Content uploaded by Matteo Ferrara
Author content
All content in this area was uploaded by Matteo Ferrara
Content may be subject to copyright.
IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY, VOL. 7, NO. 6, DECEMBER 2012 1727
Noninvertible Minutia Cylinder-Code Representation
Matteo Ferrara, Davide Maltoni, Member, IEEE, and Raffaele Cappelli, Member, IEEE
Abstract—Although several fingerprint template protection
methods have been proposed in the literature, the problem is
still unsolved, since enforcing nonreversibility tends to produce
an excessive drop in accuracy. Furthermore, unlike fingerprint
verification, whose performance is assessed today with public
benchmarks and protocols, performance of template protection
approaches is often evaluated in heterogeneous scenarios, thus
making it very difficult to compare existing techniques. In this
paper, we propose a novel protection technique for Minutia
Cylinder-Code (MCC), which is a well-known local minutiae
representation. A sophisticate algorithm is designed to reverse
MCC (i.e., recovering original minutiae positions and angles).
Systematic experimentations show that the new approach com-
pares favorably with state-of-the-art methods in terms of accuracy
and, at the same time, provides a good protection of minutiae
information and is robust against masquerade attacks.
Index Terms—Fingerprints, minutiae, noninvertible transform,
P-MCC, template protection.
I. INTRODUCTION
IN recent years, template protection techniques have gained
increasing interest in the biometric community, due to the
worldwide diffusion of new biometric applications and the con-
sequent growing of privacy issues. Fingerprints are one of the
most studied biometric traits and the most widely used in civil
and forensic recognition systems, hence the development of ef-
fective techniques to protect fingerprint templates is undoubt-
edly a crucial challenge for the research community.
In general, template protection methods are designed to guar-
antee: i) the infeasibility to reconstruct the original pattern from
the protected template (nonreversibility), ii) the possibility to
create different protected templates starting from the same un-
protected pattern (diversity), iii) the preservation of the recog-
nition accuracy when the matching is carried out on protected
templates (accuracy), and iv) the possibility to revoke a com-
promised template and reissue a new one based on the same
biometric data (revocability)[1].
In [1] template protection techniques are grouped into
two main categories: feature transformation and biometric
cryptosystem. Feature transformation methods convert an
unprotected pattern into a protected template through a trans-
formation function. During the verification phase, the same
Manuscript received May 04, 2012; revised July 06, 2012; accepted July
31, 2012. Date of publication September 19, 2012; date of current version
November 15, 2012. This work was supported by the European Community’s
Framework Programme (FP7/2007-2013) under Grant agreement 284862. The
associate editor coordinating the review of this manuscript and approving it for
publication was Dr. Anjay Kumar.
The authors are with the Department of Electronics, Computer Sciences and
Systems of the University of Bologna, 47521 Cesena (FC), Italy (e-mail: matteo.
ferrara@unibo.it; davide.maltoni@unibo.it; raffaele.cappelli@unibo.it).
Digital Object Identifier 10.1109/TIFS.2012.2215326
transformation is applied to the query pattern and the matching
takes place in the transformed space. Depending on the charac-
teristics of the transformation function, these approaches can be
further divided in: noninvertible transforms and salting.Non-
invertible transforms (e.g., [2]–[10]) exploit one-way functions
which are computationally hard to invert. Salting transforms
or biohashing (e.g., [11]) combine a transform function with
a secret key, to protect the original pattern. Hence, salting
methods are two-factor authentication approaches, whose secu-
rity partially depends on a secret key. Biometric cryptosystems
use a biometric trait to generate or protect a cryptographic key.
Some public information about the unprotected pattern, called
helper data, is stored. The helper data is not expected to reveal
any important information about the unprotected template,
hence it is not required to be secret. During the matching phase,
a cryptographic key is extracted from the query pattern using
the helper data; then the matching is indirectly performed by
verifying the validity of the extracted key. Biometric cryptosys-
tems can be further divided in key-generation and key-binding,
depending on how the helper data is generated. In the former
approaches (e.g., [12], [13]), the helper data is obtained from
the unprotected pattern and the cryptographic key is created
using the helper data and the query pattern; in the latter ap-
proaches (e.g., [14]–[18]), the helper data is derived by binding
an independent external key to the unprotected pattern: during
the matching the key is recovered from the helper data using
the query pattern.
Although several fingerprint template protection methods
have been proposed in the literature, the problem is still un-
solved, since enforcing nonreversibility tends to produce an
excessive drop in accuracy.Thisisprimaryduetothelargein-
traclass variability of fingerprint patterns: different acquisitions
of the same finger can be very dissimilar and consequently the
protected templates may be very different. It is commonly rec-
ognized that, in practice, it is very difficult to design template
protection methods that are both secure from a cryptographic
point of view and very accurate from a biometric point of
view. Unfortunately, unlike fingerprint verification, whose
performance is nowadays assessed with public benchmarks
and protocols [19], testing template protection approaches is
often performed in heterogeneous scenarios, thus making it
very difficult to compare existing techniques and to understand
their actual limits.
This paper introduces a novel minutiae template noninvert-
ible transform based on Minutia Cylinder-Code (MCC) [20], di-
mensionality reduction and binarization. MCC relies on a robust
fixed-length minutia descriptor and was independently demon-
strated to be one of the most effective local minutia descriptors
for fingerprint recognition [21]. The template protection scheme
proposed in this work has been specifically designed to benefit
from the MCC representation. Extensive experiments prove that
1556-6013/$31.00 © 2012 IEEE
1728 IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY, VOL. 7, NO. 6, DECEMBER 2012
the proposed method combines good biometric accuracy to non-
reversibility and compares favorably with the state-of-the-art.
The rest of this paper is organized as follows. Section II
briefly summarizes the state-of-the-art of noninvertible trans-
forms for fingerprint templates. Section III introduces the
MCC representation; Section IV proposes an attack strategy to
revert an MCC template into the original minutiae template,
and proves that unprotected MCC templates offer a very weak
protection of minutiae information. Section V describes the
new minutiae template protection method. Section VI reports
experiments on public databases to evaluate security and ac-
curacy of the new approach and to compare it against existing
template protection methods. Finally, Section VII draws some
concluding remarks.
II. NONINVERTIBLE TRANSFORMS
Conceptually, a template can be protected by transforming the
unprotected pattern into another representation space through a
noninvertible transform; then, during authentication, the same
transform is applied to the query template and the comparison
is performed in the transformed space. Thus, the security of
the protected template largely depends on the robustness of the
transformation used.
The idea of noninvertible transforms for fingerprint tem-
plate protection was first introduced by Ratha et al. in [2]
and extended in [3]. These approaches first locate singular
points and minutiae in fingerprint images; then, minutiae are
transformed with respect to the core point using three different
transforms: i) Cartesian, ii) polar, and iii) functional surface
folding. The resulting minutiae points are still embedded in
a two-dimensional space and conventional minutiae-based
fingerprint matching algorithms can be used to compare two
protected templates. Unfortunately, the proposed transforms
have a fairly low nonreversibility degree; in fact, the same
authors found that only few minutiae (about 8%) have their
neighbors perturbed by these transformations [22]. In con-
clusion, although the approach achieves an high matching
accuracy, the level of nonreversibility provided is quite limited.
More recent methods based on noninvertible transforms show
some improvements, but, in general, the trade-off between ac-
curacy and nonreversibility is still far from being satisfactory
[23]. In [5], [8] the authors propose an alignment-free method
that uses a family of symmetric hash functions to transform
the minutiae and performs the matching step in the hash space.
Ahn et al. [7] hide minutiae information by deriving geomet-
rical properties from triplets of minutia points. Although the
idea is promising, the accuracy is quite low. Nagar et al. [9]
describe a scheme to extract binary features from fingerprints
using minutia points and fingerprint ridges. During the matching
phase, the binary features are compared using the normalized
Hamming distance. In [24], Yang et al. propose a nonlinear dy-
namic random projection method to increase the computational
complexity of reversing the genuine biometric feature, with re-
spect to the traditional random projection.
In [4], [6], [10] and [25], to improve the degree of nonre-
versibility, the authors propose to exploit a user’s secret key as
a parameter of the noninvertible function. These methods are
two-factor authentication approaches and the nonreversibility
is mostly provided by the secrecy of the key rather than by
the transformation itself. In [4], Lee et al. calculate, for each
minutia, a rotation- and translation-invariant value from the
orientation information in its neighborhood. The protected tem-
plate is built by transforming minutiae according to changing
functions (user’s PIN dependent) that produce two values
invariant to translation and rotation of the original minutiae.
Chikkerur et al. [6] extract a texture-based feature vector from
the gray-scale neighborhood of each minutia. Each feature
vector is transformed using a noninvertible function that uses a
random key as a parameter. Yang et al. [25] create a fixed-length
binary hash string from the minutiae vicinity representation
introduced in [26]. A user-specific random parameter is used
to encrypt and randomly offset each vicinity. In [10], Zhe and
Jin use minutia vicinity decomposition (a variant of the minutia
vicinity representation [26]) to extract a set of geometrical in-
variant features from minutiae triplets. To achieve revocability,
a user-specific random matrix is added to the feature matrix.
III. MINUTIA CYLINDER-CODE
Let be a minutiae template: each minutia is a triplet
where is the minutia location and
is the minutia direction (in the range ). The Minutia
Cylinder-Code representation (MCC) [20] associates a local de-
scriptor to each minutia : this descriptor encodes spatial and
directional relationships between the minutia and its neighbor-
hood of radius , and can be conveniently represented as a
cylinder, whose base and height are related to the spatial and
directional information, respectively. The cylinder is divided
into sections: each section corresponds to a directional differ-
ence in the range ; sections are discretized into cells.
During the creation of a cylinder, a numerical value is calcu-
lated for each cell, by accumulating contributions from minu-
tiae in a neighborhood of the projection of the cell center onto
the cylinder base. The contribution of each minutia to a cell
(of the cylinder corresponding to a given minutia ), depends
both on:
• spatial information (how much is close to the center of
the cell), and
• directional information (how much the directional differ-
ence between and is similar to the directional differ-
ence associated to the section where the cell lies).
In other words, the value of a cell represents the likelihood of
finding minutiae that are close to the cell and whose directional
difference with respect to is similar to a given value. Fig. 1
shows the cylinder associated to a minutia with seven minutiae
in its neighborhood.
Given a template , MCC creates a cylinder-set ,which
contains the cylinders associated to all minutiae in with a
sufficient number of neighbors (see [20]). Each cylinder is a
local descriptor:
• invariant for translation and rotation, since i) it only
encodes distances and directional differences between
minutiae, and ii) its base is rotated according to the corre-
sponding minutia direction;
• robust against skin distortion (which is small at a local
level) and against small feature extraction errors, thanks
FERRARA et al.: NONINVERTIBLE MINUTIA CYLINDER-CODE REPRESENTATION 1729
Fig. 1. Graphical representation of a cylinder: (a) minutiae involved and
(b) cell values: lighter areas represent higher values. Note that cylinder sections
in (b) are rotated according to the direction of minutia .
to the smoothed nature of the functions defining the con-
tribution of each minutia;
• with a fixed-length given by the total number of cells in the
cylinder.
Another advantage of the MCC representation is that each
cylinder can be treated as a feature vector obtained
by linearizing the cells of the cylinder corresponding to a
given minutia 1. Hence, from a template , a set of feature
vectors can be derived:
(1)
where is the feature vector obtained from the cylinder of
minutia and is the cylinder-set of template .Inthefol-
lowing, depending on the context, we will refer to or
interchangeably; because of the 1:1 relationship between them,
this flexibility does not lead to ambiguities.
IV. MINUTIAE TEMPLATE RECONSTRUCTION STRATEGY
In this section we propose an attack strategy aimed at recon-
structing a minutiae template starting from a cylinder-set; this
is useful to evaluate the degree of nonreversibility of the MCC
representation.
Nagar and Jain introduced, in [27], a measure of nonre-
versibility (called Coverage-Effort curve) which quantifies
the number of guesses an adversary should make to recover
a certain fraction of the original minutiae template. This ap-
proach is well suited for noninvertible transforms that map each
minutia independently of the others, while it is not adequate for
approaches mapping minutiae neighborhoods (such as MCC).
In fact, it would be computationally unfeasible to compute the
number of all minutiae neighborhoods that produce the same
(or very similar) cylinder. The proposed reconstruction strategy
1In the MCC representation proposed in [20], each cell value belongs to
. For simplicity, in the proposed protection approach all
invalid values are substituted with zero. Furthermore, while in the original
MCC templates spatial and directional information of each minutia is usually
included to allow global consolidation [20], the proposed protection approach
does not store such information in the templates (see also Section V-D).
Fig. 2. Minutiae neighborhood reconstruction of a cylinder. and are the
cylinder radius and the Euclidean distance between two points, respectively.
follows two steps: first the minutiae neighborhood corre-
sponding to each cylinder is estimated; then the neighborhoods
are merged to form a single and consistent set of minutiae.
A. Reconstructing Neighborhood From Cylinder
The basic idea is to reverse the cylinder building pro-
cedure introduced in [20] by estimating position and di-
rection of each minutia from the values of the cells in the
cylinder. The algorithm in Fig. 2 allows to reconstruct a
set of minutiae starting from: i) a
cylinder and ii) a likelihood matrix computed by the
algorithm reported in Fig. 3. Notation and symbols are the
same introduced in [20]. In the algorithm reported in Fig. 3, for
each point inside the cylinder base, the likelihood of
finding a minutia with direction is calculated as the average
of the contributions of each cylinder cell whose spatial distance
from is less than . The contribution of the cell
is the product of: i) the spatial contribution that the center
of the cell (projected onto the cylinder’s base) gives to point
, ii) the directional contribution that the angle associated
to the cell (i.e., ) gives to direction , and iii) the cell
value . The algorithm in Fig. 2 creates minutiae
at local maxima of . To this purpose, it iteratively: i) finds
the maximum value of matrix ; ii) adds a new
minutia to set ;iii)sets and its
spatial and angular neighboring elements in to zero (to avoid
1730 IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY, VOL. 7, NO. 6, DECEMBER 2012
Fig. 3. Algorithm for calculating the likelihood matrix . , ,and
represent the cylinder radius, the center of the base cell with indices ,,and
the Euclidean distance between two points, respectively.
Fig. 4. Minutiae neighborhood reconstructed from the cylinder reported
in Fig. 1(b). Rounded and squared minutiae belong to the original and the
reconstructed neighborhood, respectively. The reconstruction is rather good:
minutiae locations are quite accurate and only two minutiae have been missed
(see top-left part).
selecting other elements of the same minutia neighborhood).
The algorithm ends when the current maximum is lower than a
threshold .
The parameters ( and )have
been tuned to maximize the average reconstruction accuracy on
atrainingset(asexplainedinSectionVI-D).
Fig. 4 shows the neighborhood reconstructed starting from
the cylinder reported in Fig. 1(b).
B. Neighborhood Merging
The algorithm in Fig. 5 combines the sets of minutiae recon-
structed from the cylinders into a single minutiae template. The
inputs are minutiae neighborhoods obtained, using algo-
rithm NRC (see Fig. 2), from the corresponding cylinders
Fig. 5. Minutiae template reconstruction of a set of minutiae neighborhoods.
in . Since all MCC cylinders are aligned with respect to their
central minutia, at the center of each neighborhood
there is always a minutia with direction [20]. The ratio-
nale behind this algorithm is that if two neighborhoods in the
original template are close enough, the central minutia of one
of them corresponds to a noncentral minutia in the other.
The algorithm works on a set of pairs ,
where is a set of noncentral minutiae and is the corre-
sponding set of central minutiae. Each is initialized with
the central minutia of a reconstructed neighborhood ,
then the algorithm starts an iterative merging procedure. At
each iteration it determines the best candidates and to
merge; merging and involves replacing corresponding
minutiae with their spatial- and directional-average, and leaving
unaltered noncorresponding ones. The merging procedure ter-
minates when all neighborhoods have been merged into a single
set, or when no more candidates are available for merging.
Finally, the reconstructed template is obtained as the union
of noncentral and central minutiae; if more sets are
still present (i.e., ) the neighborhood containing the
largest number of minutiae is chosen.
The algorithm in Fig. 5 is now described with more details:
at each iteration, for each pair of neighborhoods and ,all
possible alignments between noncentral minutia in and
central minutia in are considered, to find the best minu-
tiae pairing according to score function MNS.MNS is defined as
(2)
where returns the set of minutiae obtained
by translating and rotating so that position and direction of
match those of .computes a sim-
ilarity score between minutiae in and (excluding
and , which have been used for the alignment).
The two candidates and are then merged into a single
neighborhood:
(3)
FERRARA et al.: NONINVERTIBLE MINUTIA CYLINDER-CODE REPRESENTATION 1731
The set of minutiae created by contains: i) for
each minutia paired to a minutia ,asingle
minutia obtained as the spatial and directional average of
and ; ii) any unpaired minutia in and . Note that,
in principle, unpaired minutiae belonging to the intersection
of the two neighborhoods may be considered as false minu-
tiae and discarded at this stage; on the other hand, they may
find a good pairing at a following merging iteration. For this
reason unpaired minutiae are not removed during merging: for
each minutia, the algorithm counts the number of times it was
paired (pairing count) and the number of times it was inside
the intersection of two sets being merged (intersection count).
At the end of the merging iterations, a postprocessing proce-
dure, , discards any minutia whose ratio be-
tween its pairing count and its intersection count is lower than a
threshold . Other postprocessing techniques were tested
(e.g., selecting the same number of minutiae that were present
in the original unprotected template), but they lead to slightly
worse results.
Note that a template reconstructed by the algorithm in Fig. 5
may be oriented at any angle, since no information on the di-
rection of the central minutia of any cylinder is available in the
cylinder-set . For this reason, each reconstructed template
has been rotated according to a model fitting technique taking
into account the direction of maximum variance of minutiae
positions and the conformance of minutia angles to a generic
arch-like shape in the upper part. Since recovering the exact
template rotation is not critical for this study, we do not provide
further details on this step. Parameter has been tuned to
maximize the average reconstruction accuracy on a training set
(as explained in Section VI-D). Fig. 7(b) shows the efficacy of
the proposed approach in reconstructing the minutiae template
reportedinFig.7(a).
V. PROTECTED MINUTIA CYLINDER-CODE (P-MCC)
To prevent attack strategies aimed at reversing cylinders into
their original minutiae neighborhoods (see Section IV) we pro-
pose a noninvertible function based on dimensionality reduc-
tion and binarization. The resulting protection scheme is called
P-MCC.
A. Binary-KL Transform
The noninvertible transform consists in a KL projection [28]
followed by a binarization step: in the following it is referred
to as Binary-KL ( -KL). This particular transform was chosen
since, in our preliminary experiments, it showed a good preser-
vation of cylinder distances in the transformed space even when
most of the original information is lost.
Let beasetof -dimen-
sional vectors, let and be their mean vector
and covariance matrix, and let and be the
eigenvalues and the eigenvectors of , respectively. Then, for
agiven ,let ,bethema-
trix whose columns are the eigenvectors corresponding to the
largest eigenvalues:
(4)
with .
The -KL projection of a vector is:
(5)
where
(6)
binarizes each element of vector by
means of the unit step function :
(7)
B. Cylinder Noninvertible Transform
Given the feature vector obtained from a cylinder ,
and the -KL parameters and , the noninvertible transform
encodes into a -dimensional binary
space. is simply defined as follows:
(8)
and can be computed offline starting from a generic
dataset of fingerprint images (see Section VI-C).
Then, given the set of feature vectors derived from a minu-
tiae template (see (1)), the protected template is a set of
bit-vectors defined as:
(9)
C. The Similarity Between Two Protected Cylinders
Let and be the protected bit-vectors derived from two
cylinders and ; their similarity can be computed as:
(10)
where XOR denotes the bitwise-exclusive-or between two bit-
vectors, represents the 1-norm, and the length of the bit-
vectors. Note that the 1-norm of a bit-vector can be simply com-
puted as the population count (number of bits with value one).
The similarity is always in the range , where zero
means no similarity and one maximum similarity.
D. The Similarity Between Two Protected Templates
In order to compare two protected templates, a single value
denoting their overall similarity has to be obtained from the
local similarities between protected bit-vectors. It is worth
noting that a protected template contains only bit-vectors: the
spatial location and direction of the minutiae are not stored in
the template. For this reason global consolidation techniques
based on the relative placement of minutiae and directional
differences [20] cannot be adopted in this case.
According to some preliminary experiments, a simple but ef-
fective approach is the Local Greedy Similarity (LGS), origi-
nally proposed in [29] for nonprotected templates.
Given two protected templates and , the basic idea of
LGS is to calculate the global score as the average of the
bit-vector pairs with the largest similarity, but discarding pairs
that contains at least a bit-vector already selected. The value
1732 IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY, VOL. 7, NO. 6, DECEMBER 2012
Fig. 6. Information recovered from the cylinder in Fig. 1(b) (reported in the
top row), protected with (middle row) and (bottom row).
of is not an overall constant, but partially depends on the
number of bit-vectors in the two templates:
(11)
where and are parameters, and
denotes the rounding operator. The same parameters specified
in [29] have been used in this work, except for and
whose values have been tuned on a training dataset (see
Section VI-A) and set to 10 and 20, respectively.
E. From Protected to Unprotected Cylinders
InordertoapplytheattackstrategydescribedinSectionIV
to a protected template, one must first attempt to recover the
unprotected cylinders. Let be a protected template:
assuming that the parameters of the KL transform used to en-
code are available (i.e., the mean vector , the eigenvectors
,andthe largest eigenvalues ), an attacker may apply the
following procedure to reconstruct, from each protected vector
, an approximation of the corresponding unprotected
vector .
1. The KL projection of is esti-
mated as :
(12)
2. is estimated as the KL back-projection of :
(13)
The rationale of the above procedure is that, under the as-
sumption that each component of follows a normal distri-
bution with zero mean and variance (i.e., ,
(12) estimates as . In fact, since the only
available information about (besides and )isitssign
(stored in bit , see (7)), can be estimated as the
expected value of a half-normal distribution
[30], with the sign given by .Fig.6showsa
graphical example of the result obtained with the above ap-
proach. It is evident that the reconstruction leads to a relevant
obfuscation of the original cell values, thus making the determi-
nation of minutiae positions quite hard (especially for ).
Fig. 7. Minutiae templates reconstructed using the attack strategy described in
Section IV: (a) the original template and (b) the reconstructed templates starting
from MCC and P-MCC templates with equal to (c) 128, (d) 64, (e) 32, and
(f)16.Black-andwhite-filled minutiae denote recovered and false minutiae,
respectively; missed minutiae are represented by cross symbols.
In Section VI-D the feasibility of cylinder reconstruction will
be numerically quantified.
VI. EXPERIMENTATION
This section describes the experiments carried out to evaluate
the nonreversibility and the accuracy of the new template pro-
tection technique; performance comparisons with other state-of-
the-art approaches are also reported.
A. Data Sets
Most of the published methods for fingerprint template pro-
tection have been evaluated on the four data sets of FVC2002
FERRARA et al.: NONINVERTIBLE MINUTIA CYLINDER-CODE REPRESENTATION 1733
TAB L E I
FOUR DATA SETS CONSIDERED AND TEMPLATE PROTECTION METHODS FOR
WHICH PUBLISHED RESULTS ARE AVAI L A B L E
[31]; each data set contains 800 fingerprints from 100 fingers
(8 impressions per finger). Table I reports template protection
approaches for which published results on FVC2002 data sets
are available.
Other data sets used in the following experiments are:
• FVC2006 DB2 [36]: 1 680 fingerprints from 140 fingers.
• FVC2006 DB2b [36]: 120 fingerprints from 10 fingers; this
separate dataset has been used to calibrate all the recon-
struction and matching parameters.
B. Minutiae Extraction and Creation of the Cylinders
A state-of-the-art minutiae extraction algorithm (developed
by one of the best-performing FVC2006 participants) has been
used to create ISO/IEC 19794-2 [37] minutiae templates from
all fingerprints of all data sets.
MCC descriptors have been derived from the minutiae tem-
plates as described in [20] and summarized in Section III: the
same parameters reported in [29] have been used to create all
the cylinders; in particular, each cylinder contains
cells (i.e., in Section V).
C. KL Space Computation
To evaluate the trade-off between biometric accuracy and
nonreversibility varying parameter (see Section V), four KL
subspaces, with , have been created. A set
of 5 799 minutia cylinders have been obtained from FVC2006
DB2b and used as a training set to compute and for each .
D. Nonreversibility Evaluation
Two experiments have been carried out on FVC2006 DB2 to
understand if the information recovered from the cylinders:
1. reveals minutiae information and then can compromise the
identity and the privacy of a user;
2. is useful to perform masquerade attacks against state-of-
the-art automatic fingerprint recognition systems (e.g., in-
jecting a reconstructed minutiae template in a communica-
tion channel).
TAB L E I I
MINUTIAE TEMPLATE RECONSTRUCTION PARAMETER VALUES
It is worth noting that the two experiments are consistent with
recent proposals of common criteria to evaluate the security of
biometric protection algorithms [38], [39].
The minutiae template reconstruction algorithm (see
Section IV) is controlled by six parameters:
,and . A systematic tuning has been
performed to choose optimal parameter values in order to
maximize the average reconstruction accuracy on FVC2006
DB2b. The values of ,and have been
optimized using unprotected cylinders and do not depend on ,
while parameters and have been tuned separately
for each value of . Table II summarizes the parameter values.
In the first experiment, minutiae templates have been recon-
structed from MCC and P-MCC templates and compared to the
original ones. The following reconstruction accuracy indicators
have been computed:
•RM: average percentage of correctly recovered minutiae
with respect to the number of minutiae in the original
template;
•MM: average percentage of missed minutiae with respect
to the number of minutiae in the original template;
•FM: the average percentage of false minutiae with respect
to the number of minutiae in the original template.
To compute the above indicators, each reconstructed template
has been aligned to the original one in order to maximize the
number of paired minutiae. Two minutiae have been considered
paired if and only if their spatial distance is less or equal to
12 pixels and their directional difference less or equal to ;
this is in line with typical thresholds used in minutiae matching
algorithms [22].
Table III reports the reconstruction accuracy indicators on
FVC2006 DB2 using the parameters reported in Table II. As
expected, the reconstruction strategy works well with MCC
templates, recovering most of the original minutiae (81.9%),
losing only 18.1% of the minutiae, and adding a small amount
of false minutiae (17.2%). However, by applying the recon-
struction strategy to P-MCC templates, the percentage of
missed and false minutiae rapidly increases as decreases. For
example, using P-MCC , 74.6% of the original minutiae are
missed (i.e., only 25.4% of them are correctly recovered) and
69.6% of false minutiae are added.
A further test has been performed to evaluate the accuracy of
the cylinder reconstruction algorithm (NRC) alone (see Fig. 2).
To this purpose, an additional information has been added to
the templates: the correspondence between each cylinder and
its central minutia in the original template. In this way it is pos-
sible to evaluate the reconstruction accuracy indicators on each
reconstructed neighborhood. Table IV reports the results: as ex-
pected, the reconstruction accuracy of individual cylinders is
higher than that reported in Table III for the whole template.
1734 IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY, VOL. 7, NO. 6, DECEMBER 2012
Fig. 8. Score distributions for the MCC-based system. Left and right graphs show attacks using reconstructed MCC and P-MCC templates, respectively.
TAB L E I II
RECONSTRUCTION ACCURACY ON
FVC2006 DB2 TEMPLATES
TAB L E I V
RECONSTRUCTION ACCURACY ON INDIVIDUAL
CYLINDERS IN FVC2006 DB2
TAB L E V
PERFORMANCE OF THE THREE REFERENCE SYSTEMS ON FVC2006 DB2
However it shall be noted that, even in this simplified (and unre-
alistic) case, the degree of protection is remarkable: for instance,
with , given 10 true minutiae, on the average only 4 are
correctly recovered (6 are not recovered) and 6 false minutiae
are added.
Fig. 7 shows an example of minutiae template reconstructed
from MCC (b) and P-MCC (c)–(f) templates. It is evident that
reconstruction from MCC is very good, while reconstruction
from P-MCC is generally very bad (except for where
the lower part of the fingerprint template is fairly reconstructed).
In the second experiment, as proposed in [40], two scenarios
have been considered: a reconstructed template is used to at-
tack i) the system that stores the original template (type-I at-
tack), or ii) other systems where another impression of the same
finger is enrolled (type-II attack). Both attack scenarios have
been evaluated on three reference fingerprint recognition sys-
tems: MCC (the MCC-based algorithm described in [29]), NIST
(the algorithm available in the NIST Biometric Image Software
(NBIS) v4.0 [41]), and VF (VeriFinger 6.5 by Neurotechnology
[42]). Each attack scenario has been evaluated under two se-
curity levels: i) medium-security, where the biometric verifica-
tion threshold of each system has been set to 0.1% FMR [22];
ii) high-security, where the threshold of each system has been
TAB L E V I
PERCENTAGE OF SUCCESSFUL ATTACKS AGAINST THE THREE REFERENCE
SYSTEMS AT MEDIUM-SECURITY LEVEL ON FVC2006 DB2
TAB L E V II
PERCENTAGE OF SUCCESSFUL ATTACKS AGAINST THE THREE REFERENCE
SYSTEMS AT HIGH-SECURITY LEVEL ON FVC2006 DB2
set to 0% FMR. Table V reports the biometric verification per-
formance of the three reference systems at the EER and at the
operating points corresponding to the two security levels.
The attack simulations were performed on FVC2006 DB2
for both MCC and P-MCC templates. Each reconstructed tem-
plate was matched against all the twelve original templates of
the same finger, thus producing 1 680 and 18 480 type-I and
type-II attempts, respectively.
Tables VI and VII report the percentage of successful attacks
under medium- and high-security levels, respectively. Fig. 8
shows score distributions for the MCC-based reference system
when MCC and P-MCC templates are reconstructed: it is ev-
ident how, in the case of protected templates, match scores of
type I and II attacks are close to impostor scores, while with un-
protected templates, they are often close to genuine scores. The
results show that MCC templates are vulnerable, while P-MCC
is effective against such attacks. In particular P-MCC
are robust against type I and type II attacks at both security
levels, while P-MCC provides good protection only at high-
security level.
E. Evaluation of Verification Accuracy
The evaluation of biometric verification accuracy has been
carried out on all FVC2002 datasets and on FVC2006 DB2. Two
different protocols are used in the literature to report results of
template protection methods on FVC2002:
•TheoriginalFVC protocol—Each template is compared
against the remaining ones of the same finger to obtain
FERRARA et al.: NONINVERTIBLE MINUTIA CYLINDER-CODE REPRESENTATION 1735
TAB L E V III
VERIFICATION ACCURACY USING THE FVC PROTOCOL (PERCENTAGE VALUES)
TAB L E I X
VERIFICATION ACCURACY USING THE 1VS1PROTOCOL (PERCENTAGE VALUES)
the False Non Match Rate (FNMR). The first template of
each finger is compared against the first template of the
remaining fingers in the data set, to determine the False
Match Rate (FMR). If template is compared against ,
the symmetric comparison ( against ) is not executed,
to avoid correlation in the scores.
•The1vs1 protocol—The first template of each finger is
compared against the second one of the same finger to ob-
tain the FNMR. The first template of each finger is com-
pared against the first template of the remaining fingers in
the data set, to determine the FMR.
Results using both the above protocols are reported, to allow
a fair comparison with the state-of-the-art. In case of failure to
process or match templates, the corresponding matching scores
are set to zero. The following performance indicators are con-
sidered [22], [43]: Equal-Error-Rate (EER), lowest FNMR for
%,andlowestFNMRfor %
.
Tables VIII and IX compare the verification accuracy of
P-MCC (for each value of ) to existing approaches (see
Table I) using FVC and 1vs1 protocol, respectively; only algo-
rithms for which published results are available are reported.
The two tables also report the results of the unprotected MCC
algorithm [29]. Note that two-factor authentication approaches
are not reported to avoid an unfair performance comparison
with single-factor techniques; the only two-factor approach
here considered is [25] because the authors also provide results
of the stolen-token scenario, thus allowing a direct comparison.
It is worth noting that:
•P-MCC is always the most accurate algorithm;
•P-MCC is better than all existing approaches, except for
one case (EER on FVC2002 DB1 in Table VIII);
•P-MCC is often better than existing approaches.
A comparison of the accuracy of P-MCC with the unprotected
MCC in Table VIII shows that, on the average, the EER is about
1.7 times worse for P-MCC , 2.9 times worse for P-MCC ,
and 6.2 for P-MCC .
VII. CONCLUSION
In this paper, a novel minutiae template protection scheme
(P-MCC) has been proposed. Parameter , controlling the
amount of dimensionality reduction before binarization, allows
to set the desired trade-off between security and accuracy.
In order to evaluate the degree of nonreversibility of P-MCC
and of the original MCC representation, an attack strategy has
been introduced and systematic experiments have been carried
out. The results show that, while MCC representation can be
quite-easily reverse-engineered (most of the original minutiae
can be correctly recovered), P-MCC offers a good protection
against disclosure of minutia information.
A second round of experiments has been carried out to
compare the biometric verification accuracy of P-MCC with
state-of-the-art algorithms, over five datasets with two different
evaluation protocols.
Among the configurations evaluated, P-MCC is a good
trade-off between accuracy and security: it overcomes all
existing approaches except in a single case, and the amount
of information disclosed is quite limited (the chance that a
randomly selected minutia in a reversed template is real is
about 25%). Furthermore, with respect to the unprotected MCC
algorithm, P-MCC EER is just 2.9 times worse, which is a
remarkable result compared to the state-of-the-art.
It is worth noting that the proposed attack strategy is not
necessarily the most effective one. During its development we
also evaluated alternatives aimed at excluding unfeasible re-
constructed patterns; however, the particular dimensionality re-
1736 IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY, VOL. 7, NO. 6, DECEMBER 2012
duction used tend to produce compressed vectors that, once
back-projected into the original space, have a smooth nature
(both in terms of spatial and direction contributions) and very
often resemble realistic portions of a minutia template. For this
reason we believe it is unlikely that the reconstructed pattern
can be significantly improved by discarding unrealistic contri-
butions. On the other hand, instead of using an attack strategy
optimized on a whole dataset as here proposed, adapting the
strategy to a specific template (e.g., with hill-climbing methods)
could increase the success chances of a single attack.
WhilewebelievethatP-MCCadvances the state-of-the-art
of fingerprint template protection techniques, we recognize that
this approach is still far from being perfect and that relevant re-
search efforts are still necessary in this field. In particular, our
future work will be devoted to: i) carrying out a more in-depth
theoretical study of P-MCC by evaluating the feasibility of var-
ious kinds of brute force attacks; ii) adding a user-specific secret
key to P-MCC to achieve diversity and revocability; iii) evalu-
ating other transformations to be applied to MCC descriptors;
iv) extending the proposed protection method to other biometric
traits.
REFERENCES
[1] A.K.Jain,K.Nandakumar,andA.Nagar, “Biometric template secu-
rity,” EURASIP J. Adv. Signal Process., vol. 8, no. 2, pp. 1–17, Jan.
2008.
[2] N.K.Ratha,J.H.Connell,andR.M.Bolle,“Enhancingsecurityand
privacy in biometrics-based authentication systems,” IBM Syst. J., vol.
40, no. 3, pp. 614–634, 2001.
[3] N.Ratha,S.Chikkerur,J.Connell,andR.M.Bolle,“Generatingcan-
celable fingerprint templates,” IEEE Trans. Pattern Anal. Mach. Intell.,
vol. 29, no. 4, pp. 561–572, Apr. 2007.
[4] C.Lee,J.Y.Choi,K.A.Toh,andS.Lee,“Alignment-freecance-
lable fingerprint templates based on local minutiae information,” IEEE
Trans. Syst., Man, Cybern. B, Cybern., vol. 37, no. 4, pp. 980–992,
Aug. 2007.
[5] S. Tulyakov, F. Farooq, P. Mansukhani, and V. Govindaraju, “Sym-
metric hash functions for secure fingerprint biometric systems,” Pat-
tern Recognit. Lett., vol. 28, no. 16, pp. 2427–2436, Dec. 2007.
[6] S. Chikkerur, N. Ratha, J. Connell, and R. M. Bolle, “Generating reg-
istration-free cancelable fingerprint templates,” in Proc.Int.Conf.Bio-
metrics: Theory, Applications and Systems (BTAS 08), 2008, pp. 1–6.
[7] D. Ahn, S. G. Kong, Y. S. Chung, and K. Y. Moon, “Matching with
secure fingerprint templates using non-invertible transform,” in Proc.
Image and Signal Processing (CISP’08), 2008, pp. 29–33.
[8] G. Kumar, S. Tulyakov, and V. Govindaraju, “Combination of sym-
metric hash functions for secure fingerprint matching,” in Proc. 20th
Int. Conf. Pattern Recognition (ICPR), Istanbul, 2010, pp. 890–893.
[9] A. Nagar, S. Rane, and A. Vetro, “Alignment and bit extraction for
secure fingerprint biometrics,” in Proc. Media Forensics and Security,
San Jose, CA, 2010.
[10] J. Zhe and A. T. B. Jin, “Fingerprint template protection with minutia
vicinity decomposition,” in Proc. Int. Conf. Biometrics (IJCB 2011),
Washington, DC, 2011.
[11] A. T. B. Jin, D. N. C. Ling, and A. Goh, “Biohashing: Two factor au-
thentication featuring fingerprint data and tokenised random number,”
Pattern Recognit., vol. 37, no. 11, pp. 2245–2255, 2004.
[12] Y. Dodis, L. Reyzin, and A. Smith, “Fuzzy extractors: How to generate
strong keys from biometrics and other noisy data,” in Proc. Int. Conf.
Cryptology (EUROCRYPT 04), 2004, pp. 523–540.
[13] Y. Dodis, R. Ostrovsky, L. Reyzin, and A. Smith, “Fuzzy extractors:
How to generate strong keys from biometrics and other noisy data,”
SIAM J. Comput., vol. 38, no. 1, pp. 97–139, 2008.
[14] A. Juels and M. Wattenberg, “A fuzzy commitment scheme,” in Proc.
ACM Conf. Computer and Communications Security, 1999, pp. 28–36.
[15] A. Juels and M. Sudan, “A fuzzy vault scheme,” in Proc. Int. Symp.
Information Theory, 2002, p. 408.
[16] K. Nandakumar, A. K. Jain, and S. Pankati, “Fingerprint-based fuzzy
vault: Implementation and performance,” IEEE Trans. Inf. Forensics
Security, vol. 2, no. 4, pp. 744–757, Dec. 2007.
[17] A. Nagar, K. Nandakumar, and A. K. Jain, “Securing fingerprint tem-
plate: Fuzzy vault with minutiae descriptors,” in Proc. 19th Int. Conf.
Pattern Recognition (ICPR 2008), 2008, pp. 1–4.
[18] P. Li et al., “An alignment-free fingerprint cryptosystem based on fuzzy
vault scheme,” J. Netw. Comput. Applicat., vol. 33, no. 3, pp. 207–220,
May 2010.
[19] BioLab., FVC-onGoing Web Site, Jan. 2012 [Online]. Available: http://
biolab.csr.unibo.it/fvcongoing
[20] R. Cappelli, M. Ferrara, and D. Maltoni, “Minutia Cylinder-Code: A
new representation and matching technique for fingerprint recogni-
tion,” IEEE Trans. Pattern Anal. Mach. Intell., vol. 32, no. 12, pp.
2128–2141, Dec. 2010.
[21] J. Feng and J. Zhou, “A performance evaluation of fingerprint minutia
descriptors,” in Proc. Int. Conf. Hand-Based Biometrics (ICHB),Hong
Kong, 2011.
[22] D. Maltoni, D. Maio, A. K. Jain, and S. Prabhakar, Handbook of Fin-
gerprint Recognition, 2nd ed. New York: Springer-Verlag, 2009.
[23] C. Rathgeb and A. Uhl, “A survey on biometric cryptosystems and
cancelable biometrics,” EURASIP J. Inf. Security, pp. 1–25, 2011.
[24] B. Yang, D. Hartung, K. Simoens, and C. Busch, “Dynamic random
projection for biometric template protection,” in Proc.FourthIEEE
Int. Conf. Biometrics: Theory Applications and Systems (BTAS), 2010,
pp. 1–7.
[25] B. Yang, C. Busch, P. Bours, and D. Gafurov, “Robust minutiae hash
for fingerprint template protection,” in Proc. Media Forensics and Se-
curity II, 2010, p. 75410.
[26] B. Yang and C. Busch, “Parameterized geometric alignment for minu-
tiae-based fingerprint template protection,” inProc. IEEE 3rd Int. Conf.
Biometrics: Theory, Applications and Systems (BTAS 09), 2009, pp.
340–345.
[27] A. Nagar and A. K. Jain, “On the security of non-invertible fingerprint
template transforms,” in Proc. 1st IEEE Int. Workshop on Information
Forensics and Security (WIFS), 2009, pp. 81–85.
[28] K. Fukunaga, Statistical Pattern Recognition. San Diego: Academic,
1990.
[29] R. Cappelli, M. Ferrara, D. Maltoni, and M. Tistarelli, “MCC: A base-
line algorithm for fingerprint verification in FVC-onGoing,” in Proc.
11th Int. Conf. Control, Automation, Robotics and Vision (ICARCV),
Singapore, 2010.
[30] E. W. Weisstein, Half-Normal Distribution Apr. 2012 [Online]. Avail-
able: http://mathworld.wolfram.com/Half-NormalDistribution.html
[31] D. Maio, D. Maltoni, R. Cappelli, J. L. Wayman, and A. K. Jain,
“FVC2002: Second fingerprint verification competition,” in Proc. Int.
Conf. Pattern Recognition, 2002, vol. 16, pp. 811–814.
[32] T. E. Boult, W. J. Scheirer, and R. Woodworth, “Revocable fingerprint
biotokens: Accuracy and security analysis,” in Proc. IEEE Conf. Com-
puter Vision and Pattern Recognition (CVPR), 2007, pp. 1–8.
[33] H. Yang, X. Jiang, and A. C. Kot, “Generating secure cancelable fin-
gerprint templates using local and global features,” in Proc. IEEE Int.
Conf. Computer Science and Information Technology (ICCSIT 2009),
2009, pp. 645–649.
[34] B. Yang, C. Busch, P. Bours, and D. Gafurov, “Non-invertible geo-
metrical transformation for fingerprint minutiae template protection,”
in Proc. 1st Int. Workshop on Security and Communication Networks
(IWSCN), 2009, pp. 1–7.
[35] T. Ahmad, J. Hu, and S. Wang, “Pair-polar coordinate-based cance-
lable fingerprint templates,” Pattern Recognit., vol. 44, no. 10–11, pp.
2555–2564, 2011.
[36] R. Cappelli, M. Ferrara, A. Franco, and D. Maltoni, “Fingerprint veri-
fication competition 2006,” Biometric Technol. Today, vol. 15, no. 7-8,
pp. 7–9, Aug. 2007.
[37] Information Technology—Biometric Data Interchange Formats—Part
2: Finger Minutiae Data, ISO/IEC 19794-2:2005, 2005.
[38] K. Simoens et al., “Criteria towards metrics for benchmarking template
protection algorithms,” in Proc. 5th IAPR Int. Conf. Biometrics (ICB
2012), New Delhi, 2012, pp. 498–505.
[39] J. Breebaart, C. Busch, J. Grave, and E. Kindt, “A reference architec-
ture for biometric template protection based on pseudo identities,” in
Proc. BIOSIG 2008, Special Interest Group on Biometrics and Elec-
tronic Signatures, Darmstadt, Germany, 2008.
[40] J. Feng and A. K. Jain, “Fingerprint reconstruction: From minutiae to
phase,” IEEE Trans. Pattern Anal. Mach. Intell., vol. 33, no. 2, pp.
209–223, Feb. 2011.
[41] NIST Biometric Image Software NIST, Apr. 2012 [Online]. Available:
http://www.nist.gov/itl/iad/ig/nbis.cfm
[42] Neurotechnology Web Site, Neurotechnology Inc., Apr. 2012 [Online].
Available: http://www.neurotechnology.com/
[43] R. Cappelli, D. Maio, D. Maltoni, J. L. Wayman, and A. K. Jain, “Per-
formance evaluation of fingerprint verification systems,” IEEE Trans.
Pattern Anal. Mach. Intell., vol. 28, no. 1, pp. 3–18, Jan. 2006.
FERRARA et al.: NONINVERTIBLE MINUTIA CYLINDER-CODE REPRESENTATION 1737
Matteo Ferrara received the Ph.D. degree from the
Department of Electronics, Computer Science and
Systems (DEIS), University of Bologna. He received
the bachelor’s degree cum laude in computer science
from the University of Bologna (March 2004), and
the Master’s degree cum laude in October 2005.
During his Ph.D. studies, which he completed in
2009, he worked on Biometric Fingerprint Recog-
nition Systems. Today he is an assistant teacher in
Computer Architectures and Pattern Recognition
courses at the faculty of Computer Science, Uni-
versity of Bologna, and he is a member of the Biometric System Laboratory,
Cesena, Italy. His research interests include image processing, pattern recog-
nition, biometric systems (fingerprint recognition, performance evaluation of
biometric systems, fingerprint scanner quality, and face recognition), informa-
tion security, and smart card.
Davide Maltoni (M’05) is an Associate Professor
at the Department of Electronics, Informatics and
Systems (DEIS), University of Bologna. He teaches
“Computer Architectures” and “Pattern Recogni-
tion” in Computer Science, University of Bologna,
Cesena. His research interests are in the area of
Pattern Recognition and Computer Vision. He is
active in the field of Biometric Systems (fingerprint
recognition, face recognition, hand recognition,
performance evaluation of biometric systems). He
is codirector of the Biometric Systems Laboratory,
Cesena, Italy, which is internationally known for its research and publications
in the field. He is author of two books: Biometric Systems, Technology, Design
and Performance Evaluation (Springer, 2005) and Handbook of Fingerprint
Recognition (Springer, 2003; II edition 2009), for which received the PSP
award from the Association of American Publishers.
Raffaele Cappelli (M’09) received the Laurea de-
gree cum laude in computer science from the Univer-
sity of Bologna, Cesena, Italy, in 1998. In 2002, he re-
ceived the Ph.D. degree in computer science and elec-
tronic engineering at DEIS, University of Bologna.
He is an Associate Researcher at the University of
Bologna, Italy. He teaches “Pattern Recognition” at
Computer Science, and he is a member of the Bio-
metric System Laboratory, University of Bologna,
Cesena, Italy. His research interests include pattern
recognition, image retrieval by similarity, and bio-
metric systems (fingerprint classification and recognition, synthetic fingerprint
generation, fingerprint aliveness detection, fingerprint scanner quality, face
recognition, and performance evaluation methodologies).
