Biometry with challenge response pair mechanism
View Patent ↗Methods for the encoding an encryption key for secure storage are disclosed. The methods rely on the use of unclonable, one-way functions, such as images of biological objects that may be measured according to challenges to result in responses. A biometric print of a biological object is measured with a set of n challenges resulting in n responses. The responses are an ordered sequence, with each response having a fixed position in the sequence. A key is generated of bit length n. A subset of m responses in the full set of n responses is selected, where the selected responses correspond to positions of is in the key. The response subset is stored. The key is then used, and deleted. A party wishing to re-generate the key generates the same set of challenges, measures the same biological object with the challenges a second time, and generates a second set of n responses. Responses in the stored subset of m responses will match responses in the second set of n responses at certain positions in second set of n responses. These matching positions correspond to 1s in the key. The non-matching positions correspond to 0s. Thus, comparison between the response sets recovers the key.
1 . A method of generating and sharing a cryptographic key between a client and a server device, comprising:
executing an enrollment procedure comprising:
generating a sequence of seeds;
deriving, from the sequence of seeds, a first ordered sequence of n challenges specifying measurement instructions for a biometric print;
making a first biometric print of a biological object, and measuring the first biometric print in accordance with the first ordered sequence of n challenges resulting in a first ordered sequence of n responses;
storing the sequence of seeds at each of the client and server devices, and storing the ordered sequence of n responses at the server device; and
executing a key exchange procedure comprising:
deriving, from the sequence of seeds, the first ordered sequence of n challenges;
making a second biometric print of the biological object, and measuring the second biometric print in accordance with the ordered sequence of n challenge instructions resulting in a second ordered sequence of n responses;
generating a binary first key of n bit length;
selecting, within the second ordered sequence of n responses those responses having a position in the sequence corresponding to the positions of a first binary symbol in the first key, resulting in m responses;
sending the m responses to the server;
comparing each of the m responses to each response in the first ordered sequence of n responses to determine matches;
generating a second binary key of n bit length by:
on the basis of the comparison, determining positions of responses in the first ordered sequence of n responses that match responses in the subset of m responses, assigning the first binary symbol to those positions, and assigning a second binary symbol to the remaining positions.
2 . The method of claim 1 , wherein generating the sequence of seeds comprises generating n seeds with a random number generator.
3 . The method of claim 2 , wherein generating the sequence of seeds further comprises generating the sequence of seeds with a user supplied password.
4 . The method of claim 1 , wherein the biological object is a human face.
5 . The method of claim 4 , wherein the biological object is the face of the user of the terminal device.
6 . The method of claim 4 , wherein the first and second biometric prints are images of the face.
7 . The method of claim 6 , wherein the first ordered sequence of n challenges specifying measurement instructions for a biometric print specify instructions for measuring a distance from one or more points in a coordinate space to one or more facial landmarks.
8 . The method of claim 1 , wherein the biological object is one of a finger, palm, iris, or retina.
9 . The method of claim 1 , wherein generating a binary first key of n bit length comprises generating a binary first key of n bit length with a random number generator.
10 . The method of claim 1 , wherein the first the first binary symbol is a 1.
11 . The method of claim 1 , wherein deriving, from the sequence of seeds, a first ordered sequence of n challenges specifying measurement instructions for a biometric print comprises hashing each seed in the sequence with a password.
12 . The method of claim 1 , wherein comparing each of the m responses to each response in the first ordered sequence of n responses to determine matches comprises computing a Hamming distance between each of the m responses and each response in the first ordered sequence of n responses and determining a match when the Hamming distance is below a predetermined threshold.
13 . The method of claim 1 , wherein making the first and second biometric print of the biological object comprises taking an image of the biological object with a camera at the terminal device.