Enhancing Privacy in E-Payment Systems Using Homomorphic Encryption for Secure Authentication

Abstract

With the global rise of electronic payment (e-payment) systems, the demand for secure and privacy-preserving authentication mechanisms has become increasingly critical. Traditional methods often expose sensitive user data during verification, leading to privacy risks. This study addresses the limitations of conventional authentication techniques by proposing a homomorphic encryption (HE)-based solution that ensures data confidentiality throughout the authentication process. 

The core objective of this research is to develop and evaluate a prototype authentication system that integrates iris biometrics and encrypted contextual verification specifically involving transaction timestamp, merchant identity, and payment amount while ensuring all computations occur on encrypted data. The system leverages the TenSEAL library to 
implement the CKKS scheme for approximate homomorphic encryption, enabling vectorized operations on encrypted biometric features and metadata without decryption. Authentication decisions are based on cosine similarity of encrypted iris features and homomorphic comparison of encrypted contextual parameters against expected values.

Methodologically, the system is tested using the IITD Iris Database v1.0, with preprocessing via PCA and normalization to reduce dimensionality and improve efficiency. Privacy was assessed using Reconstruction Attack Analysis, Ciphertext Expansion Analysis, Ciphertext Distribution Analysis, and Chosen Ciphertext Attack Simulation. Results demonstrate that the system is effectively preserved privacy, while maintaining acceptable matching accuracy and operational feasibility in a controlled environment. 

Despite these achievements, the system's performance under real-world conditions remains to be validated. Limitations include its reliance on a controlled iris dataset, a limited scope of contextual parameters, and the computational overhead of HE. This research contributes a unique integration of fully homomorphic encryption into biometric authentication for e-payment systems and demonstrates its potential to provide strong privacy guarantees without compromising security or usability.