Privacy preserving knowledge and factor possession tests for persistent authentication
Example implementations described herein are directed to authentication based on the user's private factors, while not revealing at the server side information allowing the server (or anyone with the server's information) to deduce the private answers. In example implementations, the user answers a questionnaire with authentication factors, wherein the answers are transformed in a one-way fashion and the transformed answers are provided to the server side. Example implementations facilitate authentication based on polynomial interpolation or other methods to permit a user to authenticate, even if the user does not answer all of the questions correctly.
1. A device, comprising:
a processor, configured to:
generate a plurality of hashes from a plurality of responses to a plurality of questions;
generate an authentication hash from a polynomial interpolation of the plurality of hashes and algebraic operations over the plurality of hashes by use of a noisy interpolation algorithm, and adjust a threshold of the noisy interpolation algorithm by introduction of one of: one or more erroneous points for the polynomial interpolation, and one or more points for the polynomial interpolation; and
authenticate with the authentication hash; and
a memory configured to store the authentication hash.
2. The device of claim 1 , wherein the processor is configured to generate the authentication hash from the selection based on a selection of one of the plurality of hashes as the authentication hash, and wherein the processor is configured to generate each of the plurality of hashes from at least two of the plurality of responses.
3. The device of claim 1 , further comprising a memory configured to store a secret authentication hash, and wherein the processor is configured to authenticate with the authentication hash through a comparison of the secret authentication hash with the authentication hash, and further configured to:
use the secret authentication hash for authentication when the authentication hash matches the secret authentication hash, and
deny authentication when the authentication hash does not match the secret authentication hash.
4. The device of claim 1 , wherein the processor is configured to generate the authentication hash from the selection based on use of the plurality of hashes that correspond to the plurality of responses associated with the selected group of the plurality of questions to form the authentication hash.
5. A non-transitory computer readable storage medium storing instructions for executing a process, the instructions comprising:
generating a plurality of hashes from a plurality of responses to a plurality of questions;
generating an authentication hash from a polynomial interpolation of the plurality of hashes and algebraic operations over the plurality of hashes by use of a noisy interpolation algorithm, and adjust a threshold of the noisy interpolation algorithm by introduction of one of: one or more erroneous points for the polynomial interpolation, and one or more points for the polynomial interpolation; and
authenticating with the authentication hash.
6. The computer readable storage medium of claim 5 , wherein the generating the authentication hash from the plurality of hashes comprises performing a polynomial interpolation of the plurality of hashes.
7. The computer readable storage medium of claim 6 , wherein the authenticating with the authentication hash comprises:
comparing a secret authentication hash with the authentication hash;
using the secret authentication hash for authentication when the authentication hash matches the secret authentication hash, and
denying authentication when the authentication hash does not match the secret authentication hash.
8. The computer readable storage medium of claim 5 , wherein each of the plurality of hashes is generated from at least two of the plurality of responses; and wherein generating the authentication hash from the plurality of hashes comprises selecting one of the plurality of hashes as the authentication hash based on a selected group of the plurality of questions.
9. A server, comprising:
a processor configured to:
transmit a plurality of questions; and grant access when an authentication hash responsive to the transmitted plurality of questions matches a secret authentication hash; and deny access when the authentication hash does not match the secret authentication hash; wherein the authentication hash is generated from a polynomial interpolation of the plurality of hashes and algebraic operations over the plurality of hashes by use of a noisy interpolation algorithm, and adjust a threshold of the noisy interpolation algorithm by introduction of one of: one or more erroneous points for the polynomial interpolation, and one or more points for the polynomial interpolation; and
a memory configured to store the authentication hash.
10. The server of claim 9 , wherein the processor is configured to generate and transmit at least one of: one or more erroneous points, and one or more correct points for use in a noisy interpolation algorithm, based on the secret authentication hash and a threshold.
11. The server of claim 9 , wherein the processor is configured to select the secret authentication hash from a plurality of secret authentication hashes based on a selected group of the transmitted questions, wherein each of the plurality of secret authentication hashes is associated with at least two of the plurality of questions.
12. The server of claim 9 , wherein the processor is further configured to:
receive a response to the plurality of questions, the response comprising a response hash and an answer to one or a subset of the plurality of questions; and
construct the authentication hash from the response hash and the answer.
13. The server of claim 12 , wherein the processor is configured to construct the authentication hash by constructing a nested hash from the response hash and the answer.
14. The server of claim 12 , wherein the processor is configured to construct the authentication hash by multiplying the response hash with a hash of the answer.
15. The server of claim 9 , wherein the processor is further configured to receive the secret authentication hash and store the secret authentication hash into a memory after receiving a confirmation from a device associated a user and an account associated with the user.
16. The server of claim 9 , wherein the plurality of questions comprises a request for biometric information.