Security and Privacy in Biometric Systems -

The purpose of Biometric Encryption NIST INTERNATIONAL BIOMETRIC PERFORMANCE CONFERENCE, March 1-5, 201Tom Kevenaar Kevenaar Joint BSI-project with: Ulrike Korte (BSI), Matthias Niesing (secunet), Johannes Merkle (

www.p
Overview 

• High level overview of a biometric system • A perfectly private biometric system • The purpose of Biometric Encryption 
High level overview of a biometric system 

Enrolment Enrolment Ve

Ve

SENS SFE COMP F

STOR 

T 

Accept/Reject 
replay, tampering 

spoofing spoofing, 

SENS S

stealing spoofing, masquerade spoofing, masquerade, similarity 

l

FE F

rep ay, 

COMP 

tampering replay, tampering wire tapping wire tapping 

STOR 

T 

replay, tampering 

replay, 

tampering 

substitution copying 

wire tapping 

STOR 

ecuriS t d i l biliti 

High level overview of a biometric system S ity and privacy vulnerabilities 

Enrollment Ver

Accept/Reject 
ecuriS t d i l biliti 

High level overview of a biometric system S ity and privacy vulnerabilities • Security (ingoing arrows) defines how difficult it is to illegitim

accepted by the system. 

• Privacy (outgoing arrows) is related to the difficulty to obtain 

relevant information from a provided biometric characteristic a verification decision. 

See also: •ISO/IEC JTC1 SC27 2ndCD 24745 – Biometric information protection. •Jeroen Breebaart Jeroen Breebaart , Bian Yang Ileana Buhan , Ileana Buhan -Dulman, Christoph Christoph Busch: B Busch: Biometric iometric template template protection, the need for open standards. Datenschutz und Datensicherheit - DuD, Volume 33, No 5, May 2009, Vieweg Verlag, pp299-304. 
A Perfectly Private Biometric system 

Enrolment Verifica

SENS SENFE COMP FE STOR 

T PPB sys

PPB sys

Accept/Reject 
A pract

A Perfectly Private Biometric system 

A ti l i l t ti cal implementation 

• This PPB system is perfectly private in the sense that it outp

minimal required amount of information in the form of a binaAccept/Reject decision. 

• Furthermore, assuming a sensor leaving no latent prints (e.g

touchless sensor), the system has no eavesdropping vulner

• The system is The system is not perfectly secure not perfectly secure because the comparator 

because the comparator 

occasionally make a wrong decision. 

• All vulnerabilities can be solved using standard encryption te

without the need for long-term secrets except the protection biometric information 
A pract

A Perfectly Private Biometric system 

A ti l i l t ti cal implementation 

Long-term secrets to protect stored biometric information • access to the secrets means access to the biometric informa• secrets must be protected 

– by the system owner (which assumes that the owner ca

trusted) 

– by the user (secret is password, passphrase, stored on 

No duplicate check possible 
T 

STOR COMP 

PPBE system 

Accept/Reject 

FE

A P f tl P i t Bi t i E ti 

The purpose of Biometric Encryption 

A Perfectly Private Biometric Encryption system 
The purpose of Biometric Encryption 

• The purpose of Biometric Encryption is to implement a PPB

or, 

The goal of Biometric Encryption technology is to prevent 

biometric in

formation to be obtained 

from storage 

facilities 

systems without the need for long-term secrets. 
Conclusion 

• All vulnerabilities of a biometric system can be solved using 

cryptographic techniques without long-term secrets 

• The only exception is protecting stored biometric information 

requires long-term secrets 

• The goal of Biometric Encryption technology is to prevent re

biometric information to be obtained from storage facilities in systems without the need for long-term secrets. 

www.p