No file available
To read the file of this research,
you can request a copy directly from the authors.
Security Vulnerabilities Against Fingerprint Biometric System
Preprints and early-stage research may not have been peer reviewed yet.
Abstract
The biometric system is an automatic identification and authentication system that uses unique biological traits, such as fingerprint, face, iris, voice, retina, etc. of an individual. Of all these systems, fingerprint biometric system is the most widely used because of its low cost, high matching speed, and relatively high matching accuracy. Due to the high efficiency of fingerprint biometric system in verifying a legitimate user, numerous government and private organizations are using this system for security purpose. This paper provides an overview of the fingerprint biometric system and gives details about various current security aspects related to the system. The security concerns that we address include multiple attacks on the system, associated threat models, biometric cryptosystems, current issues, challenges, opportunities, and open problems that exist in present day fingerprint biometric systems
ResearchGate has not been able to resolve any citations for this publication.
covert acquisition potential. The external structure of the human ear has a bilateral symmetry structure. Here, we analyse ear biometrics based on ear symmetry features. We apply iterative closest point and kernel principal component analysis with circular kernel for feature extraction while using a circular kernel function, combined with empirical mode decomposition into intrinsic mode functions perceptual hashing using and fast Chebyshev transform, and a secure authentication approach that exploits the discrete logarithm problem and Bose–Chaudhuri–Hocquenghem error-correcting codes to generate 128-bit crypto keys. We evaluate the proposed ear biometric cryptosecurity system using our data set of ear images acquired from 103 persons. Our results show that the ear biometric-based authentication achieved an equal error rate of 0.13 and true positive rate TPR of 0.85.
Fingerprint-based recognition is widely deployed in different domains. However, current recognition systems are vulnerable to presentation attack. Presentation attack utilizes an artificial replica of a fingerprint to deceive the sensors. In such scenarios, fingerprint liveness detection is required to ensure the actual presence of a live fingerprint. In this paper, we propose a static software-based approach using quality features to detect the liveness in a fingerprint image. The proposed method extracts eight sensor-independent quality features from the detailed ridge–valley structure of a fingerprint at the local level to form a 13-dimensional feature vector. Sequential Forward Floating Selection and Random Forest Feature Selection are used to select the optimal feature set from the created feature vector. To classify fake and live fingerprints, we have used support vector machine, random forest, and gradient boosted tree classifiers. The proposed method is tested on a publically available database of LivDet 2009 competition. The experimental results demonstrate that the least average classification error of 5.3% is achieved on LivDet 2009 database, exhibiting supremacy of the proposed method over current state-of-the-art approaches. Additionally, we have analyzed the importance of individual features on LivDet 2009 database, and effectiveness of the best-performing features is evaluated on LivDet 2011, 2013, and 2015 databases. The obtained results depict that the proposed approach is able to perform well irrespective of the different sensors and materials used in these databases. Further, the proposed method utilizes a single fingerprint image. This characteristic makes our method more user-friendly, faster, and less intrusive.
Cryptographic frameworks depend on key sharing for ensuring security of data. While the keys in cryptographic frameworks must be correctly reproducible and not unequivocally connected to the identity of a user, in biometric frameworks this is different. Joining cryptography techniques with biometrics can solve these issues. We present a biometric authentication method based on the discrete logarithm problem and Bose-Chaudhuri-Hocquenghem (BCH) codes, perform its security analysis, and demonstrate its security characteristics. We evaluate a biometric cryptosystem using our own dataset of electroencephalography (EEG) data collected from 42 subjects. The experimental results show that the described biometric user authentication system is effective, achieving an Equal Error Rate (ERR) of 0.024.
Recent research has demonstrated the possibility of generating "Masterprints" that can be used by an adversary to launch a dictionary attack against a fingerprint recognition system. Masterprints are fingerprint images that fortuitously match with a large number of other fingerprints thereby compromising the security of a fingerprint-based biometric system, especially those equipped with small-sized fingerprint sensors. This work presents new methods for creating a synthetic MasterPrint dictionary that sequentially maximizes the probability of matching a large number of target fingerprints. Three techniques, namely Co-variance Matrix Adaptation Evolution Strategy (CMA-ES), Differential Evolution (DE) and Particle Swarm Optimization (PSO), are explored. Experiments carried out using a commercial fingerprint verification software, and public datasets, show that the proposed approaches performed quite well compared to the previously known MasterPrint generation methods.
An emerging direction for authenticating people is the adoption of biometric authentication systems. Biometric credentials are becoming increasingly popular as a means of authenticating people due to the wide range of advantages that they provide with respect to classical authentication methods (e.g., password-based authentication). The most characteristic feature of this authentication method is the naturally strong bond between a user and her biometric credentials. This very same advantageous property, however, raises serious security and privacy concerns in case the biometric trait gets compromised. In this article, we present the most challenging issues that need to be taken into consideration when designing secure and privacy-preserving biometric authentication protocols. More precisely, we describe the main threats against privacy-preserving biometric authentication systems and give directions on possible countermeasures in order to design secure and privacy-preserving biometric authentication protocols.
Smartphone-based biometrics offers a wide range of possible solutions, which could be used to authenticate users and thus to provide an extra level of security and theft prevention. We propose a method for positive identification of smartphone user's identity using user's gait characteristics captured by embedded smartphone sensors (gyroscopes, accelerometers). The method is based on the application of the Random Projections method for feature dimensionality reduction to just two dimensions. Then, a probability distribution function (PDF) of derived features is calculated, which is compared against known user PDF. The Jaccard distance is used to evaluate distance between two distributions, and the decision is taken based on thresholding. The results for subject recognition are at an acceptable level: we have achieved a grand mean Equal Error Rate (ERR) for subject identification of 5.7% (using the USC-HAD dataset). Our findings represent a step towards improving the performance of gait-based user identity verification technologies.
Fingerprint-based recognition systems have been increasingly deployed in various applications nowadays. However, the recognition systems can be spoofed by using an accurate imitation of a live fingerprint such as an artificially made fingerprint. In this paper, we propose a novel software-based fingerprint liveness detection method which achieves good detection accuracy. We regard the fingerprint liveness detection as a two-class classification problem and construct co-occurrence array from image gradients to extract features. In doing so, the quantization operation is firstly conducted on the images. Then, the horizontal and vertical gradients at each pixel are calculated, and the gradients of large absolute values are truncated into a reduced range. Finally, the second-order and the third-order co-occurrence arrays are constructed from the truncated gradients, and the elements of the co-occurrence arrays are directly used as features. The second-order and the third-order co-occurrence array features are separately utilized to train support vector machine classifiers on two publicly available databases used in Fingerprint Liveness Detection Competition 2009 and 2011. The experimental results have demonstrated that the features extracted with the third-order co-occurrence array achieve better detection accuracy than that with the second-order co-occurrence array and outperform the state-of-the-art methods.
A number of previous researchers have discussed the vulnerability of TPM to physical attack and have proposed a number of solutions to solve these issues. Investigation have shown a number of flaws that these solutions suffers from. Trusted Platform Module User Authentication Model (TPM-UAM) is a model that was proposed and evaluated to overcome major safety issue that TPM found to be vulnerable to. A system prototype based on TPM-UAM was developed to prove the TPM-UAM ability to protect trusted computers protected by TPM. Expert review method depends on the understanding that experts are able to provide clear judgment and opinions from their experience and knowledge in their fields. The evaluation process consists of three sections, functionality evaluation, ‘can you break it?’ test and usability evaluation. Three experts in an individual expert review method were asked to evaluate the system prototype in order to confirm the system correctness of design and implementation and also to evaluate the prototype as a reflection of the TPM-UAM and confirm the model ability to protect trusted computers protected by TPM. The evaluation process was conducted as planed and the system prototype was successfully evaluated. The results confirmed on the system’s correct design and implementation, also confirms the correct imitation and representation of the TPM-UAM model in a software prototype, as well as the system efficiency and ability to secure TPM. This paper describes the expert evaluation of software prototype based on TPMUAM model. Three experts in the field of trusted computing and information security evaluated the system prototype individually in three evaluation sections includes functionality evaluation, ‘can you break it’ test and usability evaluation. The evaluation results confirms the system correct design, ability to protect TPM and the reflection of the TPM-UAM model that the prototype system intended to represent.
Wide spread use of biometric based authentication implies the need to secure biometric reference data. Various template protection schemes have been introduced to prevent biometric forgery and identity thefts. Cancelable biometrics and visual cryptography are two recent technologies introduced to address the concerns regarding privacy of biometric data, and to improve public confidence and acceptance of biometric systems. Cancelable biometrics is an important technique that allows generation of revocable biometric templates. As the number of biometric instances are limited and once compromised they are lost forever. Cancelable biometrics allows templates to be cancelled and revoked like passwords innumerable times. Recently, various approaches that utilize visual cryptography to secure the stored template and impart privacy to the central databases have been introduced. This work attempts to summarize the existing approaches in literature making use of these two technologies to protect biometric templates.
In a spoofing attack, an impostor masquerades as a legitimate user by replicating that user's biometrics. Although methods exist to determine whether a live person or biometric artifact is in front of a biometric sensor, spoofing attacks remain a problem.
This paper presents the implementation of a complete fingerprint biometric cryptosystem in a Field Programmable Gate Array (FPGA). This is possible thanks to the use of a novel fingerprint feature, named QFingerMap, which is binary, length-fixed, and ordered. Security of Authentication on FPGA is further improved because information stored is protected due to the design of a cryptosystem based on Fuzzy Commitment. Several samples of fingers as well as passwords can be fused at feature level with codewords of an error correcting code to generate non-sensitive data. System performance is illustrated with experimental results corresponding to 560 fingerprints acquired in live by an optical sensor and processed by the system in a Xilinx Virtex 6 FPGA. Depending on the realization, more or less accuracy is obtained, being possible a perfect authentication (zero Equal Error Rate), with the advantages of real-time operation, low power consumption, and a very small device.
Face recognition has become more significant and relevant in recent years owing to it potential applications. Since the faces are highly dynamic and pose more issues and challenges to solve, researchers in the domain of pattern recognition, computer vision and artificial intelligence have proposed many solutions to reduce such difficulties so as to improve the robustness and recognition accuracy. As many approaches have been proposed, efforts are also put in to provide an extensive survey of the methods developed over the years. The objective of this paper is to provide a survey of face recognition papers that appeared in the literature over the past decade under all severe conditions that were not discussed in the previous survey and to categorize them into meaningful approaches, viz. appearance based, feature based and soft computing based. A comparative study of merits and demerits of these approaches have been presented.
Several issues related to the vulnerability of fingerprint recognition systems to attacks have been highlighted in the biometrics literature. One such vulnerability involves the use of artificial fingers, where materials such as Play-Doh, silicone, and gelatin are inscribed with fingerprint ridges. Researchers have demonstrated that some commercial fingerprint recognition systems can be deceived when these artificial fingers are placed on the sensor; that is, the system successfully processes the ensuing fingerprint images, thereby allowing an adversary to spoof the fingerprints of another individual. However, at the same time, several countermeasures that discriminate between live fingerprints and spoof artifacts have been proposed. While some of these antispoofing schemes are hardware based, several software-based approaches have been proposed as well. In this article, we review the literature and present the state of the art in fingerprint antispoofing.
Form a privacy perspective most concerns against the common use of biometrics arise from the storage and misuse of biometric data. Biometric cryptosystems and cancelable biometrics represent emerging technologies of biometric template protection addressing these concerns and improving public confidence and acceptance of biometrics. In addition, biometric cryptosystems provide mechanisms for biometric-dependent key-release. In the last years a significant amount of approaches to both technologies have been published. A comprehensive survey of biometric cryptosystems and cancelable biometrics is presented. State-of-the-art approaches are reviewed based on which an in-depth discussion and an outlook to future prospects are given.
Biometric-based access control systems (BACSs) are vulnerable to replay attacks. Replay attacks occur when a biometric template is intercepted and maliciously used to gain unauthorized access to a system. In this paper, we introduce a Genetic and Evolutionary Biometric Security (GEBS) application which uses a Genetic and Evolutionary Computation to develop disposable Feature Extractors (FEs) in an effort to mitigate replay attacks. We describe how a previously developed system known as GEFE (Genetic and Evolutionary Feature Extraction) can be used to evolve unique and disposable FEs for users of BACS. Furthermore, we propose two access control protocols based on the use of disposable FEs and/or their resulting templates (also referred to as feature vectors (FVs)). In our proposed protocols, FEs/FVs are used to authenticate the identity of individuals and are then discarded. Our results show that this GEBS application can be successfully used to mitigate biometric replay attacks.
Biometric systems present several drawbacks that may significantly decrease their utility. Nowadays, several platforms (such as the FVC-onGoing) exist to assess the performance of such systems. Despite this, none platform exists for the security evaluation of biometric systems. Hence, the aim of this paper is to present an on-line platform for the security evaluation of biometric systems. The key benefits of the presented platform are twofold. First, it provides the research community in biometrics an evaluation tool to assess biometric systems in term of security. Second, the platform provides a database of common threats and vulnerabilities of biometric systems that can be updated by researchers feedbacks. The presented tool is modality-independent. A keystroke dynamics system is used to illustrate the benefits of the presented platform.
Biometric EncryptionTM is an algorithm which has been developed to securely link and retrieve a digital key using the interaction of a biometric image, such as a fingerprint, with a secure block of data, known as a BioscryptTM. The key can be used, for example, as an encryption/decryption key. The Bioscrypt comprises a stored filter function, produced by a correlation-based image processing algorithm, as well as other information which is required to first retrieve, and then verify the validity of, the key. The process of securely linking a key with a biometric is known as enrollment, while the process of retrieving this key is known as verification. This paper presents details of the enrollment and verification procedures.
Fake finger submission attack is a major problem in fingerprint recognition systems. In this paper, we introduce an aliveness detection method based on multiple static features, which derived from a single fingerprint image. The static features are comprised of individual pore spacing, residual noise and several first order statistics. Specifically, correlation filter is adopted to address individual pore spacing. The multiple static features are useful to reflect the physiological and statistical characteristics of live and fake fingerprint. The classification can be made by calculating the liveness scores from each feature and fusing the scores through a classifier. In our dataset, we compare nine classifiers and the best classification rate at 85% is attained by using a Reduced Multivariate Polynomial classifier. Our approach is faster and more convenient for aliveness check for field applications.
This paper presents an in depth discussion of WalnutDSA, a quantum resistant public-key digital signature method based on the one-way function E-multiplication. A key feature of WalnutDSA is that it provides very efficient means of validating digital signatures which is essential for low-powered and constrained devices. This paper presents an in-depth discussion of the construction of the digital signature algorithm, and delves deeply into the underlying mathematics that facilitates analysing the security of the scheme. When implemented using parameters that defeat all known attacks, WalnutDSA is among the fastest quantum resistant signature verification methods; it performs orders of magnitude faster than ECC, even on low-end embedded hardware. WalnutDSA delivers a 12–25× speed improvement over ECDSA on most platforms, and a 31× speed improvement on a 16-bit microcontroller, making it an ideal solution for low-resource processors found in the Internet of Things (IoT).
Biometrics increasingly form the basis of identification and recognition across many sensitive applications. But as the use of biometric systems increases, so do the threats against them. The secure storage of biometric templates has therefore become a key issue in the modern era; the acceptance of biometric authentication devices by the general public is dependent on the perceived level of security of biometric information templates stored within databases.
To address the issues like identity theft and security threats, a continuously evolving technology known as biometrics is presently being deployed in a wide range of personal, government, and commercial applications. Despite thegreat progress in the field, several exigent problems have yet to be addressed to unleash biometrics full potential. This article aims to present an overview of biometric research and more importantly the significant progress that has been attained over the recent years. The paper is envisaged to further not only the understanding of general audiences and policy makers but also interdisciplinary research. Most importantly, this article is
intended to complement earlier articles with updates on most recent topics and developments related to e.g. spoofing, evasion, obfuscation, face reconstruction from DNA, big data issues in biometrics, etc.
The problem of fingerprint liveness detection has received an increasing attention in the last decade, as attested by the organisation of three editions of an international competition, named LivDet, dedicated to this challenge. LivDet editions and other works in the literature showed that the performance of current fingerprint liveness detection algorithms is not good enough to allow empowering a fingerprint verification system with a module aimed to distinguish alive from fake fingerprint images. However, recent developments have shown that texture-based features can provide promising solutions to this problem. In this study, a novel fingerprint liveness descriptor named binarised statistical image features (BSIFs) is adopted. Similarly to local binary pattern and local phase quantisation-based representations, BSIF encodes the local fingerprint texture into a feature vector by using a set of filters that, unlike other methods, are learnt from natural images. Extensive experiments with over 40,000 live and fake fingerprint images show that the authors' proposed method outperforms most of the state-of-The-Art algorithms, allowing a step ahead to the real integration of fingerprint liveness detectors into verification systems.
The World Bank estimates that as many as 1.5bn people worldwide do not officially exist. This lack of formal identification is a key challenge across the developing world – without reliable, unique and persistent identifiers, governments and development organisations struggle to provide essential goods and services to the populations they serve. The problem is wide-ranging: the dynamic nature of subsistence or agricultural communities and largely dysfunctional civil registration systems, combined with rapid population growth, have led to communities which are uncountable and poorly censused. Paper-based identity systems are resource-intensive, fragile and easily manipulated.
Biometric authentication schemes are frequently used to establish the identity of a user. Often, a trusted hardware device is used to decide if a provided biometric feature is sufficiently close to the features stored by the legitimate user during enrollment. In this paper, we address the question whether the stored features can be extracted with side-channel attacks. We consider several models for types of leakage that are relevant specifically for fingerprint verification, and show results for attacks against the Bozorth3 and a custom matching algorithm. This work shows an interesting path for future research on the susceptibility of biometric algorithms towards side-channel attacks.
The growing popularity of wearable devices is leading to new ways to interact with the environment, with other smart devices, and with other people. Wearables equipped with an array of sensors are able to capture the owner's physiological and behavioural traits, thus are well suited for biometric authentication to control other devices or access digital services. However, wearable biometrics have substantial differences from traditional biometrics for computer systems, such as fingerprints, eye features, or voice. In this article, we discuss these differences and analyse how researchers are approaching the wearable biometrics field. We review and provide a categorization of wearable sensors useful for capturing biometric signals. We analyse the computational cost of the different signal processing techniques, an important practical factor in constrained devices such as wearables. Finally, we review and classify the most recent proposals in the field of wearable biometrics in terms of the structure of the biometric system proposed, their experimental setup, and their results. We also present a critique of experimental issues such as evaluation and feasibility aspects, and offer some final thoughts on research directions that need attention in future work.
Biometric systems are developed in order to replace traditional authentication. However, protecting the stored templates is considered as one of the critical steps in designing a secure biometric system. When biometric data is compromised, unlike passwords, it can’t be revoked. One methodology for biometric template protection is ‘Biometric Cryptosystem’. Biometric cryptosystems benefit from both fields of cryptography and biometrics where the biometrics exclude the need to remember passwords and the cryptography provides high security levels for data. In order to, develop these systems, Fuzzy Commitment Scheme (FCS) is considered as well known approach proposed in the literature to protect the user’s data and has been used in several applications. However, these biometric cryptosystems are hampered by the lack of formal security analysis to prove their security strength and effectiveness. Hence, in this paper we present several metrics to analyze the security and evaluate the weaknesses of biometric cryptosystems based on FCS.
There is a growing demand for biometrics-based recognition of children for a number of applications, particularly in developing countries where children do not have any form of identification. These applications include tracking child vaccination schedules, identifying missing children, preventing fraud in food subsidies, and preventing newborn baby swaps in hospitals. Our objective is to develop a fingerprint-based identification system for infants (age range: 0-12 months)1. Our ongoing research has addressed the following issues: (i) design of a compact, comfortable, high-resolution (>1,000 ppi) fingerprint reader; (ii) image enhancement algorithms to improve quality of infant fingerprint images; and (iii) collection of longitudinal infant fingerprint data to evaluate identification accuracy over time. This collaboration between Michigan State University, Dayalbagh Educational Institute, Saran Ashram Hospital, Agra, India and NEC Corporation, has demonstrated the feasibility of recognizing infants older than 4 weeks using fingerprints.
One of the potential vulnerabilities in a biometric system is the leakage of biometric template information, which may lead to serious security and privacy threats. Most of the available template protection techniques fail to meet all the desired requirements of a practical biometric system like revocability, security, privacy, and high matching accuracy. In particular, protecting the fingerprint templates has been a difficult problem due to large intra-user variations (e.g., rotation, translation, nonlinear deformation, and partial prints). There are two fundamental challenges in any fingerprint template protection scheme. First, we need to select an appropriate representation scheme that captures most of the discriminatory information, but is sufficiently invariant to changes in finger placement and can be secured using available template protection algorithms. Secondly, we need to automatically align or register the fingerprints obtained during enrollment and matching without using any information that could reveal the features, which uniquely characterize a fingerprint. This chapter analyzes how these two challenges are being addressed in practice and how the design choices affect the trade-off between the security and matching accuracy. Though much progress has been made over the last decade, we believe that fingerprint template protection algorithms are still not sufficiently robust to be incorporated into practical fingerprint recognition systems.
The biometric cryptographic system can provide a secure integration of the biometric features and the traditional cryptology. The application of biometrics based key binding method or biometric keys can not only hide the information of the users' biometric features, but can also securely realize secret key production, key recovery and authentication. This paper first proposes a general model for biometrics based key binding algorithm, and then presents a novel (cryptographic) key generation method based on fingerprint features and the Shamir threshold scheme. Our method can not only protect the legitimate user's secret key but can also effectively prevent his biometric features from being revealed. Our experimental results show that our fingerprint features based key binding method is efficient and the key success recovery rite may approach to 91 percent. But the key recovery is not so much successful as for our method to be applied for practical cryptographic system. Hence, more work has to do for our method's optimization.
In order to render a biometric system robust against malicious tampering, it is important to understand the different types of attack and their impact as observed by the liveness and matching scores. In this study, we consider zero-effort impostor attack (referred to as the Z-attack), nonzero-effort impostor attack such as presentation attack or spoofing (S-attack), and other categories of attack involving tampering at the template level (U- and T-attacks). In order to elucidate the impact of all possible attacks, we (1) introduce the concepts of source of origin and symmetric biometric matchers, and (2) subsequently group the attacks into four categories. These views not only improve the understanding of the nature of different attacks but also turn out to ease the design of the classification problem. Following this analysis, we design a novel classification scheme that can take full advantage of the attack-specific data characteristics. Two realisations of the scheme, namely, a mixture of linear classifiers, and a Gaussian Copula-based Bayesian classifier, turn out to outperform a strong baseline classifier based on SVM, as supported by fingerprint spoofing experiments.
The paper presents a novel and efficient information security technique by employing orthogonal coding scheme, encoded steganography and nonlinear encryption scheme involving joint transform correlation. Multiple biometric signatures are encoded using individual orthogonal codes and then multiplexed together. The encoded and multiplexed image is then embedded inside a cover image utilizing a new steganography technique. Here, a color cover image is first decomposed into three color components, red, green and blue, each of which is used to embed one set of biometric signatures. In each component image, one bit from the three least significant bits is selected using another secret key which is then replaced by the information bit. The component stego images are combined to form the color stego image, which is again encrypted using a multiple phase-shifted reference joint transform correlation (MRJTC) technique. The MRJTC technique is a nonlinear encryption process which increases the security strength significantly against any unauthorized access. The encoded steganography process reduces the vulnerability of an intruder retrieving any information through any steganalysis attack. In addition, the orthogonal encoding scheme enhances the robustness by making the biometric information almost inaccessible without authorization.
Systems employing biometric traits for people authentication and identification are witnessing growing popularity due to the unique and indissoluble link between any individual and his/her biometric characters. For this reason, biometric templates are increasingly used for border monitoring, access control, membership verification, and so on. When employed to replace passwords, biometrics have the added advantage that they do not need to be memorized and are relatively hard to steal. Nonetheless, unlike conventional security mechanisms such as passwords, biometric data are inherent parts of a person?s body and cannot be replaced if they are compromised. Even worse, compromised biometric data can be used to have access to sensitive information and to impersonate the victim for malicious purposes. For the same reason, biometric leakage in a given system can seriously jeopardize the security of other systems based on the same biometrics. A further problem associated with the use of biometric traits is that, due to their uniqueness, the privacy of their owner is put at risk. Geographical position, movements, habits, and even personal beliefs can be tracked by observing when and where the biometric traits of an individual are used to identify him/her.
Bringer et al . proposed two cryptographic protocols for the computation of Hamming distance. Their first scheme uses oblivious transfer and provides security in the semi‐honest model. The other scheme uses committed oblivious transfer and is claimed to provide full security in the malicious case. The proposed protocols have direct implications to biometric authentication schemes between a prover and a verifier where the verifier has biometric data of the users in plain form.
In this paper, we show that their protocol is not actually fully secure against malicious adversaries. More precisely, our attack breaks the soundness property of their protocol where a malicious user can compute a Hamming distance, which is different from the actual value. For biometric authentication systems, this attack allows a malicious adversary to pass the authentication without knowledge of the honest user's input with at most O ( n ) complexity instead of O (2 n ), where n is the input length. We propose an enhanced version of their protocol where this attack is eliminated. The security of our modified protocol is proven using the simulation‐based paradigm. Furthermore, as for efficiency concerns, the modified protocol utilizes verifiable oblivious transfer, which does not require the commitments to outputs, which improves its efficiency significantly. Copyright © 2015 John Wiley & Sons, Ltd.
Biometric recognition is an integral component of modern identity management and access control systems. Due to the strong and permanent link between individuals and their biometric traits, exposure of enrolled users? biometric information to adversaries can seriously compromise biometric system security and user privacy. Numerous techniques have been proposed for biometric template protection over the last 20 years. While these techniques are theoretically sound, they seldom guarantee the desired noninvertibility, revocability, and nonlinkability properties without significantly degrading the recognition performance. The objective of this work is to analyze the factors contributing to this performance divide and highlight promising research directions to bridge this gap. The design of invariant biometric representations remains a fundamental problem, despite recent attempts to address this issue through feature adaptation schemes. The difficulty in estimating the statistical distribution of biometric features not only hinders the development of better template protection algorithms but also diminishes the ability to quantify the noninvertibility and nonlinkability of existing algorithms. Finally, achieving nonlinkability without the use of external secrets (e.g., passwords) continues to be a challenging proposition. Further research on the above issues is required to cross the chasm between theory and practice in biometric ?template protection.
Biometric identity verification is now commonly used in embedded electronic devices, from consumer products as smartphones to ID documents. As biometric traits are related to individual, the privacy of such personal information is important. Many of these embedded systems rely on an embedded comparison, like Match On Card (MOC) in smart cards, where the stored biometric trait is kept inside the device. In this paper, we extend further a recent work on the vulnerability analysis of an embedded hardware verification module (matcher) against Side Channel Analysis (SCA) techniques, by introducing a new SCA strategy. We present the used SCA approach to exploit the activity leakage of this embedded matcher to retrieve the stored trait. Then we present some simple countermeasures to protect against SCA and we give an evaluation of their performances both in term of security and complexity.
A recent survey of iris biometric research from its inception through 2007, roughly 15 years of research, lists approximately 180 publications. This new survey is intended to update the previous one, and covers iris biometrics research over the period of roughly 2008 to 2010. Research in iris biometrics has expanded so much that, although covering only three years and intentionally being selective about cov-erage, this new survey lists a larger number of references than the inception-through-2007 survey.
Fingerprint is a popular biometric modality which is used extensively in several applications for person authentication, providing high uniqueness and acceptable performance. Most fingerprint systems use minutiae-based representations. However, several studies have proven that the original fingerprint impression can be reconstructed from minutia information, which makes the problem of ensuring the security of fingerprint data very critical. In this paper, we present a new approach for fingerprint template protection. Our objective is to build a non-invertible transformation that meets the requirements of revocability, diversity, security and performance. In this context, we exploit the information provided by the extracted minutiae to construct a new representation based on special spiral curves, which can be used for the recognition task instead of the traditional minutiae-based representation. The proposed approach has been evaluated using the original FVC protocol and compared with existing protection approaches which use the same protocol. Our experimental results illustrate the ability of the proposed representation to preserve the performance of protected systems. Moreover, we demonstrate that the security of our approach is sufficiently robust to the zero effort and brute force attacks.
Identity management through biometrics offer potential advantages over knowledge and possession based methods. A wide variety of biometric modalities have been tested so far but several factors paralyze the accuracy of mono-modal biometric systems. Usually, the analysis of multiple modalities offers better accuracy. An extensive review of biometric technology is presented here. Besides the mono-modal systems, the article also discusses multi-modal biometric systems along with their architecture and information fusion levels. The paper along with the exemplary evidences highlights the potential for biometric technology, market value and prospects.
Several biometric threats systems models have been proposed to facilitate the design, implementation and validation techniques for securing these systems. Some models classify threats by type of attacks, others by specific attacks and other by using vulnerabilities and threat agent. Each model proposes a vision and a different approach to identify these threats. For example, to design security techniques for wireless biometric card, one should identify all threats facing this kind of device. In this paper, a comparative study and synthesis to help choose the most fitting model, depending on the security problems addressed, is given.
This paper focuses on a biometric cryptosystem implementation and evaluation based on a number of fingerprint texture descriptors. The texture descriptors, namely, the Gabor filter-based FingerCode, a local binary pattern (LBP), and a local direction pattern (LDP), and their various combinations are considered. These fingerprint texture descriptors are binarized using a biometric discretization method and used in a fuzzy commitment scheme (FCS). We constructed the biometric cryptosystems, which achieve a good performance, by fusing discretized fingerprint texture descriptors and using effective error-correcting codes. We tested the proposed system on a FVC2000 DB2a fingerprint database, and the results demonstrate that the new system significantly improves the performance of the FCS for texture-based fingerprints.
Biometric recognition--the automated recognition of individuals based on their behavioral and biological characteristic--is promoted as a way to help identify terrorists, provide better control of access to physical facilities and financial accounts, and increase the efficiency of access to services and their utilization. Biometric recognition has been applied to identification of criminals, patient tracking in medical informatics, and the personalization of social services, among other things. In spite of substantial effort, however, there remain unresolved questions about the effectiveness and management of systems for biometric recognition, as well as the appropriateness and societal impact of their use. Moreover, the general public has been exposed to biometrics largely as high-technology gadgets in spy thrillers or as fear-instilling instruments of state or corporate surveillance in speculative fiction. Now, as biometric technologies appear poised for broader use, increased concerns about national security and the tracking of individuals as they cross borders have caused passports, visas, and border-crossing records to be linked to biometric data. A focus on fighting insurgencies and terrorism has led to the military deployment of biometric tools to enable recognition of individuals as friend or foe. Commercially, finger-imaging sensors, whose cost and physical size have been reduced, now appear on many laptop personal computers, handheld devices, mobile phones, and other consumer devices. Biometric Recognition: Challenges and Opportunities addresses the issues surrounding broader implementation of this technology, making two main points: first, biometric recognition systems are incredibly complex, and need to be addressed as such. Second, biometric recognition is an inherently probabilistic endeavor. Consequently, even when the technology and the system in which it is embedded are behaving as designed, there is inevitable uncertainty and risk of error. This book elaborates on these themes in detail to provide policy makers, developers, and researchers a comprehensive assessment of biometric recognition that examines current capabilities, future possibilities, and the role of government in technology and system development. © 2010 by the National Academy of Sciences. All rights reserved.
Most fingerprint recognition systems store minutiae-based fingerprint template in a database. As the minutiae template is very compact, many take it for granted that these minutiae points do not contain sufficient information for reconstructing the original fingerprint. This paper proposes a scheme to reconstruct the fingerprint from minutiae points based on the amplitude and frequency modulated (AM-FM) fingerprint model to fool a system that requires a full print. We first generate a binary ridge pattern which has a similar ridge flow to that of the original fingerprint. The continuous phase is intuitively reconstructed by removing the spirals in the phase image estimated from the ridge pattern. We further introduce a phase refinement process to reduce the artifacts created due to the discontinuity in the reconstructed phase image, which is the combination of the continuous phase and the spiral phase (computed from the minutiae points). Compared with previous works, our reconstructed fingerprint matches better against the original fingerprint and the other impressions. In addition, it contains fewer artifacts.
Fingerprint authentication systems suffer from security and privacy issues since it needs to store the fingerprint template in the database. Once this data is compromised, the effect is forever as it can not be revoked. In this paper, we propose a local feature-based cancelable fingerprint template scheme. The experimental result which is generated by using a public database, FVC2002DB2, shows that it has a low error level and also meets the security and privacy requirements, such as revocability and diversity.