无需携带设备，用活体生物特征实现高强度在线身份认证。
BIDO: A Biometric Identity Online Authentication Framework
- 用用户记忆的密码+实时生物特征生成一次性签名密钥
- 在三大人脸数据集上验证准确率超92%，误识别率仅0.03%
- 支持所有FIDO2网站，不存储任何生物信息，适合安全敏感场景
安全系统需要持续、加密强度高的身份验证，且无需用户携带物理令牌或专用硬件。本文提出BIDO（Biometric Identity Online）——一种无设备认证标准，符合NIST SP 800-63B定义的认证保证等级2（AAL2），且不存储长期生物模板、人脸图像或任何个人身份信息（PII）。BIDO通过每次认证事件中使用用户自定义口令作为盐值，从实时生物特征中确定性地派生椭圆曲线数字签名算法（ECDSA）密钥材料，消除持久私钥存储，同时可在任意普通传感器终端完成验证。生成的凭证为不可发现（非驻留）的WebAuthn凭证，与所有FIDO2支持的网站服务完全兼容，无需服务器端修改。多阶段流程包括采集200个有效生物特征样本，使用Dlib 68点面部关键点预测器提取特征，仿射对齐人脸，前向检测过滤，计算双眼中点欧氏距离，以8为除数进行地板除量化，稳定跨会话漂移，并通过多数投票绑定SHA-256哈希生成验证种子（Vseed），从中瞬时派生WebAuthn凭证并在签名后立即清零。在三个主流人脸基准（VGGFace2、LFW、MegaFace）上评估，于LFW上达到99.51%验证准确率，在MegaFace Challenge 1（10^6干扰项）上实现92.14%的Rank-1识别准确率，密码学层面的错误接受率（FAR）为0.03%，错误拒绝率（FRR）为0.90%。
原文摘要 · Abstract (English)
Security systems demand continuous, cryptograph- ically robust identity verification without requiring subjects to carry physical tokens, smart cards, or dedicated hardware authenticators. This paper presents BIDO (Biometric Identity Online), a device-free authentication standard that achieves Au- thenticator Assurance Level 2 (AAL2) per NIST SP 800-63B with- out storing long-lived biometric templates, facial images, or any other form of Personally Identifiable Information (PII). BIDO derives Elliptic Curve Digital Signature Algorithm (ECDSA) key material deterministically from a live biometric measurement salted with a user-defined memorized secret at every authen- tication event, eliminating persistent private-key storage while enabling verification from any commodity sensor terminal. The generated credentials are non-discoverable (non-resident) Web Authentication (WebAuthn) credentials, fully compatible with all FIDO2-enabled websites and services without modification on the server side. A multi-stage pipeline, comprising capture of 200 valid biometric samples, feature extraction using the Dlib 68- point facial landmark predictor, affine face alignment, frontality gating, Euclidean distance computation from the inter-eye mid- point, floor-division quantization with divisor q = 8, inter-session drift stabilization, and majority-voting SHA-256 hash binding, produces a Verification Seed (Vseed) from which the WebAuthn credential is transiently derived and immediately zeroized after signing. Evaluated against three prominent face benchmarks (VGGFace2, LFW, and MegaFace), achieving 99.51% verification accuracy on LFW and 92.14% Rank-1 identification accuracy on MegaFace Challenge 1 at 10^6 distractors, with a cryptographic False Accept Rate (FAR) of 0.03%, a False Reject Rate (FRR) of 0.90%.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。