How to Evaluate Transformation Based Cancelable Biometric Systems? - PowerPoint PPT Presentation

How to Evaluate Transformation Based Cancelable Biometric Systems? R. Belguechi, E. Cherrier and C. Rosenberger GREYC Research Lab, ENSICAEN - CNRS – University of Caen, FRANCE NIST International Biometric Performance Testing Conference 2012

Context Cancelable biometric systems Privacy by design biometric systems, Two approaches : crypto-biometrics and transformation based, Pionner article : Ratha et al., 2001, BioHashing, a popular algorithm : Teoh et al., 2004, Difficult to evaluate their security. christophe.rosenberger@ensicaen.fr (GREYC) Evaluation of cancelable systems IBPC 2012 2 / 23

Context Cancelable biometric systems Privacy by design biometric systems, Two approaches : crypto-biometrics and transformation based, Pionner article : Ratha et al., 2001, BioHashing, a popular algorithm : Teoh et al., 2004, Difficult to evaluate their security. Contributions Proposition of evaluation criteria for privacy and security compliance ⇒ extension of Nagar et al., 2010, Illustrations on fingerprints and finger knuckle prints, Definition of a Matlab toolbox for the evaluation of BioHashing based cancelable systems christophe.rosenberger@ensicaen.fr (GREYC) Evaluation of cancelable systems IBPC 2012 2 / 23

Outline BioHashing algorithm 1 Evaluation framework 2 Experimental results 3 Conclusion & perspectives 4 christophe.rosenberger@ensicaen.fr (GREYC) Evaluation of cancelable systems IBPC 2012 3 / 23

Outline BioHashing algorithm 1 Evaluation framework 2 Experimental results 3 Conclusion & perspectives 4 christophe.rosenberger@ensicaen.fr (GREYC) Evaluation of cancelable systems IBPC 2012 4 / 23

BioHashing algorithm Figure 1: General principle of the BioHashing algorithm christophe.rosenberger@ensicaen.fr (GREYC) Evaluation of cancelable systems IBPC 2012 5 / 23

BioHashing algorithm christophe.rosenberger@ensicaen.fr (GREYC) Evaluation of cancelable systems IBPC 2012 6 / 23

BioHashing algorithm Properties Given the BioCode, the biometric raw data cannot be retrieved, Only the BioCode is stored, If the BioCode is intercepted, a new one can be generated, An individual can have many BioCodes for different applications, The BioHashing process improves performances. christophe.rosenberger@ensicaen.fr (GREYC) Evaluation of cancelable systems IBPC 2012 7 / 23

BioHashing algorithm Properties Given the BioCode, the biometric raw data cannot be retrieved, Only the BioCode is stored, If the BioCode is intercepted, a new one can be generated, An individual can have many BioCodes for different applications, The BioHashing process improves performances. Open questions for an attacker Is it possible to generate an admissible BioCode without the seed ? Can we predict a BioCode given previous realizations ? How different are two BioCodes generated from the same FKPcode ? ⇒ Definition of an evaluation framework. christophe.rosenberger@ensicaen.fr (GREYC) Evaluation of cancelable systems IBPC 2012 7 / 23

Outline BioHashing algorithm 1 Evaluation framework 2 Overview Notations Efficiency Non-invertibility Diversity Experimental results 3 4 Conclusion & perspectives christophe.rosenberger@ensicaen.fr (GREYC) Evaluation of cancelable systems IBPC 2012 8 / 23

Overview Security properties Performance : the template protection shall not deteriorate the performance of the original biometric system, Revocability or renewability : it shoud be possible to revoke a biometric template. Non-invertibility or irreversibility : from the transformed data, it should not be possible to obtain enough information on the original biometric data to forge a fake biometric template, Diversity or unlinkability : it should be possible to generate different biocodes for multiple applications, and no information should be deduced from their different realizations. ⇒ Definition of 8 evaluation criteria based on Nagar et al., 2010 christophe.rosenberger@ensicaen.fr (GREYC) Evaluation of cancelable systems IBPC 2012 9 / 23

Notations Verification process R z = 1 { D T ( f ( b z , K z ) , f ( ´ (1) b z , K z )) ≤ ǫ T } Where : R z : decision result for the verification of user z using the cancelable system, D T : distance function in the transformed domain, f : the feature transformation function, b z , ´ b z represent the template and query biometric features of user z , K z : set of transformation parameters, ǫ T : decision threshold. christophe.rosenberger@ensicaen.fr (GREYC) Evaluation of cancelable systems IBPC 2012 10 / 23

Efficiency property A 1 evaluation criterion A 1 = 1 − AUC ( FAR T , FRR T ) (2) AUC ( FAR O , FRR O ) where : AUC : area under the ROC curve, FRR O is the false reject rate and FAR O is the false accept rate of the original biometric system (without any template protection), FRR T is the false reject rate and FAR T is the false accept rate of the cancelable biometric system (with template protection). if A 1 > 0, the protection of the template improves the performance. christophe.rosenberger@ensicaen.fr (GREYC) Evaluation of cancelable systems IBPC 2012 11 / 23

Non-invertibility property A 2 to A 5 evaluation criteria FAR A ( ǫ T ) = P ( D T ( f ( b z , K z ) , A z ) ≤ ǫ T ) (3) Where : FAR A ( ǫ T ) : probability of a successful attack by the impostor for the threshold ǫ T . A z : generated biocode by the impostor with different methods, We can consider ǫ T = ǫ EER T ( ǫ EER T : threshold to have the EER functionning point of the cancelable biometric system). christophe.rosenberger@ensicaen.fr (GREYC) Evaluation of cancelable systems IBPC 2012 12 / 23

Non-invertibility property A priori information used by the impostor Zero effort attack ( A 2 ) : An impostor provides one of its biometric sample to be authenticated as the user z : A z = f ( ´ b x , K x ), christophe.rosenberger@ensicaen.fr (GREYC) Evaluation of cancelable systems IBPC 2012 13 / 23

Non-invertibility property A priori information used by the impostor Zero effort attack ( A 2 ) : An impostor provides one of its biometric sample to be authenticated as the user z : A z = f ( ´ b x , K x ), Brute force attack ( A 3 ) : An impostor tries to be authenticated by trying different random values of A : A z = A , christophe.rosenberger@ensicaen.fr (GREYC) Evaluation of cancelable systems IBPC 2012 13 / 23

Non-invertibility property A priori information used by the impostor Zero effort attack ( A 2 ) : An impostor provides one of its biometric sample to be authenticated as the user z : A z = f ( ´ b x , K x ), Brute force attack ( A 3 ) : An impostor tries to be authenticated by trying different random values of A : A z = A , Stolen token attack ( A 4 ) : An impostor has obtained the token K z of the genuine user z and tries different random values of b to generate : A z = f ( b , K z ), christophe.rosenberger@ensicaen.fr (GREYC) Evaluation of cancelable systems IBPC 2012 13 / 23

Non-invertibility property A priori information used by the impostor Zero effort attack ( A 2 ) : An impostor provides one of its biometric sample to be authenticated as the user z : A z = f ( ´ b x , K x ), Brute force attack ( A 3 ) : An impostor tries to be authenticated by trying different random values of A : A z = A , Stolen token attack ( A 4 ) : An impostor has obtained the token K z of the genuine user z and tries different random values of b to generate : A z = f ( b , K z ), Stolen biometric data attack ( A 5 ) : An impostor knows ´ b z and tries different random numbers K to generate : A z = f ( ´ b z , K ). christophe.rosenberger@ensicaen.fr (GREYC) Evaluation of cancelable systems IBPC 2012 13 / 23

Diversity property A 6 evaluation criterion M A 6 = 1 � � max( I ( f ( b z , K z ) , f ( b j z , K z ))) N z j =1 P ( x , y ) log( P ( x , y ) � � I ( X , Y ) = P ( x ) P ( y )) x y Where : b z : denotes the reference of the individual z in the database, z : denotes the j th test data of the individual z in the database, b j N : the number of individuals in the database, M : the number of generated biocodes for each individual, P : the estimation of the probability. christophe.rosenberger@ensicaen.fr (GREYC) Evaluation of cancelable systems IBPC 2012 14 / 23

Diversity property A 7 to A 8 evaluation criteria For each template of the genuine user : Generation of Q biocodes B z = { f ( b z , K z 1 ) , .., f ( b z , K z Q ) } for user z , Prediction of a possible biocode value by setting the most probable value of each bit given B z , Computation of equation (2). ⇒ A 7 value for Q = 3 and A 8 for Q = 11 christophe.rosenberger@ensicaen.fr (GREYC) Evaluation of cancelable systems IBPC 2012 15 / 23

Diversity property A 7 to A 8 evaluation criteria For each template of the genuine user : Generation of Q biocodes B z = { f ( b z , K z 1 ) , .., f ( b z , K z Q ) } for user z , Prediction of a possible biocode value by setting the most probable value of each bit given B z , Computation of equation (2). ⇒ A 7 value for Q = 3 and A 8 for Q = 11 Summary The security and robustness of a cancelable biometric system are characterized by an eight-dimensional vector ( A i , i = 1 , . . . , 8) christophe.rosenberger@ensicaen.fr (GREYC) Evaluation of cancelable systems IBPC 2012 15 / 23

Outline BioHashing algorithm 1 2 Evaluation framework 3 Experimental results Protocol Robustness to attacks Summary Conclusion & perspectives 4 christophe.rosenberger@ensicaen.fr (GREYC) Evaluation of cancelable systems IBPC 2012 16 / 23