How are the encrypted FHE payloads produced by Private Identity different from the templates produced by a cloud-based biometric recognition system?

Question

How does the Private Identity system work? I am familiar with template-based matching systems and cloud-based recognition DNNs, but none of these use fully homomorphic encryption. How does a DNN provide an embedding? How does this embedding differ from templates used today?

Answer 1

Private Identity uses fully homomorphic encryption (FHE) to provide a privacy-preserving AI service framework that supports encrypted biometric enrollment, match and search operations on encrypted data. In this application, FHE provides both secure storage and secure computation by allowing the cloud to calculate the similarity (geometric distance) between two sets of vector data in their encrypted form.

In this application, Private Identity uses the FHE algorithm to preserve privacy by concealing the input data, the output data and even the occurrence of search itself. This is important for compiling with industry standards and worldwide data privacy laws.

As your question points out, the FHE algorithm does not resemble the data used to support the usual template-based or cloud-based DNN recognition algorithms. Instead of creating a template, the Private Identity recognition algorithm uses the biometric as input to a pre-trained mobile embedding DNN (using Tensorflow.js on the user’s local device) to create a 1-way cryptographic hash that irreversibly encrypts the data. The original biometric is then deleted from the local device immediately after FHE transformation.

This eliminates any requirement to store, transmit or use a plaintext biometric or template. The FHE algorithm preserves privacy so effectively that, in this case, a business’ GDPR, CCPA and BIPA obligations fall away when using FHE.

To provide its authentication services, Private Identity then mathematically operates on the FHE payload using a second DNN (hosted in a cloud AI service) that performs encrypted match and search operations on the encrypted dataset. Interestingly, each biometric modality is supported by its own separate set of DNNs. So, for face, face+mask, fingerprint and voice recognition, one separate mobile embedding DNN runs on the user’s local device using Javascript and one DNN (in this case, each is a FCNN) runs on a cloud ai service.

The FHE payload itself is a globally unique (i.e. no two payloads are ever the same), positional array of 128 floating-point numbers that does not contain biological or behavioral characteristics, imagery or a template of any physiological, biological or behavioral trait.

Finally, in addition to processing FHE payloads instead of biometric data, the Private Identity MFA system does not process any other personal data. Instead of username or email, the algorithm simply generates a random 128-bit universally unique identifier (UUID, or surrogate key) to label each user. The UUID is also anonymized data in that it is random, contains no personal or biometric data, is not derived from biometric data, and is unable to aid in identifying the data subject.

As you are likely aware, FHE cryptosystems such as this were not practical or scalable until quite recently. FHE emerged in late 2018 when Microsoft launched SEAL, a set of relatively fast, open source, state-of-the-art homomorphic encryption libraries. Google then followed in 2019 with the release of its own open-source homomorphic cryptography tool, Private Join and Compute. A handful of additional companies are now also producing commercial FHE systems including IBM, Enveil, Duality Technologies and Private Identity.