A Framework for Token and Biometrics Based Authentication in Computer Systems

Abstract

User authentication is of vital importance to the security of computer systems. This paper proposes a new framework for multifactor authentication using token and various biometrics, such as fingerprint, retina scan, hand geometry and face pattern, which allows the authenticator, usually runs as a  sever, to store only cipher texts, instead of the plaintexts of the biometrics templates, so as to reduce the risk of disclosing personal data of users. Another advantage of the framework is that the biometrics templates are bound to the private key inside the token therefore cannot be modified by changing server-resident data. The framework is based on a special challenge-response protocol, which is used to authenticate the token and decrypt the cipher texts of biometrics at the same time, such that live biometrics samples collected from the token owners can be matched to the recovered templates. Besides principles and architecture, a cryptographic study of the framework is also presented, which focuses on a formal proof for the security of the new protocol, under the Random Oracle Model.