Towards Secure Biometric Solutions: A Multifactor Authentication Framework for Facial Recognition While Protecting User Data

Storing raw facial images or face embeddings in an authentication database creates a persistent privacy liability. A single breach can permanently expose a person’s biometric identity. This paper presents a multifactor authentication (MFA) framework for facial recognition systems that removes this liability by never storing biometric data, in any form, on the server. Unlike conventional biometric template protection (BTP) techniques, which typically trade a fixed transformation of the image or the feature vector (e.g., PolyProtect, cancelable biometrics, and the fuzzy commitment scheme) for a reduction in recognition accuracy, the proposed method couples a decomposition-based feature-obfuscation step with time-based one-time passwords, AES-256 encryption, and SHA-512 hashing to generate a single-use, revocable authentication proof. This proof is designed to be irreversible, unlinkable, and revocable while leaving recognition accuracy effectively unchanged. Across six public benchmarks, namely, Labeled Faces in the Wild dataset (LFW), Age Database 30 (AgeDB-30), Cross-Age LFW (CALFW), Cross-Pose LFW (CPLFW), Racial Faces in the Wild (RFW), and Cross-Quality LFW (XQLFW), the proposed method attains 99.91% accuracy on LFW (area under the curve [AUC] 0.997) and is within 0.08–5.38 percentage above the published ArcFace and MagFace baselines on the benchmarks. A dedicated ablation with and without the protection layer, repeated under cosine, Euclidean, and Manhattan similarity, shows no measurable accuracy degradation attributable to the protection step itself. The principal novelty of the approach is architectural rather than purely cryptographic. The framework embeds feature-level BTP directly inside a MFA protocol, so that biometric-free storage, revocability, and MFA are obtained jointly instead of as separate, loosely coupled add-ons. Performance is comparatively weaker on cross-quality (XQLFW, 83.7%) and cross-age (CALFW) dataset, a limitation we analyze in this work.

Document can be accessed here.