How to Evaluate Transformation Based Cancelable

Biometric Systems?

R. Belguechi, E. Cherrier and C. Rosenberger

GREYC Research Lab, ENSICAEN - CNRS – University of Caen, FRANCE

NIST International Biometric Performance Testing Conference 2012
Context

Cancelable biometric systems

Privacy by design biometric systems,

Two approaches : crypto-biometrics and transformation based,

Pionner article : Ratha et al., 2001,

BioHashing, a popular algorithm : Teoh et al., 2004,

Difficult to evaluate their security.

christophe.rosenberger@ensicaen.fr (GREYC) Evaluation of cancelable systems IBPC 2012 2 / 23
Context

Cancelable biometric systems

Privacy by design biometric systems,

Two approaches : crypto-biometrics and transformation based,

Pionner article : Ratha et al., 2001,

BioHashing, a popular algorithm : Teoh et al., 2004,

Difficult to evaluate their security.

 

Contributions

Proposition of evaluation criteria for privacy and security compliance

⇒ extension of Nagar et al., 2010,

Illustrations on fingerprints and finger knuckle prints,

Definition of a Matlab toolbox for the evaluation of BioHashing based

cancelable systems

christophe.rosenberger@ensicaen.fr (GREYC) Evaluation of cancelable systems IBPC 2012 2 / 23
Outline

1

2

3

4

BioHashing algorithm

Evaluation framework

Experimental results

Conclusion & perspectives

christophe.rosenberger@ensicaen.fr (GREYC) Evaluation of cancelable systems IBPC 2012 3 / 23
Outline

1

2

3

4

BioHashing algorithm

Evaluation framework

Experimental results

Conclusion & perspectives

christophe.rosenberger@ensicaen.fr (GREYC) Evaluation of cancelable systems IBPC 2012 4 / 23
BioHashing algorithm

Figure 1: General principle of the BioHashing algorithm

christophe.rosenberger@ensicaen.fr (GREYC) Evaluation of cancelable systems IBPC 2012 5 / 23
BioHashing algorithm

christophe.rosenberger@ensicaen.fr (GREYC) Evaluation of cancelable systems IBPC 2012 6 / 23
BioHashing algorithm

Properties

Given the BioCode, the biometric raw data cannot be retrieved,

Only the BioCode is stored,

If the BioCode is intercepted, a new one can be generated,

An individual can have many BioCodes for different applications,

The BioHashing process improves performances.

christophe.rosenberger@ensicaen.fr (GREYC) Evaluation of cancelable systems IBPC 2012 7 / 23
BioHashing algorithm

Properties

Given the BioCode, the biometric raw data cannot be retrieved,

Only the BioCode is stored,

If the BioCode is intercepted, a new one can be generated,

An individual can have many BioCodes for different applications,

The BioHashing process improves performances.

Open questions for an attacker

Is it possible to generate an admissible BioCode without the seed ?

Can we predict a BioCode given previous realizations ?

How different are two BioCodes generated from the same FKPcode ?

⇒ Definition of an evaluation framework.

christophe.rosenberger@ensicaen.fr (GREYC) Evaluation of cancelable systems IBPC 2012 7 / 23
Outline

1

2

3

4

BioHashing algorithm

Evaluation framework

Overview

Notations

Efficiency

Non-invertibility

Diversity

Experimental results

Conclusion & perspectives

christophe.rosenberger@ensicaen.fr (GREYC) Evaluation of cancelable systems IBPC 2012 8 / 23
Overview

Security properties

Performance : the template protection shall not deteriorate the

performance of the original biometric system,

Revocability or renewability : it shoud be possible to revoke a

biometric template.

Non-invertibility or irreversibility : from the transformed data, it

should not be possible to obtain enough information on the original

biometric data to forge a fake biometric template,

Diversity or unlinkability : it should be possible to generate different

biocodes for multiple applications, and no information should be

deduced from their different realizations.

⇒ Definition of 8 evaluation criteria based on Nagar et al., 2010

christophe.rosenberger@ensicaen.fr (GREYC) Evaluation of cancelable systems IBPC 2012 9 / 23
Notations

Verification process

Rz = 1{DT (f (bz ,Kz ),f (b ́z ,Kz ))≤T } (1)

Where :

Rz : decision result for the verification of user z using the cancelable

system,

DT : distance function in the transformed domain,

f : the feature transformation function,

bz , b ́

z represent the template and query biometric features of user z,

Kz : set of transformation parameters, 

T : decision threshold.

christophe.rosenberger@ensicaen.fr (GREYC) Evaluation of cancelable systems IBPC 2012 10 / 23
Efficiency property

A1 evaluation criterion

A1 = 1 − AUC(FART, FRRT)

AUC(FARO, FRRO) (2)

where :

AUC : area under the ROC curve,

FRRO is the false reject rate and FARO is the false accept rate of the

original biometric system (without any template protection),

 

FRRT is the false reject rate and FART is the false accept rate of the

cancelable biometric system (with template protection).

if A1 > 0, the protection of the template improves the performance.

christophe.rosenberger@ensicaen.fr (GREYC) Evaluation of cancelable systems IBPC 2012 11 / 23
Non-invertibility property

A2 to A5 evaluation criteria

FARA(T ) = P(DT (f (bz ,Kz ), Az ) ≤ T ) (3)

Where :

FARA(T ) : probability of a successful attack by the impostor for the

threshold T .

Az : generated biocode by the impostor with different methods,

We can consider T = EERT (EERT : threshold to have the EER

functionning point of the cancelable biometric system).

christophe.rosenberger@ensicaen.fr (GREYC) Evaluation of cancelable systems IBPC 2012 12 / 23
Non-invertibility property

A priori information used by the impostor

Zero effort attack (A2) :

An impostor provides one of its biometric sample to be authenticated

as the user z : Az = f (b ́

x ,Kx ),

christophe.rosenberger@ensicaen.fr (GREYC) Evaluation of cancelable systems IBPC 2012 13 / 23
Non-invertibility property

A priori information used by the impostor

Zero effort attack (A2) :

An impostor provides one of its biometric sample to be authenticated

as the user z : Az = f (b ́

x ,Kx ),

Brute force attack (A3) :

An impostor tries to be authenticated by trying different random

values of A : Az = A,

christophe.rosenberger@ensicaen.fr (GREYC) Evaluation of cancelable systems IBPC 2012 13 / 23
Non-invertibility property

A priori information used by the impostor

Zero effort attack (A2) :

An impostor provides one of its biometric sample to be authenticated

as the user z : Az = f (b ́

x ,Kx ),

Brute force attack (A3) :

An impostor tries to be authenticated by trying different random

values of A : Az = A,

Stolen token attack (A4) :

An impostor has obtained the token Kz of the genuine user z and

tries different random values of b to generate : Az = f (b,Kz ),

christophe.rosenberger@ensicaen.fr (GREYC) Evaluation of cancelable systems IBPC 2012 13 / 23
Non-invertibility property

A priori information used by the impostor

Zero effort attack (A2) :

An impostor provides one of its biometric sample to be authenticated

as the user z : Az = f (b ́

x ,Kx ),

Brute force attack (A3) :

An impostor tries to be authenticated by trying different random

values of A : Az = A,

Stolen token attack (A4) :

An impostor has obtained the token Kz of the genuine user z and

tries different random values of b to generate : Az = f (b,Kz ),

Stolen biometric data attack (A5) :

An impostor knows b ́

z and tries different random numbers K to

generate : Az = f (b ́

z ,K).

christophe.rosenberger@ensicaen.fr (GREYC) Evaluation of cancelable systems IBPC 2012 13 / 23
Diversity property

A6 evaluation criterion

A6 = 1

N

X

z

X

M

j=1

max(I (f (bz ,Kz ), f (bj

z ,Kz )))

I(X, Y ) = X

x

X

y

P(x, y)log( P(x, y)

P(x)P(y)

)

Where :

bz : denotes the reference of the individual z in the database,

j b th z : denotes the j test data of the individual z in the database,

N : the number of individuals in the database,

M : the number of generated biocodes for each individual,

P : the estimation of the probability.

christophe.rosenberger@ensicaen.fr (GREYC) Evaluation of cancelable systems IBPC 2012 14 / 23
Diversity property

A7 to A8 evaluation criteria

For each template of the genuine user :

Generation of Q biocodes Bz = {f (bz ,K 1

z ), .., f (bz ,K Qz )} for user z,

Prediction of a possible biocode value by setting the most probable

value of each bit given Bz ,

Computation of equation (2).

⇒ A7 value for Q = 3 and A8 for Q = 11

christophe.rosenberger@ensicaen.fr (GREYC) Evaluation of cancelable systems IBPC 2012 15 / 23
Diversity property

A7 to A8 evaluation criteria

For each template of the genuine user :

Generation of Q biocodes Bz = {f (bz ,K 1

z ), .., f (bz ,K Qz )} for user z,

Prediction of a possible biocode value by setting the most probable

value of each bit given Bz ,

Computation of equation (2).

⇒ A7 value for Q = 3 and A8 for Q = 11

Summary

The security and robustness of a cancelable biometric system are

characterized by an eight-dimensional vector (Ai, i = 1, . . . , 8)

christophe.rosenberger@ensicaen.fr (GREYC) Evaluation of cancelable systems IBPC 2012 15 / 23
Outline

1 BioHashing algorithm

2 Evaluation framework

3 Experimental results

Protocol

Robustness to attacks

Summary

4 Conclusion & perspectives

christophe.rosenberger@ensicaen.fr (GREYC) Evaluation of cancelable systems IBPC 2012 16 / 23
Experimental protocol

Benchmark databases

PolyU FKP Database Lin Zhang, 2009 :

4 fingers of 165 volunteers, each individual

has provided 12 images,

FVC2002 benchmark Maio et al., 2002

(dB3) :

composed of 8 fingerprints (resolution 355 x

390 pixels) for 100 individuals.

christophe.rosenberger@ensicaen.fr (GREYC) Evaluation of cancelable systems IBPC 2012 17 / 23
Experimental protocol

Benchmark databases

PolyU FKP Database Lin Zhang, 2009 :

4 fingers of 165 volunteers, each individual

has provided 12 images,

FVC2002 benchmark Maio et al., 2002

(dB3) :

composed of 8 fingerprints (resolution 355 x

390 pixels) for 100 individuals.

Feature computation

Gabor descriptors

Size : 128 parameters (16 scales, 8 orientations)

Computation : single enrolment, Hamming distance verification

christophe.rosenberger@ensicaen.fr (GREYC) Evaluation of cancelable systems IBPC 2012 17 / 23
Robustness to attacks : fingerprint case

Figure 2: Analysis on fingerprints (FVC 2002)

christophe.rosenberger@ensicaen.fr (GREYC) Evaluation of cancelable systems IBPC 2012 18 / 23
Robustness to attacks : FKP case

Figure 3: Analysis on finger knuckle prints (POLY FKP)

christophe.rosenberger@ensicaen.fr (GREYC) Evaluation of cancelable systems IBPC 2012 19 / 23
Evaluation results

Synthesis

Evaluation is done on a functionning point,

The more a priori information the attacker knows, the more the

attack is efficient,

It is possible to compare attacks (same algorithm and biometric data).

Modalities A1 A2 A3 A4 A5 A6 A7 A8

Fingerprint 1.0 0 0 0 0 0.44 0 0

FKP 0.10 0.25 0.15 0.54 0.25 0.58 0.51 0.59

Table 1: Evaluation results of the cancelable biometric systems.

christophe.rosenberger@ensicaen.fr (GREYC) Evaluation of cancelable systems IBPC 2012 20 / 23
Outline

1

2

3

BioHashing algorithm

Evaluation framework

Experimental results

4 Conclusion & perspectives

christophe.rosenberger@ensicaen.fr (GREYC) Evaluation of cancelable systems IBPC 2012 21 / 23
Conclusion & perspectives

Contributions

Evaluation framework for cancelable biometric systems,

Simulation of different attacks,

Illustration on a FKP and fingerprint generic biometric system.

christophe.rosenberger@ensicaen.fr (GREYC) Evaluation of cancelable systems IBPC 2012 22 / 23
Conclusion & perspectives

Contributions

Evaluation framework for cancelable biometric systems,

Simulation of different attacks,

Illustration on a FKP and fingerprint generic biometric system.

Perspectives

More complex attacks

⇒ generation of the biocode based on the listening attack

⇒ impact of the random generator

christophe.rosenberger@ensicaen.fr (GREYC) Evaluation of cancelable systems IBPC 2012 22 / 23
Questions

http ://www.epaymentbiometrics.ensicaen.fr/

christophe.rosenberger@ensicaen.fr (GREYC) Evaluation of cancelable systems IBPC 2012 23 / 23