Authentication methods and systems

An authentication method comprising:

• obtaining an enrollment encoding of features from a user, wherein the enrollment encoding includes a first set of occlusions at a first set of locations;
• setting a value at the first set of locations to a selected value to create a revised enrollment encoding;
• processing the revised enrollment encoding and an enrollment codeword to create a blinded enrollment encoding as recovery data;
• obtaining an authentication encoding of features from the user, wherein the authentication encoding includes the first set of locations and includes a second set of occlusions at a second set of locations, wherein at least a portion of the second set of locations does not overlap with the first set of locations;
• setting the value at the first set of locations and the value at the second set of locations of the authentication encoding to the selected value to create a revised authentication encoding;
• processing the revised authentication encoding and the recovery data to create an authentication codeword;
• and
• comparing the authentication codeword and the enrollment codeword to authenticate the user.

A non-transitory computer readable storage medium having program instructions embodied therewith, the program instructions readable by a processor to cause the processor to perform a method for authenticating a user comprising:

• obtaining an enrollment encoding of features from a user, wherein the enrollment encoding includes a first occlusion at a first location;
• setting a value at the first location to a selected value to create a revised enrollment encoding;
• processing the revised enrollment encoding and an enrollment codeword to create a blinded enrollment encoding as recovery data;
• receiving an authentication input associated with the user, wherein the authentication input comprises a first template portion, including an encoding of features, and a second template portion, including an identification of a second location in the first template portion that is not usable, wherein at least a portion of the second location does not overlap with the first location;
• revising the first template portion by setting a value at the first location and at the second location to a selected value to form a revised first template portion;
• creating an authentication codeword from the revised first template portion and from public recovery data;
• performing an error correction process to generate a corrected authentication codeword from the authentication codeword and from the second template portion;
• and
• decoding the corrected authentication codeword.