Biometric-based identity verification using zero-knowledge proofs
Disclosed are various embodiments for verifying a consumer's identity during card-not-present (CNP) transactions using biometric data (e.g., fingerprint, retina scan, iris scan, handprint, voice sample, face scan, etc.) of the consumer obtained using a biometric security device. A zero-knowledge proof algorithm is used to verify the identity of a user initiating a transaction without disclosing personal information (e.g., biometric data) of the user to the issuer, merchant, recipient and/or other party, thereby preserving the privacy of the user.
1. A system, comprising:
a client device comprising a processor and a memory; and
machine-readable instructions stored in the memory that, when executed by the processor, cause the client device to at least:
transmit a request to initiate a transaction to a transaction terminal;
receive a verification request from the transaction terminal, the verification request requesting verification of a user associated with the transaction and the client device, the verification request including transaction details associated with the transaction;
send a signature request to a biometric security device, the signature request including the transaction details;
receive signed transaction details and a public key from the biometric security device, the signed transaction details being signed using a private key generated based at least in part on biometric data associated with the user;
generate a proof of membership using a prover kit and the public key; and
transmit the proof of membership, the public key and the signed transaction details to the transaction terminal as a response to the verification request.
2. The system of claim 1 , wherein the proof of membership comprises a zero-knowledge proof configured to verify an identity of the user associated with the transaction.
3. The system of claim 1 , wherein the prover kit is part of a zero-knowledge proof algorithm, and when executed, the machine-readable instructions further cause the client device to at least receive the prover kit from a security provider.
4. The system of claim 1 , wherein the biometric data comprises at least one of a fingerprint, a handprint, a retinal scan, a facial scan, or a voice sample.
5. The system of claim 1 , wherein the biometric security device is integrated with the client device.
6. The system of claim 1 , wherein the public key is derived from the private key.
7. The system of claim 1 , wherein the biometric security device is communicatively coupled to the client device via a wired or wireless connection.
8. A method, comprising:
transmitting a request to initiate a transaction to a transaction terminal;
receiving a verification request from the transaction terminal, the verification request requesting verification of a user associated with the transaction and a client device, the verification request including transaction details associated with the transaction;
sending a signature request to a biometric security device, the signature request including the transaction details;
receiving signed transaction details and a public key from the biometric security device, the signed transaction details being signed using a private key generated based at least in part on biometric data associated with the user;
generating a proof of membership using a prover kit and the public key; and
transmitting the proof of membership, the public key and the signed transaction details to the transaction terminal as a response to the verification request.
9. The system of claim 8 , wherein the proof of membership comprises a zero-knowledge proof configured to verify an identity of the user associated with the transaction.
10. The system of claim 8 , wherein the prover kit is part of a zero-knowledge proof algorithm, and further comprising receiving the prover kit from a security provider.
11. The system of claim 8 , wherein the biometric data comprises at least one of a fingerprint, a handprint, a retinal scan, a facial scan, or a voice sample.
12. The system of claim 8 , wherein the biometric security device is integrated with the client device.
13. The system of claim 8 , wherein the public key is derived from the private key.
14. The system of claim 8 , wherein the biometric security device is communicatively coupled to the client device via a wired or wireless connection.
15. A non-transitory, computer-readable medium, comprising machine-readable instructions that, when executed by a processor of a client device, cause the computing device to at least
transmit a request to initiate a transaction to a transaction terminal;
receive a verification request from the transaction terminal, the verification request requesting verification of a user associated with the transaction and the client device, the verification request including transaction details associated with the transaction;
send a signature request to a biometric security device, the signature request including the transaction details;
receive signed transaction details and a public key from the biometric security device, the signed transaction details being signed using a private key generated based at least in part on biometric data associated with the user;
generate a proof of membership using a prover kit and the public key; and
transmit the proof of membership, the public key and the signed transaction details to the transaction terminal as a response to the verification request.
16. The non-transitory, computer-readable medium of claim 15 , wherein the proof of membership comprises a zero-knowledge proof configured to verify an identity of the user associated with the transaction.
17. The non-transitory, computer-readable medium of claim 15 , wherein the prover kit is part of a zero-knowledge proof algorithm, and when executed, the machine-readable instructions further cause the client device to at least receive the prover kit from a security provider.
18. The non-transitory, computer-readable medium of claim 15 , the biometric data comprises at least one of a fingerprint, a handprint, a retinal scan, a facial scan, or a voice sample.
19. The non-transitory, computer-readable medium of claim 15 , wherein the biometric security device is integrated with the client device.
20. The non-transitory, computer-readable medium of claim 15 , wherein the public key is derived from the private key.