects not associated with the user; obtaining a plurality of candidate cryptographic keys based on the biometric data objects that most closely match the biometric parameters from the user; and applying one or more of the plurality of candidate cryptographic keys in an attempt to access information secured with a valid cryptographic key of the user.

2 . The method of claim 1 , wherein applying one or more of the plurality of candidate cryptographic keys in an attempt to access information includes authenticating the user by identifying a candidate key that successfully accesses a system secured by the valid cryptographic key of the user.

3 . The method of claim 1 , wherein applying one or more of the plurality of candidate cryptographic keys in an attempt to access information includes decrypting information previously encrypted by the valid cryptographic key of the user.

4 . The method of claim 1 , wherein the biometric parameters correspond to a plurality of different biometric parameters from the user including one or more skinprint parameters, iris scan parameters and voice recognition parameters.

5 . The method of claim 4 , wherein the skinprint parameters include one or more fingerprints, thumbprints and knuckle prints.

6 . The method of claim 4 , wherein the iris scan parameters correspond to different portions of the iris of at least one eye of the user.

7 . The method of claim 1 , wherein the database includes at least one authentic biometric data object for each of a plurality of different biometric parameters of the user and a larger number of synthetic biometric data objects not associated with the user.

8 . The method of claim 7 , wherein the larger number of synthetic biometric data objects not associated with the user includes at least a million synthetic biometric data objects.

9 . The method of claim 1 , wherein the biometric data objects are each associated with an offset corresponding to a point on a multidimensional curve using modular arithmetic and wherein a predetermined number of offsets are required to uniquely specify the multidimensional curve.

10 . The method of claim 9 , wherein obtaining a particular cryptographic key of the plurality of candidate cryptographic keys includes deriving a cryptographic key component from a corresponding multidimensional curve specified by the offsets corresponding to some of the plurality of the identified biometric data objects.

11 . The method of claim 10 , wherein deriving the corresponding cryptographic key component from the corresponding multidimensional curve includes identifying a point of intersection of the corresponding multidimensional curve with a predetermined axis.

12 . The method of claim 1 , wherein comparing the biometric parameters to a database of biometric data objects to identify biometric data objects that most closely match the biometric parameters from the user includes identifying ten or fewer biometric data objects for each biometric parameter from a database of at least a million biometric data objects.

13 . The method of claim 1 , wherein applying one or more of the plurality of candidate cryptographic keys in an attempt to access information secured with a valid cryptographic key of the user comprises authenticating the user by:
applying the candidate cryptographic keys to a secure system programmed with the valid cryptographic key until one of the candidate cryptographic keys accesses the secure system and the user is thereby authenticated and, if none of the candidate cryptographic keys accesses the secure system, the user is thereby not authenticated.

14 . The method of claim 1 , wherein the cryptographic key is one or more of a symmetric cryptographic key, a private cryptographic key of an asymmetric private key/public key pair, or a cryptographic seed used to initialize a pseudo-random generator from which a key is generated.

15 . The method of claim 1 , further including a setup procedure for generating the database that includes the at least one authentic biometric data object for the user and the larger number of synthetic biometric data objects not associated with the user.

16 . The method of claim 15 , wherein the setup procedure comprises:
selecting a multidimensional curve for the user and selecting a plurality of points on the multidimensional curve; obtaining a plurality of initial biometric parameters from the user; for each of the plurality of initial biometric parameters, generating and storing a corresponding biometric template and associating a selected one of the plurality of points with the biometric template wherein a sufficient number of initial biometric parameters are obtained to uniquely specify the multidimensional curve for the user; and associating a cryptographic key component with the multidimensional curve for the user.

17 . The method of claim 16 , wherein the setup procedure further comprises:
selecting a plurality of additional multidimensional curves for use with synthetic biometric parameters and selecting a plurality of points on each of the additional multidimensional curves; obtaining a plurality of synthetic biometric parameters not associated with the user; for each of the plurality of synthetic biometric parameters, generating and storing a corresponding synthetic biometric template in the database and associating a selected one of the plurality of points on a selected one of the additional multidimensional curves with the synthetic biometric template; and associating an additional cryptographic key component with each of the additional multidimensional curves.

18 . The method of claim 17 , further comprising mixing the biometric templates for the user with the synthetic biometric templates within the database so that the source of any particular template is obscured.

19 . The method of claim 17 , further comprising compacting the database of biometric objects into a seed from which the full database can be regenerated.

20 . The method of claim 17 , wherein individual biometric data objects in the database include either an authentic biometric data object for the user or a synthetic biometric data object not associated with the user but not a combination of both.

21 . The method of claim 17 , wherein a subset of a total number of cryptographic key components is stored and additional cryptographic key components are generated based on the stored cryptographic key components.

22 . A device, comprising:
a biometric parameter detector operative to obtain at least one biometric parameter from a user; a storage device; and a processing circuit operative to
obtain biometric parameters from the user using the biometric parameter detector;
compare the biometric parameters to a database of biometric data objects stored in the storage device to identify biometric data objects that most closely match the biometric parameters from the user, wherein the database includes at least one authentic biometric data object for the user and a larger number of synthetic biometric data objects not

Assignees

• Qualcomm Inc

Inventors

• Jakobsson Bjorn Markus

Classifications

• H04L9/0866

  involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics · CPC title

• H04L9/14

  using a plurality of keys or algorithms · CPC title

• H04L2209/24

  Key scheduling, i.e. generating round keys or sub-keys for block encryption · CPC title

• H04L9/3231 Primary

  Biological data, e.g. fingerprint, voice or retina (network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861) · CPC title