Christoph Busch PET for the Protection of Biometric data JRC Ispra 2008-11-14

ISO 24745 -

Biometric Template Protection

Christoph Busch 

Hochschule Darmstadt / Gjøvik University College / Fraunhofer IGD 

IBPC 2010 -Satellite Workshop II 

NIST 

March 5, 2010 

Its is time to standardize BTP 

Biometric Template Protection 

• alias {Helper Data Scheme, biotoken, biotypes, Pseudo Identities, 

Pseudonymous Identifier, Fuzzy commitment, Cancelable Biometrics, 

Biometric encryption, Biohasing, Fuzzy Vault, 

Shielding functions, Fuzzy extractors, Extended PIR, BIOCRYPTICS,} 

• All of them can be represented in a unified architecture 

! see Brebaart et al. „A Reference Architecture for Biometric Template 

Protection based on Pseudo Identities“, GI-LNI: BIOSIG 2008 

• Vendors: 

! IBM 

! Philips 

! priv-ID 

! GenKey 

! Mitsubishi 

! Hitachi 

! Sagem Securite 

! securis 

! secunet 

Christoph Busch ISO 24745 Template Protection NIST 2010-03-05 2

1 
Standardization on Template Protection 

Christoph Busch ISO 24745 Template Protection NIST 2010-03-05 3

Biometric Standardisation 

International Civil 

Aviation Organization 

Joint Technical 

Committee One 

International 

Electrotechnical 

Commission 

International Organization 

for Standardisation 

SC 17 

Cards & Personal Identification 

SC 27 

IT Security Techniques 

SC 37 

Biometrics 

TC 68 

Banking, Securities 

Financial services 

SC37 to TC68 

SC 37 Formal Liaisons 

Christoph Busch ISO 24745 Template Protection NIST 2010-03-05 4
 

 

The Process 

International Standard 

• Working Draft (WD) 

• Committee Draft (CD) 

• Final Committee Draft (FCD) 

• Final Draft International Standard (FDIS) 

• International Standard (IS) 

Issues to consider: 

• Commenting periods 

• Potentially multiple loops at one level 

• Need for mature technology 

(has been argued for Template Protection...) 

• Decisions are made on consensus 

• Need to progress 

• Five year revision cycle 

Christoph Busch ISO 24745 Template Protection NIST 2010-03-05 5

Biometric Standardisation 

Onion Layers 

• Layer 1: BDB 

! Digital representations 

of biometric characteristics 

• Layer 2: LDS 

! CBEFF Meta-data 

• Layer 3+4: 

System properties 

! Security 

! Performance 

• Layer 5: BioAPI, BIP 

! System Integration Biometric Data 

Interchange 

Formats 

LDS / 

File Framework 

Biometric Data 

Security Attributes 

Biometric Interfaces 

Biometric 

System Properties 

Societal and 

Jurisdictional Issues 

Harmonized 

Biometric Vocabulary 

SC37 WG6 

SC37 WG1 

SC17 7816-11 

Card based 

SC37 WG 2

 BioAPI 

SC37 WG4

 Biometric 

Profiles 

SC27

 Security

 24745 

SC37 WG5 

Performance 

SC27

 ( Availability, 

Integrity) 

SC37 WG2

 CBEFF 

SC37 WG3 

Christoph Busch Standards IMT 4621 6
ISO/IEC 24745 

Biometric Template Protection 

• October 2006 

! M.G. Chun and Mr. P.J. Lee were appointed as new Co-editors 

! 3rd WD had not been created 

• October 2007: Lucerne meeting 

! Discussion on refocusing the standard 

• April 2008: Kyoto meeting 

! NB commented on N6314 and accepted to 

continue with original scope (N3928rev1, 2004) 

! „.... project under its original scope“ 

• October 2008: Cyprus meeting 

! Inclusion of renewability and diversification 

• November 2009: Redmond meeting 

! 2nd CD 

Christoph Busch ISO 24745 Template Protection NIST 2010-03-05 7

ISO/IEC 24745 

Biometric Template Protection 

• Dependency to other projects 

Christoph Busch ISO 24745 Template Protection NIST 2010-03-05 

Biometric Template 

Protection 

24745 

SC27 WG5 

IdM 

Privacy 

Framework/Arch. 

E.A. Assurence 

ISO/TC 68-Finacial 

Services

 Biometrics Security 

Framework 19092 

19092:2007 

SC37 WG2 

Biometrics 

CBEFF-Part 4 

Security Block Format 

Spec. 19785-4 

SC37 WG6 

Biometrics 

Jurisdictional and 

Societal 

Considerations 24714-1 

 for Commercial 

8
Content of 2nd CD ISO 24745 

6.1 Security requirements for biometric sytems 

• 6.1.1 Confidentiality 

• 6.1.2 Integrity 

• 6.1.3 Availability 

• 6.1.4 Renewability and revocability 

... 

8.2 Biometric information privacy requirements 

• 8.2.1 Irreversibility 

• 8.2.2 Unlinkability 

• 8.2.3 Confidentiality 

• 8.2.4 Data minimization 

Christoph Busch ISO 24745 Template Protection NIST 2010-03-05 9

Threats and Countermeasures 

Against biometric system components 

• Data capture: T sensor spoofing - 

! liveness detection / multimodal biometric, challenge response 

• Signal processing: T insertion of imposter data 

! use approved algorithm 

• Comparison: T manipulation of comparison scores 

! secure server and/or client, trusted COC 

• Storage: T database compromise 

! diversification to allow renewability of biometric references 

! data separation 

! database access control 

• Decision: T hill climbing, T threshold manipulation 

! secure channel , access control 

Christoph Busch ISO 24745 Template Protection NIST 2010-03-05 10
Threats and Countermeasures 

During transmission 

• Data Capture -Signal Processing: 

! T Eavesdropping 

! T Replay 

! T Brute Force 

• Storage-Comparison 

! T Eavesdropping 

! T Replay 

! T Man in the middel 

! T Hill climbing 

• Comparison-Decision 

! T: Comparison score manipulation 

• Signal Processing-Comparison 

Christoph Busch ISO 24745 Template Protection NIST 2010-03-05 11

Security in Application Models 

Classification of system regarding storage of biometric 

references and comparison 

• Clause 7.2 

! Model A – Store on server and compare on server 

! Model B – Store on token and compare on server 

! Model C – Store on server and compare on client 

! Model D – Store on client and compare on client 

! Model E – Store on token and compare on client 

! Model F – Store on token and compare on token 

! Model G – Store distributed on token and server, compare on server 

! Model H – Store distributed on token and client, compare on client 
Christoph Busch ISO 24745 Template Protection NIST 2010-03-05 14

Consensus at Oct 2008 meeting 

Biometric Template Protection should include 

Pseudonymous Identifieres 

• Now a mature technology with various products 

! Significant progress over 1st ad 2nd WD 

• Allows renewability/revocability 

! Create new Pseudonymous Identifiers from same biometric sample 

• Prevents collisions and 

associated security / privacy risks 

• Allows a data separation principle 

! PI and AD stored in different places to 

- Enhance security 

- Puts both data subject and service provider in control 

of comparison process and revocation 

Christoph Busch ISO 24745 Template Protection NIST 2010-03-05 13

Renewable Biometric References 

Elements in the architecture 

• auxiliary data AD 

! subject-dependent data that is part of a renewable biometric reference 

and may be required to reconstruct pseudonymous identifiers during 

verification, or for verification in general 

• pseudonymous identifier PI 

! part of a renewable biometric reference that represents an individual or 

data subject within a certain context by means of a protected identity that 

can be verified by means of a captured biometric sample and the 

auxiliary data (if any) 

• supplementary data SD 

! data intended for security amplification of renewable biometric references 

by means of possession, knowledge or application-based secrets that are 

both required during enrolment and verification and are not stored with 

biometric references nor dependent on biometric characteristics, that are 

either provided by the data subject or the identity management system 
PI Framework 

• Architecture for renewable biometric references 

Pseudonymous 

Identifier Pseudonymous Pseudonymous 

Identifier Identifier 

Encoder Recoder 

Comparator 

Pseudonymous Identifier (PI) 

Christoph Busch ISO 24745 Template Protection NIST 2010-03-05 

Protected Template Structure 

Protected Template 

• Pseudonymous Identifier 

• Auxiliary Data 

! Diversification Data Pseudonymous Identifiier 

! Other data elements 

Christoph Busch ISO 24745 Template Protection NIST 2010-03-05 

15
Example Methods Generating PIs 

Table C.1 maps existing methods to ISO 24745 

Example Methods Generating PIs 
 

 

 

 

 

 

 

 

Christoph Busch ISO 24745 Template Protection NIST 2010-03-05 20

Example Methods Generating PIs 

Table C.1 Suggested add-ons to examples 

References 

[1] Sutcu, Y, Sencar, H.T., and Memon, N. "A secure biometric authentication scheme based on robust 

hashing," Proc. of ACM Multimedia and Security Workshop. New York, USA, 111-116 (2005). 

[2] Teoh, A. B. J., Goh, A., and Ngo, D. C. L. "Random multispace quantization as an analytic mechanism 

for BioHashing of biometric and random identity inputs," IEEE Trans. on Pattern Analysis and Machine 

Intelligence, 28(12), 1892–1901 (2006). 

[3] GenKey. “System, portable device and method for digital authenticating, crypting and signing by 

generating short-lived cryptokeys,” US Patent 2006/0198514A1. 

[4] T. E. Boult, W. J. Scheirer, R. Woodworth, “Revocable fingerprint biotokens: accuracy and security 

analysis,” in Proc. IEEE Inter. Conf. on Comput. Vis. & Patt. Recog, USA, 2007. 

[5] Q. Li, Y. Sutcu, N. Memon, “Secure Sketch for Biometric Templates,” Advances in Cryptology – 

ASIACRYPT 2006. 

[6] B. Yang, C. Busch, P. Bours, and D. Gafurov, “Robust Minutiae Hash for Fingerprint Template 

Protection,” SPIE Media Forensics and Security, Electronic Imaging, Jan.17-21, San Jose, USA, 

2010. 

Current Status 

• SC27 WG5 Redmond meeting 

addressed numerous comments -

also from SC37 

• Latest 2nd CD 24745 

• Comments are due: April 8, 2010 
Contact 

Christoph Busch ISO 24745 Template Protection NIST 2010-03-05 21