Keyless granted privacy patent for biometric authentication technology

Privacy-by-design biometric authentication for an increasingly privacy-concerned era

LONDON, Sept. 30, 2021 /PRNewswire/ -- Keyless Technologies, the next-generation biometric authentication company, today announced that they have been granted a non-provisional patent by the U.S. Patent and Trademark Office, for how they authenticate and preserve the privacy of a user's digital identity. The technology prevents organizations, third parties and even Keyless from accessing a person's biometric data as it is not stored on a device or any centralized location - a market first. That means the technology exceeds regulation, such as GDPR and CCPA. In the current era where security and privacy concerns are running high, this fundamental shift from the current approach for biometric authentication will have meaningful value for many industries and individuals concerned with privacy for digital identities.

"Our mission at Keyless is to provide people and organizations with a passwordless future, where the user is the key. We want to do it in a way that lets people login to any app or service, from any device, easily and safe in the knowledge that they have the privacy they deserve, and for organizations to maintain security and compliance for their systems and users. This patent demonstrates our commitment to that mission," says Andrea Carmignani, CEO and Co-Founder.

The Keyless privacy-by-design technology utilizes innovative cryptography and secure multi-party computing on the edge. When a user enrols with Keyless, their biometric template is encrypted, broken up into "shards" and stored across multiple servers. Even if a server is compromised, the attackers would never have access to the complete dataset. The user's template is also deleted from the device they used to enrol. When next they are asked to authenticate, the user looks into a forward-facing camera and their details are matched against the stored "shards;" at no time is the full template ever restored. The way Keyless technology processes and stores data means that it exceeds GDPR (no personally identifiable information is stored) and in conjunction with partners, adheres to PSD2 SCA requirements.

This is especially useful for highly regulated industries, such as financial services, or for industries that struggle with revenue leakage due to credential sharing, such as streaming media services. Keyless' technology ensures that it is the person and not a device, being authenticated in a private and secure manner. The simple enrolment and subsequent authentication process is also designed to be as intuitive for the user as possible, to enhance user experience.

"The intersection of user experience, privacy and security is a very hot space, right now," says Paolo Gasti, CTO. "There are multiple vendors and analysts out there talking about it, but no one has yet solved that conundrum. By investing in the research and developing our technology in a privacy-first way, we believe we've taken a big step in addressing it. And as we look ahead to up and coming technologies that will one day 'be the norm,' such as blockchain and services offering Self-Sovereign Identity, where privacy-by-design is a key tenet, Keyless technology will be able to support those too."