University of Colorado at Colorado Springs

Remote authentication using

Vaulted Fingerprint Verification

Hamdan A. Alzahrani

A dissertation proposal submitted

in partial fulfillment of the requirement for the degree

Doctor of Philosophy

1

Remote authentication using

Vaulted Fingerprint Verification

May 2014

Advisor

Professor Terrance Boult, Chair

Dissertation Committee Members:

1. Professor C. Edward Chow2. Professor Albert Glock3. Professor Walter J. Scheirer4. Professor Mohammad Mahoor

2

Table of contents

Abstract.......................................................................................................................................................................... 5

Chapter 1: Introduction.......................................................................................................................................... 6

Chapter 2: Related Work..................................................................................................................................... 10

2.1. General Biometric Techniques............................................................................................................10

2.1.1. Representations.................................................................................................................................10

2.1.2. Quantization........................................................................................................................................13

2.1.3. Error Correcting Codes...................................................................................................................14

2.2. General Protective Techniques...........................................................................................................15

2.2.1. Cryptographic Functions...............................................................................................................15

2.2.2. Other Protections..............................................................................................................................17

2.3. Additional Functionality.........................................................................................................................17

2.4. Template Protection Systems..............................................................................................................17

2.4.1. Fuzzy Vault.......................................................................................................................................... 18

2.4.2. Fuzzy Commitment.......................................................................................................................... 20

2.4.3. Fuzzy Extractor..................................................................................................................................22

2.4.4. Other Template Protection Systems.........................................................................................24

2.4.5. Analysis................................................................................................................................................. 28

2.5. Vaulted Verification..................................................................................................................................29

2.5.1. Enrollment Process..........................................................................................................................30

2.5.2. Verification Process.........................................................................................................................30

Chapter 3: Preliminary Work............................................................................................................................ 31

3.1. Vaulted Fingerprint Verification.........................................................................................................31

3.1.1. Enrollment Process..........................................................................................................................32

3

3.1.2. Verification Process.........................................................................................................................33

3.1.3. Evaluation............................................................................................................................................ 37

3.1.4. Security.................................................................................................................................................. 39

Chapter 4: Proposed Work................................................................................................................................. 40

4.1. VFV................................................................................................................................................................... 41

4.2. VFV-PMCC..................................................................................................................................................... 41

4.3. Biotope Triangles...................................................................................................................................... 43

4.4. Biotope/Fuzzy Extractor Theory........................................................................................................44

4.5. Time line........................................................................................................................................................ 45

4.6. List of publication......................................................................................................................................45

5. References............................................................................................................................................................. 46

4

Abstract

Fingerprint biometrics are increasingly used for identity verification. However, these

require a careful balance of accuracy and privacy that is missing in many implementations.

In this proposal, I review techniques and systems for protected biometric templates,

identify several weaknesses in existing systems, and develop a research plan to improve

the quality of biometric template systems.

My research develops the Vaulted Verification (VV) system into Vaulted Fingerprint

Verification (VFV) by implementing VV on a fingerprint minutia triangle representation.

This allows for key exchange using the protected biometric template. I propose adding the

PMCC minutia neighborhood descriptor to VFV to improve accuracy.

My research will also implement Biotope on a minutia triangle representation. Currently,

Biotope uses a minutia pair representation. The minutia pair representation lacks

distinguishability, which leads to complicated matching operations. The minutia triangle

representation should improve accuracy while simplifying matching.

A formal description of Biotope as a Fuzzy Extractor will be provided if the accuracy of the

above systems is insufficient to compete with the state of the art.

5

Chapter 1: Introduction

With the rise of the Internet, remote verification of identity is an increasingly

important part of modern life. From online banking systems to personal data storage to

software as a service, most aspects of modern life require identity verification.

Current identity systems rely on passwords, encryption keys, or tokens. Passwords

are the most common identification system in current use due to ease of implementation

and administration, and user familiarity. However, passwords are vulnerable if used with

common words or patterns. Yet passwords can be easy to crack if they are poorly chosen,

and such poorly chosen passwords are common (Adams and Sasse 1999). Another method

to securing an identity is the use of cryptographic keys. These are similar to passwords, but

longer and more difficult to memorize. They are used for identity purposes when digital

storage is available, often combined with smart cards. Tokens, such as smart cards, allow a

more physical approach to identity assurance. They require physical possession of an item

to prove identity.

Each of these methods has their own strengths and weaknesses. Passwords tend to

be short and easily broken, but are also easy to replace. Encryption keys are difficult or

impossible to memorize, but provide very strong security. Tokens do not require the

memorization or outside storage of a string, but can be stolen and copied. However, all of

these methods have a similar weakness. All of them are independent of the user, and so do

not provide strong evidence for the presence of the user.

6

A solution to this problem is biometrics. By measuring and comparing a feature of

the user, we can increase the assurance that the user is present during authentication.

Automated biometric matching has been achieved with face(Andrew B J Teoh, Goh,

and Ngo 2006), iris(Wilber, Scheirer, and Boult 2012), fingerprint(Watson, Garris, and

Tabassi 2007), and other biometrics. While these systems significantly enhance identity

assurance, they have their own difficulties. Biometric features are inherently static. A

change to a biometric often requires a long time or a significant injury. Large databases of

biometric features are vulnerable to the “Birthday Problem”(Wagner 2002), sometimes

referred to as the doppelganger threat (T. Boult 2007).

The static nature of biometrics has advantages and weaknesses. It is what allows it

to be used as an identification mechanism. Most features are constant enough to be used

for years or decades without update. However, the unchanging nature also puts biometric

templates at high risk of compromise. Once a biometric is compromised to an attacker, the

feature may not uniquely identify the user. An attacker with access to an unprotected

biometric template can create a physical copy, such as a gummy finger (Matsumoto et al.

2002). Alternatively the attacker can directly use the template identify as legitimate user,

especially in remote applications.

With the rise of large databases of biometric features, the doppelganger threat

becomes significant. As with the Birthday Problem, the probability of there being a match

between any two users in a large system can be high. When this problem is applied to

biometrics, it is referred to as the doppelganger threat. Once an attacker finds a match

among a large set of users, they can masquerade as that person.

7

These two threats guide the design of a well-protected biometric identification

system. The system must protect the biometric against being revealed, since the biometric

is permanently compromised if an attacker ever gains it. This system must also allow for

revocation and reissue of unique templates.

Template protection should have the following requirements (A. K. Jain, Nandakumar, and

Nagar 2008):

A. Diversity: The secure template must not allow cross-matching across databases,

thereby ensuring the user’s privacy.

B. Revocability: It should be straightforward to revoke a compromised template and

reissue a new one based on the same biometric data.

C. Security: It must be computationally hard to obtain the original biometric template

from the secure template. This property prevents an adversary from creating a

physical spoof of the biometric trait from a stolen template.

D. Performance: The biometric template protection scheme should not degrade the

recognition performance (FAR and FRR) of the biometric system.

The field of protected biometric templates is rapidly progressing. While systems

need both security and accuracy, security aspects are difficult to compare. Examples of

state of the art in terms of accuracy can be found at FVC Ongoing (Dorizzi et al. 2009).

Currently, protected biometric systems lack several desirable features. First,

existing systems lack accuracy at necessary security levels. Second, there are few effective

biometric systems that allow key exchange. Finally, most existing biometric template

8

protection systems lack strong theoretical foundations. My thesis will make progress in

closing these critical gaps. I will develop: a system for biometric remote authentication and

key exchange, extend this system to compare with the state of the art, extend Biotope to a

minutia triangle representation, and, as necessary, give a formal description of Biotope as a

Fuzzy Extractor.

To understand the benefits and difficulties of this thesis, I first examine common

techniques in the creation and protection of biometric templates in section 2.1. General

Biometric Techniques. In section 2.4. Template Protection Systems, I examine select papers

from the literature to show how these techniques are used. In section 2.5. Vaulted

Verification, I outline a detailed method of sending messages using a biometric called

Vaulted Verification. In section 3.1. Vaulted Fingerprint Verification, I discuss my recent

work on integrating Vaulted Verification with fingerprint biometrics. Finally, in section

Chapter 4: Proposed Work, I discuss my plans to improve system accuracy, protect the

biometric, and prove the protections used.

9

Chapter 2: Related Work

Biometric data needs to be protected in such a way that allows authentication while

preserving privacy. Effective biometric protections work best on clear representations of

the data, which form an important basis for protected templates. These representations can

then be protected by a variety of methods. Additional functionality is commonly included in

the protected template to allow key binding, key generation, and remote authentication.

2.1. General Biometric Techniques

Inter-user variability needs to be addressed. This variability could be resulted from

fingerprint displacement, fingerprint pressure, non-liner distortions, etc. To alleviate this

problem, it is important to have a representation that provides high discriminatory

information for the fingerprint.

2.1.1. Representations

The system that is used to represent minutia strongly influences how the biometric

data is protected. For example, protecting bitstring is different from protecting vectors. The

biometric data for minutia-based systems is often initially represented in a coordinate

system derived from the image (Watson, Garris, and Tabassi 2007). These coordinates are

generally unsuitable for protected templates due to biometric sampling errors. The

primary methods for managing these errors are global alignment, local alignment, and

invariant representations.

10

2.1.1.1. Global Alignment Representations

Global matchers attempt to match minutia within a common coordinate system.

This requires finding a transformation (translation and rotation) between the gallery and

probe coordinates, which maximizes the number of overlapping minutia. The advantage of

this method is conceptual simplicity; minutiae are identified if their location and additional

data match. The disadvantage is that the coordinate system alignment requires common

information (commonly core, delta, or singular point(s)) that must be available. Failure to

recover or identify the data in probe, results in false rejections.

Global alignment representations are uncommon in current work. (Ahmad 2012)

examines global coordinate system transformations to protect templates. (Arakala, Jeffers,

and Horadam 2007) uses a core-point aligned coordinate system. (Nagar, Nandakumar, and

Jain 2009) uses high curvature points to align the coordinate system. (Kaizhi and Aiqun

2013) uses the core point aligned FingerCode (A. Jain et al. 1999) as a base representation.

2.1.1.2. Local Alignment Representations

Local alignment representations attempt to find a transformation between

coordinate systems on (small) regions of the images. On fingerprints, this is usually done

with respect to a minutia at the center of the region. The position and orientation of the

minutia are used as a coordinate system for the region. Since the common information

needed is trivial (ex. every minutia is a center of a coordinate system), these are often

referred to as “alignment-free” representations. Local alignment is robust against non-

linear distortions. (Ahmad 2011; Arakala, Jeffers, and Horadam 2007; Cappelli, Ferrara, and

11

Maltoni 2010; Ferrara, Maltoni, and Cappelli 2012) use local alignment to identify

neighboring minutia. (Jin et al. 2012; D. Moon et al. 2007) identify all minutiae with respect

to each minutia.

2.1.1.3. Invariant Representation

Invariant structure representations attempt to avoid issues of alignment by

constructing invariant representations from each image. These invariant representations

are then used to match the images. An example of an invariant structure is the distance

between two points; distance is independent of rigid changes to the coordinate system

used to describe the points. However, individual invariant representations are not

sufficiently distinguishable. To overcome this, they are often grouped into larger

structures.

These representations generally produce a feature vector containing some relations

derived from the structure. For minutia pairs, this can be the distance between the points

(d) and the relative orientations (o1, o2) forming a vector [d, o1, o2]. A triangle feature vector

may contain 3 pair distances, 3 internal angles, and 3 relative orientations. Larger

structures have similar vectors with more elements, and other relationships may be

included.

(T. Boult 2007; Das, Karthik, and Chandra Garai 2012; Jin 2010) uses a pair

representation. (X. Chen et al. 2006; Zheng, Gao, and Zhang 2009; Jin et al. 2009; Jin et al.

2013; S. Wang and Hu 2014; P. Li et al. 2012; Parziale and Niel 2004) use generic triangles.

12

(Chau and Soto 2011; Júnior 2010; W Yang et al. 2013; Wencheng Yang, Hu, and Wang

2012) use Delaunay triangles, which restrict the triangles to a limited neighborhood.

2.1.2. Quantization

Quantization is the procedure of constraining values from a large (eg. continuous)

domain to a smaller discrete domain in a once to many map (Gray and Neuhoff 1998).

Thus, it is impossible to determine the value of a quantized number. Quantization trades

distinguishability for stability. The primary benefit of quantization is to mitigate the

distortion problem. The disadvantage of quantization is the loss of discriminability.

Examples include truncation (ex. 1.6 to 1), and rounding (ex 1.6 to 2).

(Wencheng Yang et al. 2014; Jin et al. 2012; P. Li et al. 2012; Andrew Beng Jin Teoh

and Kim 2007; B. Yang et al. 2010; R. Wang et al. 2010; Kaizhi and Aiqun 2013;

Mirmohamadsadeghi and Drygajlo 2013) quantize bitstrings derived from representations.

(Hartloff et al. 2013; T. Boult 2007; Júnior 2010; Arakala, Jeffers, and Horadam 2007;

Nandakumar 2007; S. Wang and Hu 2014; Jin 2010; Jin et al. 2009; D. Moon et al. 2007;

Nagar, Nandakumar, and Jain 2009)quantize features.(Ahmad 2012; Jin et al. 2012; Zhang

et al. 2013; A. Jain et al. 1999)quantize based on coordinate grids.(Wencheng Yang et al.

2014; Jin et al. 2012; P. Li et al. 2012; Andrew Beng Jin Teoh and Kim 2007; B. Yang et al.

2010; R. Wang et al. 2010; Kaizhi and Aiqun 2013; Mirmohamadsadeghi and Drygajlo

2013) quantize bitstrings derived from representations. (Hartloff et al. 2013; T. Boult 2007;

Júnior 2010; Arakala, Jeffers, and Horadam 2007; Nandakumar 2007; S. Wang and Hu

2014; Jin 2010; Jin et al. 2009; D. Moon et al. 2007; Nagar, Nandakumar, and Jain

13

2009)quantize feature vectors.(Ahmad 2012; Jin et al. 2012; Zhang et al. 2013; A. Jain et al.

1999)quantize based on coordinate grids.

2.1.3. Error Correcting Codes

Another method of managing errors is error correction codes. These are more

specialized than quantization in that they require bitstring representations. However,

unlike quantization, error correction codes do not reduce distinguishability. Error

correction codes trade message length for stability. Error correction codes are the basis for

Fuzzy Commitment and are closely related to Fuzzy Extractors, both of which are discussed

in more detail below.

Error correction codes utilize redundant bits to find and correct errors in a bitstring,

up to an error correction capacity. In forward error correction, these redundant bits are

added to the message, increasing its length. When used in biometrics, the redundant bits

can be sent separately to the matcher as helper data. Error correction codes can be made

with a variety of message length and error correction capacities.

(P. Li et al. 2012; Wencheng Yang et al. 2014; Wencheng Yang, Hu, and Wang 2012;

Fan and Lin 2009; Nagar, Nandakumar, and Jain 2009; Jin et al. 2012; Kaizhi and Aiqun

2013; Arakala, Jeffers, and Horadam 2007; Andrew Beng Jin Teoh and Kim 2007) use error

correction codes on the biometric. (Johnson, Scheirer, and Boult 2013; W Scheirer and

Boult 2009; Nandakumar 2007; Bringer, Chabanne, and Favre 2012) use error correction

codes to correct a message as part the authentication process.

14

2.2. General Protective Techniques

2.2.1. Cryptographic Functions

It is very difficult to make standard cryptography work with biometrics despite its

power to protect secrets. The noisy nature of biometrics conflicts with cryptographic

functionality (e.g. Avalanche effect). Additionally, the privacy risks associated with

biometrics make cryptographic hashes a better fit. Despite these difficulties, there are some

approaches that protect the temp late by applying standard cryptography.

2.2.1.1. Symmetric Encryption

Symmetric key cryptography methods use the same key for encryption and

decryption. The simplest method of symmetric encryption is through combining the

message with a random string (key) by XOR operation. If the key is random, this is the one-

time pad and provides provable security. This method is vulnerable to key reuse; using the

key to encrypt two messages makes recovering the key and the messages trivial.

Exclusive OR (XOR) operation is used as a protection method in (Fan and Lin 2009;

Nagar, Nandakumar, and Jain 2009; Zhang et al. 2013; Kaizhi and Aiqun 2013; Arakala,

Jeffers, and Horadam 2007). XOR operation is used in (Fan and Lin 2009), (Kaizhi and

Aiqun 2013) to combine the template and challenge.

Another approach to symmetric key cryptography is algorithmic. These systems can

allow keys to be used with multiple messages. Algorithmic methods are often quite

complicated, see (Stallings 2011) for more details. Algorithmic symmetric key encryption is

15

used by (T. Boult 2007) to encrypt the quantized value so that preform matching is in the

encrypted domain.

2.2.1.2. Public Key Encryption

Public key cryptography, or asymmetric cryptography, uses separate keys for

encryption and decryption. This allows communication across unsecured channels without

the need of an initial shared secret. The disadvantages of public key cryptography are the

large key sizes. More information on public key cryptography can be found in (Stallings

2011). Public key cryptography is used in (T. Boult 2007), (Fan and Lin 2009), (Johnson,

Scheirer, and Boult 2013), (H. Li et al. 2013), (W. Scheirer, Bishop, and Boult 2010), (W

Scheirer and Boult 2009).

2.2.1.3. Cryptographic Hashes

Cryptographic hashes take a string of arbitrary length to a fixed length string in such

a way that it is non-invertible and collision resistant. It should also produce hash values

which are evenly distributed and apparently random(Stallings 2011). Cryptographic

hashes are also deterministic. The non-invertibility of cryptographic hashes is particularly

useful for template security due to biometric privacy concerns. The deterministic nature of

hashes can be avoided by including a random string (called a salt) in the input. This

random string can provide some security if it is kept secret.

Hash function is applied in (C.-T. Li and Hwang 2010; X. Li et al. 2011; C. Chen, Lee,

and Hsu 2012) to biometric features to release embedded secret. Hash function is used in

16

(Kaizhi and Aiqun 2013) for authentication purpose. (Kumar, Tulyakov, and Govindaraju

2010) performs matching on hashed space.

2.2.2. Other Protections

Due to the difficulty of producing stable, fixed length bitstrings that are needed for

standard encryption, protected biometric templates sometimes use alternate security

methods.

One example of a non-standard protection is biometric salting. In this method, a

secret string is used to define a transformation operation. The most notable use of this

method is in Biohashing (Andrew B J Teoh, Goh, and Ngo 2006) where the secret string

defines a projection operator.

2.3. Additional Functionality

Protected biometric templates are often imbedded within other functions that

increase their functionality. These are commonly key binding or key generating functions.

Key binding functions allow an arbitrary message to be included in a template. Examples

include Fuzzy Commitment, Fuzzy Vault, and Vaulted Verification. Key generating functions

allow a key to be produced from the biometric data; an example of this is Fuzzy Extractor.

Some systems that implement these concepts are described in more detail below.

2.4. Template Protection Systems

Understanding how techniques are used to protect biometric templates is as

important as knowing which techniques are used. Therefore, I now describe how a few

17

protected biometric template systems integrate these transformations. Two examples of

the common methods Fuzzy Vault, Fuzzy Commitment, and Fuzzy Extractor are discussed,

with one example of the Biotope system, PMCC, and a cancelable template transformation.

2.4.1. Fuzzy Vault

Fuzzy Vault binds a key to a template through the use of polynomial interpolation.

The key is used to create a polynomial. The biometric is divided into a (unordered) set of

values, which are used to evaluate the polynomial forming a point. These points are

combined with a large number of chaff points to form a vault. A probe template attempts to

identify enough correct points to reconstruct the polynomial, recovering the key. Fuzzy

Vault suffers from a large number of security flaws in its naïve application . However, many

researchers have modified the protocol to address them.

Fuzzy Vault was initially described in (Juels and Sudan 2006). Its weaknesses are

well described in (WJ Scheirer and Boult 2007). It is implemented in (Xi and Hu 2009; K. Y.

Moon and Moon 2012; Nandakumar 2007; Bringer, Chabanne, and Favre 2012; D. Moon et

al. 2007; Nagar and Chaudhury 2006; Nagar, Nandakumar, and Jain 2009; Hartloff et al.

2013). Two systems which implement Fuzzy Vault are described below.

2.4.1.1. Toward Fingerprints as Strings: Secure Indexing for Fingerprint Matching

(Hartloff et al. 2013) proposed a Fuzzy Vault-based protected template. The primary

objects are a minimum distance graph minutia descriptor and an arbitrary key. The

minimum distance graph is a graph that connects a point to its nearest neighbor. This

graph is extended until it has 5 nodes. The distance, relative angles, and minutia

18

orientations are used to create a vector used to describe the initial minutia. The vector

elements are quantized to provide error tolerance. The key is used to create a polynomial

for the Fuzzy Vault. The minimum distance graph minutia descriptors are used to

determine the vault points.

The biometric representation is protected by ambiguity (chaff) in the Fuzzy Vault.

This system was tested on FVC2002 DB1 and DB2. It achieved a 13.2% EER, or 1.5% FAR

with a 23.9% FRR. The system uses all available biometric data to produce a single match

score.

The lack of protection on the biometric representation can be overcome in Fuzzy

Vaults, as given by our next example.

2.4.1.2. A Hybrid Biometric Cryptosystem for Securing Fingerprint Minutiae Templates

(Nagar, Nandakumar, and Jain 2009) proposed a Fuzzy Vault-based protected

template using Fuzzy Commitment as additional protection. The primary objects in this

system are minutia locations and orientations, a minutia neighborhood ridge descriptor,

and an arbitrary key. A minutia ridge descriptor is a binary string derived from the ridge

pattern around a minutia. The key combined with an error detection code. The key with

error detection code is used to construct a polynomial for the Fuzzy Vault.

They use global alignment by high curvature points to align the coordinate system.

Minutia locations are used to determine the vault points. The polynomial evaluations are

protected by Fuzzy Commitment with the minutia ridge descriptors.

19

The biometric representation is protected by Fuzzy Commitment and ambiguity

(chaff) in the Fuzzy Vault. When evaluated on FVC2002 BD2, this system achieved 5% FRR

with a .01% FAR. The system uses all available biometric data to produce a single match

score.

While Fuzzy Commitment is used in this paper to protect minutia points

individually, it can also be used as the primary binding method.

2.4.2. Fuzzy Commitment

Fuzzy Commitment binds a key to a template through the use of error correction

codes. A template is treated as a translation of an arbitrary code word. A (translated) probe

template is treated as a corruption of that code word, which can be corrected to recover the

key. Fuzzy Commitment requires the storage of the translation (non-secret) helper data.

The template must also be ordered and have a fixed length.

Fuzzy Commitment was initially described in (Juels and Wattenberg 1999) and is

implemented in (Nagar, Nandakumar, and Jain 2009), (P. Li et al. 2012), (Kaizhi and Aiqun

2013). Two systems are described below which use Fuzzy Commitment.

2.4.2.1. An Enhancing Fingerprint Template Protection Method

(Kaizhi and Aiqun 2013) proposed a Fuzzy Commitment-based protected template

system. The primary features are a FingerCode (A. Jain et al. 1999) representation,

Biohashing (Andrew B J Teoh, Goh, and Ngo 2006), and BCH-based Fuzzy Commitment.

20

FingerCode is a fingerprint descriptor based around a central minutia point. It uses average

grayscale color of the image to produce a feature vector.

The authors first align the fingerprint based on fingerprint minutia. A FingerCode

feature vector is extracted from the aligned image. The feature vector is Biohashed to

produce a fixed length bitstring. This bitstring is used to bind an arbitrary code word using

Fuzzy Commitment.

This system is evaluated on FVC2002 DB2. When the Biohashing matrix is

confidential, this system achieves a 0% EER. When the matrix is public, the EER is 4.27%.

The system uses all available biometric data to produce a single match score.

While this system achieves remarkable accuracy when the Biohash projection

matrix is secret, it requires leaving fingerprint minutia unprotected for alignment

purposes.

2.4.2.2. An Effective Biometric Cryptosystem Combining Fingerprints With Error

Correction Codes

(P. Li et al. 2012) proposed a Fuzzy Commitment-based template protection system.

The primary features of this system are a minutia triangle initial representation, a set

difference binarization, an LDA dimension reduction, and a BCH-based Fuzzy Commitment.

The minutia triangles create feature vectors. The set difference binarization splits the set of

feature vectors into two subsets based on a random question. It then takes the difference of

the number of feature vectors in each subset. This produces a more stable feature vector.

21

LDA is used to reduce the length of this vector and remove correlations. The vector is then

binarized. The binary vector is used to bind an arbitrary codeword by Fuzzy Commitment.

They evaluate the system on several databases, including FVC2002 db1 and db2. For

DB1, they achieved an EER of 1.08%. For DB2, they achieved an EER of .54%. The system

uses all available biometric data to produce a single match score.

The biometric representation is protected by cryptographic hashing, as part of the

Fuzzy Commitment. However, the authors do not examine the privacy and security effects

of the LDA dimension reduction matrix.

2.4.3. Fuzzy Extractor

Fuzzy Extractor uses error correction codes and hash functions to generate a key

from a biometric template. The parity bits of an error correction code applied to the

template are stored as helper data. The template is hashed to generate a key. To regenerate

the key from a new biometric template, the parity bits are used to error correct the

template, which will then hash to the key value. Fuzzy Extractor is described in (Dodis,

Reyzin, and Smith 2004) and implemented in(Wencheng Yang, Hu, and Wang 2012;

Arakala, Jeffers, and Horadam 2007; Wencheng Yang et al. 2014).

In addition to its practical application as a biometric key generating function, (Dodis,

Reyzin, and Smith 2004) provide a solid abstract definition of Fuzzy Extractor. This

abstract definition provides a general framework for understanding many biometric

template protection systems. The abstract Fuzzy Extractor provides a powerful method of

analyzing information loss.

22

2.4.3.1 Fuzzy Extractors for Minutiae-based Fingerprint Authentication

(Arakala, Jeffers, and Horadam 2007) propose a Fuzzy Extractor-based system. The

primary features are a dual globally and locally aligned representation, polar coordinate

quantization, and a random seed. The location of each minutia is based on its relative

position to a core point, giving distance and angle with respect to the core point’s

orientation. For additional distinguishability, a minutia is also associated with its 5 nearest

neighbors, which are given by polar coordinates centered at the minutia. Both the global

and local coordinates are quantized based on a polar grid. This results in a set of binary

vectors associated to each minutia. A layered Fuzzy Extractor is used to generate a key.

First, a PinSketch is applied to the global position vector. Second, a PinSketch is applied to

the local position vectors. The resulting code word is then hashed with a random seed.

The system is protected by the Fuzzy Extractor system. The only unprotected data

are the parity bits of the error correction codes, which reveal a limited amount of

information. The system is evaluated on FVC2000. They achieved an EER of about 15%.

This poor result shows that it is possible to use Fuzzy Extractors with fingerprints in

principle, but a better representation needs to be found. The system uses all available

biometric data to produce a single match score.

2.4.3.2. An Alignment-free Fingerprint Bio-cryptosystem Based on Modified Voronoi

Neighbor Structures

(Wencheng Yang et al. 2014) propose a Fuzzy Extractor-based system. The primary

features are a minutia neighborhood representation, grid quantization, and a PinSketch-

23

based Fuzzy Extractor, and key-based polynomial. The authors create a local structure

based on the neighboring minutia points. This structure is quantized based on a local

coordinate grid, creating binary vectors. A PinSketch-based Fuzzy Extractor is used to

stabilize and protect the vectors, resulting in a hashed vector. The hashed vectors are used

to evaluate the key polynomial.

This system is evaluated on several databases, including FVC2002. They achieved an

EER of 11.84% on DB1, and 10.38% on DB2. This EER is significantly reduced when used

on only high quality images. The system uses all available biometric data to produce a

single match score. Since each element is matched independently, this system could allow

multiple permutations to send a message. However, this implementation is focused on

regenerating a fixed message.

2.4.4. Other Template Protection Systems

2.4.4.1. Biotope

Biotope is a system for creating cryptographically secure biotokens (T. Boult 2007).

In the Biotope system, a process of quantization and encryption secures the biometric.

First, each feature is quantized with the remainder saved. The integer (stable) portion is

then encrypted by any standard encryption method. The residual is saved to improve

matching accuracy with a minimal loss of private information. During matching, the

(encrypted) integer portion is binary-matched, with the residual portions distance-

matched to provide a more accurate score.

24

The primary features are a pair minutia representation, encryption, and a modified

Bozorth matcher. The pair minutia representation is generated from a list of minutia,

capturing their distance and orientations. This is quantized, with the residual retained. The

integer portion is encrypted, and both are used in the Bozorth matcher to identify similar

fingerprints.

This system is evaluated on several datasets, including FVC2000, FVC2002, and

FVC2004. On FVC2002 DB1 it has a 2.1% EER. On FVC2002 DB2 it has a 1.2% EER. All

available biometric data is used to create a single match value and token.

2.4.4.2. Bipartite Biotokens

The Biotope system described above has been extended to a key binding system in

Bipartite Biotokens (W Scheirer and Boult 2009). Similar to Biotope, this system uses a

minutia pair representation, quantization of the feature vector, and encryption. The feature

vector derived from the minutia pair representation is quantized, with remainder retained.

The integer portion is encrypted. In order to bind a key to the biotoken, the minutia pairs

are hashed and evaluated on a Reed-Solomon (RS) Polynomial that encodes the key. The RS

values are stored with the pair feature vector. To match, the user first finds possible pair

feature vector matches, and then applies a Bozorth-like matcher to reduce the set of

matched pairs. The RS evaluation points are obtained by hashing the pair data and the RS

values from the template. These are used to decode the RS polynomial and obtain the key.

Bipartite Biotokens are evaluated on FVC 2002 DB1 and DB2 in the original paper.

FRR is dependent on the size of the key encoded, and ranges from 7% for 128 bit keys to

25

37% for 1024 bit keys with 0% FAR. An improved version of Bipartite Biotoken is

evaluated in (L. Jain, Wilber, and Boult 2013) with FVC 2002 DB1a, DB2a, and DB3a and

FVC 2004 DB1a, DB2a,DB3a. On FVC 2002 DB1a, they achieved about 4% FRR at .1% FAR.

On FVC 2002 DB2a, they achieved about 7% FRR at .1% FAR.

2.4.4.3. PMCC

Minutia Cylinder Code (Cappelli, Ferrara, and Maltoni 2010) is a method for

constructing a local descriptor for a minutia. It locally aligns the coordinate system for each

minutia (central minutia) based on that minutia’s position and orientation. The vector

describes all neighboring minutia based on its relative position and orientation.

While MCC creates an effective minutia neighborhood descriptor, it reveals

information about the biometric. In (Ferrara, Maltoni, and Cappelli 2012), the authors

modify MCC by projecting most of the information about the neighboring minutia and

binarizing the result. This results in a minutia neighborhood feature in a convenient, non-

invertible bitstring form. PMCC achieves more accurate results than other biometric

protection systems at the cost of reduced security, lack of revocability

(Mirmohamadsadeghi and Drygajlo 2013), and no key binding/generation.

PMCC has lower security than other biometric cryptographic systems. Between 25%

and 30% of minutia can be recovered from the PMCC descriptor by inversion, depending

on the size of the PMCC bitstring. Comparatively, the cryptographic hashes used by Fuzzy

Commitment and Fuzzy Extractor reveal no minutia locations without a successful match.

26

PMCC does not support revocability. It cannot utilize a password or random string to

differentiate templates. Similarly, it cannot generate or release a key on a successful match.

PMCC was evaluated on FVC2002 and FVC2006. For comparison purposes, 32 bit

PMCC achieved a 6.6% EER, 14.8% FRR at .1% FAR, 19.5% FRR at 0% FAR on FVC2002

DB1, and 4.3% EER, 11.5% FRR at .1% FAR, 16.4% FRR at 0% FAR on FVC2002 DB2.

2.4.4.4. Cancelable Fingerprint Templates With Delaunay Triangle-Based Local

Structures

Yang, W., Hu, J., Wang, S., & Yang, J (W Yang et al. 2013) propose a cancelable

template using Delaunay triangle. The main features are a Delaunay triangle representation

and a non-invertable polar transformation. The Delaunay triangle representation produces

a feature vector. The feature vector is element-wise quantized. Each triangle then

undergoes a non-invertible polar transformation.

Formally non-invertible transformations, such as the one used in this example, are

not very good at protecting templates. Other key-scrambled transformation techniques are

non-invertible on a few percent of the data (T. Boult 2007). The authors of this system do

not present a security analysis.

This system was evaluated on FVC2002 DB1 and DB2. On DB1 it has a 5.9% EER. On

DB2 it has a 4% EER. All available biometric data is used to generate a single match score.

27

2.4.5. Analysis

From the techniques available to the field and these examples, we can now draw

some conclusions.

There is a strong tradeoff between system accuracy and privacy. For example,

(Kaizhi and Aiqun 2013) proposed a cancellable template system based on fuzzy

commitment. They were able to achieve an effectively 0% FAR at 0% FRR (FVC2004 DB2),

but only by having a private key and public minutia data. (P. Li et al. 2012) implement

Fuzzy Commitment. They achieved an effectively 0% FAR at 4.6% FRR (FVC2002 DB2), but

at the expense of having helper data that depended heavily on user data, leaving an

unknown amount of private biometric information public. On the other hand, systems that

accurately account for lost privacy have unusable error rates. (Wencheng Yang et al. 2014)

use Fuzzy Extractors, which reveal a bounded amount of private information, but has a FRR

of not less than 25% at near 0% FAR1. Therefore, the tradeoff between accuracy and

privacy has not been optimally solved in existing work.

Moreover, most systems use all available biometric data to create a single match

result. Any message released from the template was fixed at the time of template creation.

This problem is most severe for Fuzzy Commitment, Fuzzy Vault, and Fuzzy Extractor. For

these systems, the message must be created at registration.

Bipartite Biotokens avoid this problem by the creation of nested templates. For each

new message, a new template can be created with public key cryptography.

1 Based on ROC curve, exact numbers not provided.

28

Bipartite Biotokens are complicated by their fingerprint biometric representation,

which requires multiple layers of matching. The minutia pair representation has low

distinguishability and requires multiple methods of complicated matching algorithms.

Since the message elements are paired directly with the minutia pair elements, Bipartite

Biotokens cannot use redundancy at the representation level.

This analysis gives direction to my research. Protected biometric systems require a

better accuracy / security trade off. Since most protected biometric systems have template

dependent messages, new methods of biometric key exchange are necessary. The best

existing system for biometric key exchange, Bipartite Biotokens based on Biotope, may

benefit from an improved representation.

2.5. Vaulted Verification

Vaulted Verification (VV) (Wilber and Boult 2012) is a privacy preserving, remote

key exchange system. Unlike the key binding and key generation functions discussed above,

VV allows key binding at an arbitrary time by a remote server. The template is divided into

a number of blocks. These blocks are paired with chaff blocks and stored. The permutation

of these paired blocks stores the key. A user recovers the key by identifying the real blocks

from the chaff blocks, recovering the permutation. Protection in this system is provided by

public key encryption, which allows the template to be transmitted to a remote server. The

server can then use the protocol to verify the user. Vaulted Verification is described in

(Wilber and Boult 2012) and implemented in (Johnson, Scheirer, and Boult 2013), (Wilber,

Scheirer, and Boult 2012). The enrollment and verification process are as follows.

29

2.5.1. Enrollment Process

The user enrolls in the system by submitting the appropriate biometric modality to

the client. The client then constructs feature vectors and groups them into multiple blocks

called “real blocks.” Each real block is paired with a randomized chaff block. Each block is

independently encrypted by the user’s encryption key. The entire template is then

encrypted by the server’s encryption key.

The template becomes a group of encrypted real and chaff blocks. This allows the

server to swap blocks and create a challenge response, which is later used to authenticate a

potential user.

2.5.2. Verification Process

The user needs to prove his identity in order to access the server. The server creates

a random binary bitstring of length N, where N is the number of block pairs in the template.

The server permutes the blocks according to the bitstring created. If the bit is 1, then the

blocks are swapped. If the bit is 0, no swapping is conducted. The blocks are encrypted and

sent to the client. The client decrypts the received blocks and compares them against live

input to identify the real blocks and ultimately recover the correct bitstring.

30

Chapter 3: Preliminary Work

3.1. Vaulted Fingerprint Verification

This review of current research indicates that we can now create a communication

channel between remote sites while: providing strong evidence of a user’s identity though

biometrics, using the user-friendly fingerprint biometric, protecting the biometric data, and

having reasonable performance. To investigate this question, I build the Vaulted

Fingerprint Verification (VFV) system. VFV integrates fingerprint biometrics with VV to

send a message encoded in the biometric to a remote user. This message is used to verify

that user.

Our approach uses minutia triples as fuzzy feature representation (X. Chen et al.

2006). The minutia triangles are extracted to vectors that can be compared for a match. We

have modified the fuzzy feature representation approach by extending it into a voting

system that helps the client distinguish real blocks from chaff, which is necessary to

recover the VFV bitstring. An overview of the enrollment process is illustrated in Figure 1.

31

3.1.1. Enrollment Process

Figure 1. Enrollment process.

Fingerprint minutiae are the building blocks of VFV. We use Mindtct from the NIST

toolset (Kenneth), which outputs the x and y coordinates for the minutia, the minutia

orientation, and the quality value as illustrated in 1:

Mi ={x, y, θ, q} (1)

We eliminate low-quality minutiae and compute all possible combinations of three

minutia points to construct a set of triangles. We compute the distance, interior angle, and

invariant orientation of each triangle. The distances are ordered from largest to smallest.

Invariant orientation is the difference between the minutia orientation and the bisector of

the triangle through that point. However, not all of the triangles we construct are useful.

32

We only accept triangles whose distances are between two threshold values (10, 150).

Overly long triangles are likely to have distorted distances while short distances will distort

angles (X. Chen et al. 2006).

The accepted triangles are then permuted randomly to remove any ordering

relationship between minutia locations in the triangle set. These accepted, randomized

triangles are grouped into blocks, which give us more control over accuracy at the expense

of template size. As we will show in our experiment increasing block size increases

accuracy but consumes more triangles per bit.

Chaff triangles are constructed in the similar manner. The only difference is that the

chaff is drawn from a separate pool of subjects. Constructing chaff is critical part of the

system. We need to balance the overlap between the real and chaff triangles. This requires

us to make it difficult for an attacker to discriminate real triangles while allowing potential

users to identify themselves with high probability.

Each block is individually encrypted using user’s private key. Each real block is then

paired with a chaff block. Next, the entire template is encrypted with the server’s public

key. Then, the encrypted template is sent to the server for use in the verification process.

3.1.2. Verification Process

A user initiates the identity verification process by requesting authentication from

the server. The server decrypts the template using its key and creates a challenge bitstring

of length N, where N is the number of blocks in the saved template. The server then swaps

pairs according to the generated bitstring. If the bitstring is 1, the pair is swapped; if it is 0,

33

there is no change. The permuted template becomes encrypted with the user’s public key,

and it is sent to the client.

The client decrypts the template and matches it against a live input to recover the

bitstring. Our matching algorithm consists of four parts: score generation, vote summation,

group comparison, and key generation (bit string recovery).

A score function takes each triangle from the gallery set and probe set and outputs

a score. We use Equation 2 to compare a triangle from gallery Tg to a triangle of probe Tpr:

score={1−¿T g−T pr∨¿Threshold ,if ∨T g−T pr∨¿Threshold0 ,∧otherwise (2)

The score is summed along the probe set dimension, resulting in a triangle vote

vector. The triangle vote vector is summed along each block, which results in a Block Vote

Vector (BVV).

The BVV allows us to compare the two gallery sets. The gallery set with the larger

BVV is classified as a “real” block, and the other is classified as a “chaff” block. If the BVV is

equal for both sets, we classify the block as undetermined.

The BVV classifications for the entire set is combined with the error correction

parity bits. This allows us to recover the permutation bitstring. An overview of the

verification process is illustrated in Figure 2.

34

Figure 2. Verification process.

35

Verification process pseudo-codeThe gallery has two sets; These are referred to as Gallery (Sets)

Each Set has N blocks; These are referred to as Gallery (Set (Blocks))

Each Block has M Triangles; These are referred to as Gallery(Sets(Blocks(Triangles)))

Each Triangle has 9 elements- 3 distances, 3 interior angles, 3 orientations; These are referred to as Gallery (Sets (Blocks(Triangles(Elements))))

for each Gallery(Sets)for each Gallery(Sets(Blocks))

for each Gallery(Sets(Blocks(Triangles)))for each Gallery(Sets(Blocks(Triangles(Elements))))

for each Probe(Triangles(Elements))calculate Element Match Score as the entrywise score function between Gallery(Sets(Blocks(Triangles))) and Probe(Triangle)

calculate Pairwise Triangle Match Score as product of Element Match Scores

endendcalculate the Triangle Match Score as the sum of the Pairwise Triangle Match Scores

endcalculate Block Match Score as sum of Triangle Match Scores

endif Set1(Block Match Score) is greater than Set2(Block Match Score)

then Bitstring is 1else, if Set1(Block Match Score) is less than Set2(Block Match Score)

then Bitstring is 0else

then Bitstring is errorend if

endapply RS-ECC to Bitstring to create Corrected Bitstring

36

3.1.3. Evaluation

The proposed VFV protocol has been evaluated using data from the DB1-A of

Fingerprint Verification Competition 2002 (FVC2002) (Maio and Maltoni 2002), which

contains 8 images per person for 100 people. An implementation of VFV requires setting a

quality threshold, maximum and minimum distance thresholds, block size, and template

length, which are listed in Table 1.

Table 1. Triangle construction parameters.

Minutia quality

Min. distance Max. distance Block size Template length

25 10 150 8 255

The thresholds for the scoring function (2) were determined empirically. We

performed a grid search over a training set of the threshold space to locate the values that

maximized the distinguishability between the real and chaff triangles. The mean optimal

thresholds and standard deviation are shown in Table 2.

Table 2. Optimal threshold.

Mean Standard deviationSample

size

DistanceInterior

angleInvariant

orientationDistance

Interior angle

Invariant orientation

31.1 14.7 17.3 1.4 1.8 1.4 24

37

The accuracy of the VFV system is determined by all of the parameters listed in

tables 1 and 2. Blocking plays a critical role in accuracy. Larger block sizes improve

accuracy, which reduces the need for error correction but reduces template length. On the

other hand, a smaller block size reduces accuracy but increases template length allowing

larger keys. Larger block size increases uniqueness for block matching, suggesting

directions for future improvements.

The bitstring produced by the client is corrected by Reed-Solomon ECC with n= 255

and k=65. This allows us to correct 95 errors in any bitstring, leaving 65 bits of security.

With these parameters, VFV has an ERR of about 7.5% (Figure 3). While below the state-of-

the-art privacy-enhanced algorithms on this dataset; e.g., the 2.1%EER reported18 by Bolt et

al. in 2007, these initial experiments do suggest that VFV has potential in viable remote

authentication method. The section on future work discusses methods for improving the

system.

Figure 3: FAR and FRR curves

38

3.1.4. Security

The first layer of security is encryption. Blocks are encrypted using user’s personal

(symmetric) key. Personal encryption prevents server and attacker from reading the

contents of the template. Within the template, groups are randomly permuted by an

initialization vector so they cannot be identified. The encrypted template is digitally signed

by the user’s private key, which ensures the integrity of the template. The template is then

encrypted using the server’s encryption key. The additional layer of encryption maintains

the confidentiality of the transmitted template.

At the verification stage, the server digitally signs the permuted template with its

private key and encrypts the permuted template using the user’s public key. This ensures a

unique challenge to prevent replay attacks. The encrypted template is then sent to the user.

This ensures the integrity and confidentiality of the challenge.

We can consider different scenarios of attack upon the system. If an attacker gains

access to a server’s private key at the enrollment stage, the attacker still cannot modify the

template due to the signature.

If the user’s private key is compromised, the attacker can inject his template at the

enrollment stage. At verification, the attacker can authenticate himself as a legitimate user

while denying access to the legitimate user. Since the user can no longer authenticate, this

can be detected through verification after enrollment.

39

If both the server and user private keys are compromised, the communication

channel is no longer secure. However, the template is still protected by the user’s personal

key and by the chaff.

If the user’s personal key is compromised at the enrollment stage, the template is

protected through the server’s public key. At the verification stage, the template is

protected through the user’s private key.

If the user’s personal and private keys are compromised, the template is still

protected at the enrollment stage through the server’s public key. However, the attacker

can recover the template at the verification stage.

If all keys are compromised, the attacker has the full control over the system and

can recover the template at any stage, leaving the chaff as the final layer of protection.

Without the biometric, if the chaff is good, the attacker still has a random chance to recover

the actual key. If the attacker has also broken into the server, they don’t need the random

string to impersonate the user, but with both templates and the all keys, the attacker can

recover the triangles. We currently know of no algorithm to recover minutiae from the

triangle data, but cannot rule out that is it might be possible.

Chapter 4: Proposed Work

My proposal has 4 parts: proof of concept for VFV, improved accuracy VFV with

PMCC, Biotope applied to triangle representation, and, as necessary, a formal description of

Biotope as Fuzzy Extractor. The proof of concept section consists of my existing work on

40

VFV. Accuracy will be improved by integrating PMCC with VFV. Extending Biotope to

triangles will demonstrate proficiency with biometric protection systems. If these systems

do not work as intended, I will also give a formal description of Biotope as a Fuzzy

Extractor.

4.1. VFV

Our implementation model is discussed 3.1. Vaulted Fingerprint Verification. In that

section, we prove that it is possible to transmit a message from a server to a remote user

encoded in a template. This message is chosen after template creation. However, VFV

requires additional accuracy to compete with the state of the art. Currently, the feature

vectors are insufficiently distinguishable, and may match each other accidentally. This is

the first contribution of my thesis.

Minutia1

Minutia2

Minutia3[d2,3 a1 o1

d1,3 a2 o2

d1,2 a3 o3]

Current Feature Vector

4.2. VFV-PMCC

While VFV proves that it is possible to construct a biometric message with

fingerprints, the accuracy of the triangle representation is limited. Therefore, I propose

including PMCC descriptors (Ferrara, Maltoni, and Cappelli 2012) to the minutia. PMCC

provides a bitstring description of the minutia neighborhood, and are discussed in more

41

detail in 2.4.4.3. PMCC. These should enhance triangle distinguishability, improving

accuracy.

Minutia1

Minutia2

Minutia3[d2,3 a1 o1 PMCC1

d1,3 a2 o2 PMCC2

d1,2 a3 o3 PMCC3]

PMCC Feature Vector

Figure 4 VFV-PMCC: Triangle A compared with triangles B and C. It matches triangle B only because they have the same PMCC. Triangle C has a different PMCC, thus it will not match despite having similar distances, angles, and orientation.

42

This modification will have no conceptual changes to the VFV system. Key exchange,

bitstring error correction, and block matching are all conceptually unchanged. However, it

will significantly impact the triangle matcher function as the original elements (d, a, o) are

numbers, while the PMCC elements are bitstrings. The original elements are approximately

matched by a Euclidean distance function, but the PMCC elements will require a Hamming

distance function. Additionally, there is no obvious best method of combining these scores,

so this project will require determining the weights of PMCC and the existing elements

within the matching function. VFV with PMCC will be compared against other state of the

art systems with respect to accuracy, and security for the second contribution of my thesis.

4.3. Biotope Triangles

An effective and accurate protected biometric system has been built by Boult (T.

Boult 2007), discussed in 2.4.4.1. Biotope. The current implementation on a minutia pair

representation compares favorably with other State of the Art systems. However, the pair

representation has several limitations and may not be an optimal for Biotope.

The pair representation has limited information content (1 distance, and 2

orientation values). This provides limited distinguishability for the matcher. Additionally,

the small size makes it difficult to protect the stable values with large encryption keys, as

the protected object must be the same size as the key.

A triangle representation overcomes the weaknesses of the pair representation. The

triangle representation contains more information (3 distances, 3, angles, and 3 orientation

43

values). This will provide more distinguishability to the matcher and allow protection by

larger encryption keys.

I will construct an implementation of the Biotope system on a minutia triangle

representation. It will be compared against the existing pair-representation Biotope system

as the third contribution of my thesis.

4.4. Biotope/Fuzzy Extractor Theory

Biotope is a general concept. It has been applied to face (T. E. Boult 2006) and

fingerprint (T. Boult 2007) biometrics, and is the basis of a key binding system (W Scheirer

and Boult 2009). It functions by using a robust matcher that uses the remainder of a

quantization procedure as helper data.

Fuzzy Extractor provides a framework for understanding the amount of information

revealed by helper data. There are several useful theorems associated with Fuzzy Extractor

that allow for bounds on the information revealed by helper data.

A formal description of the relationship between Biotope and Fuzzy Extractor will

provide benefits to both systems. For Biotope, it will provide an abstract description to

ensure the groundwork for future generalizations. For Fuzzy Extractor, it will extend the

known methods of utilizing helper data.

If VFV-PMCC and Biotope Triangles are unable to compete with the State of the Art,

then the formal description of the relationship between Biotope and Fuzzy Extractor will

be the final contribution of my thesis.

44

4.5. Time line

Task Estimated timeImplement VFV-PMCC May - JuneImplement Biotope triangles July - AugustReserved for formal description of Biotope as Fuzzy Extractor. September - OctoberWriting and preparation for Thesis Defense November - December

4.6. List of publication

1. Albahdal, Abdullah A., Hamdan Alzahrani, Lalit Prithviraj Jain, and Terrance E. Boult. "Trusted BWI: Privacy and trust enhanced biometric web identities." Biometrics: Theory, Applications and Systems (BTAS), 2013 IEEE Sixth International Conference on, pp. 1-8. IEEE, 2013.

2. Alzahrani, Hamdan, and Terrance E. Boult. “Remote authentication using vaulted fingerprint verification.” To appear in Biometric and Surveillance Technology for Human and Activity Identification XI, May 2014.

45

5. ReferencesAdams, Anne, and Martina Angela Sasse. 1999. “Users Are Not the Enemy.” Communications of the ACM 42 (12) (December 1):

40–46. doi:10.1145/322796.322806. http://portal.acm.org/citation.cfm?doid=322796.322806.

Ahmad, Tohari. 2011. “Cartesian and Polar Transformation-Based Cancelable Fingerprint Template.” IECON 2011 - 37th Annual Conference of the IEEE Industrial Electronics Society (November): 373–378. doi:10.1109/IECON.2011.6119339. http://ieeexplore.ieee.org/lpdocs/epic03/wrapper.htm?arnumber=6119339.

———. 2012. “Global and Local Feature-Based Transformations for Fingerprint Data Protection” (January). http://researchbank.rmit.edu.au/view/rmit:160073.

Arakala, Arathi, Jason Jeffers, and KJ Horadam. 2007. “Fuzzy Extractors for Minutiae-Based Fingerprint Authentication.” Advances in Biometrics: 760–769. http://link.springer.com/chapter/10.1007/978-3-540-74549-5_80.

Boult, TE. 2007. “Revocable Fingerprint Biotokens: Accuracy and Security Analysis.” IEEE Conference on Computer Vision and Pattern Recognition. http://ieeexplore.ieee.org/xpls/abs_all.jsp?arnumber=4270135.

Boult, Terrance E. 2006. “Robust Distance Measures for Face-Recognition Supporting Revocable Biometric Tokens.” In Automatic Face and Gesture Recognition.

Bringer, Julien, H Chabanne, and M Favre. 2012. “Fuzzy Vault for Multiple Users.” In Progress in Cryptology, AFRICACRYPT 2012, 67–81. http://link.springer.com/chapter/10.1007/978-3-642-31410-0_5.

Cappelli, Raffaele, Matteo Ferrara, and Davide Maltoni. 2010. “Minutia Cylinder-Code: A New Representation and Matching Technique for Fingerprint Recognition.” IEEE Transactions on Pattern Analysis and Machine Intelligence 32 (12) (December): 2128–41. doi:10.1109/TPAMI.2010.52. http://www.ncbi.nlm.nih.gov/pubmed/20975113.

Chau, AC, and CP Soto. 2011. “Hybrid Algorithm for Fingerprint Matching Using Delaunay Triangulation and Local Binary Patterns.” Progress in Pattern Recognition, Image Analysis, Computer Vision, and Applications: 692–700. http://link.springer.com/chapter/10.1007/978-3-642-25085-9_82.

Chen, Chin-ling, Cheng-chi Lee, and Chao-yung Hsu. 2012. “Mobile Device Integration of a Fingerprint Biometric Remote Authentication Scheme” (April 2011). doi:10.1002/dac.

Chen, Xinjian, Jie Tian, Xin Yang, and Yangyang Zhang. 2006. “An Algorithm for Distorted Fingerprint Matching Based on Local Triangle Feature Set.” IEEE Transactions on Information Forensics and Security 1 (2): 169–177. http://ieeexplore.ieee.org/xpls/abs_all.jsp?arnumber=1634359.

Das, Priyanka, Kannan Karthik, and Boul Chandra Garai. 2012. “A Robust Alignment-Free Fingerprint Hashing Algorithm Based on Minimum Distance Graphs.” Pattern Recognition 45 (9) (September): 3373–3388. doi:10.1016/j.patcog.2012.02.022. http://linkinghub.elsevier.com/retrieve/pii/S0031320312001008.

Dodis, Yevgeniy, Leonid Reyzin, and Adam Smith. 2004. “Fuzzy Extractors: How to Generate Strong Keys from Biometrics and Other Noisy Data.” Advances in Cryptology-Eurocrypt 2004.

Dorizzi, B, M Cappelli, D Maio, D Maltoni, S Houmani, S Garcia-Salicetti, and A Mayoue. 2009. “Fingerprint and On-Line Signature Verification Competitions at ICB 2009.” In International Conference on Biometrics, 725 – 732.

Fan, Chun-i, and Yi-hui Lin. 2009. “Provably Secure Remote Truly Three-Factor Authentication Scheme With Privacy Protection on Biometrics.” IEEE Transactions on Information Forensics and Security 4 (4) (December): 933–945. doi:10.1109/TIFS.2009.2031942. http://ieeexplore.ieee.org/lpdocs/epic03/wrapper.htm?arnumber=5238635.

Ferrara, Matteo, Davide Maltoni, and Raffaele Cappelli. 2012. “Noninvertible Minutia Cylinder-Code Representation.” IEEE Transactions on Information Forensics and Security 7 (6) (December): 1727–1737. doi:10.1109/TIFS.2012.2215326. http://ieeexplore.ieee.org/lpdocs/epic03/wrapper.htm?arnumber=6307852.

46

Gray, R.M., and D.L. Neuhoff. 1998. “Quantization.” IEEE Transactions on Information Theory 44 (6): 2325–2383. doi:10.1109/18.720541. http://ieeexplore.ieee.org/lpdocs/epic03/wrapper.htm?arnumber=720541.

Hartloff, Jesse, Jimmy Dobler, Sergey Tulyakov, Atri Rudra, and Venu Govindaraju. 2013. “Towards Fingerprints as Strings: Secure Indexing for Fingerprint Matching.” 2013 International Conference on Biometrics (ICB) (June): 1–6. doi:10.1109/ICB.2013.6612973. http://ieeexplore.ieee.org/lpdocs/epic03/wrapper.htm?arnumber=6612973.

Jain, AK, Salil Prabhakar, Lin Hong, and Sharath Prankanti. 1999. “FingerCode: A Filterbank for Fingerprint Representation and Matching.” Computer Vision and Pattern Recognition 2 (11): 187–193. http://ieeexplore.ieee.org/xpls/abs_all.jsp?arnumber=784628.

Jain, Anil K, Karthik Nandakumar, and Abhishek Nagar. 2008. “Biometric Template Security.” EURASIP Journal on Advances in Signal Processing 2008 (1): 579416. doi:10.1155/2008/579416. http://asp.eurasipjournals.com/content/2008/1/579416.

Jain, Lalit, Michael J. Wilber, and Terrance E. Boult. 2013. “Issues in Rotational (Non-)invariance and Image Preprocessing.” 2013 IEEE Conference on Computer Vision and Pattern Recognition Workshops (June): 76–83. doi:10.1109/CVPRW.2013.19. http://ieeexplore.ieee.org/lpdocs/epic03/wrapper.htm?arnumber=6595857.

Jin, Zhe. 2010. “A Revocable Fingerprint Template for Security and Privacy Preserving.” KSII Transactions on Internet and Information Systems 4 (6) (December 23): 1327–1342. doi:10.3837/tiis.2010.12.020. http://www.itiis.org/tiis/download.jsp?filename=TIIS_Vol4No6P20December2010.pdf.

Jin, Zhe, Bok-Min Goi, Yong Haur Tay, and Andrew Beng Jin Teoh. 2013. “A Non-Invertible Graph-Based Hamming Embedding Transform for Fingerprint Minutiae Protection.” 2013 6th International Congress on Image and Signal Processing (CISP) (Cisp) (December): 1688–1693. doi:10.1109/CISP.2013.6743948. http://ieeexplore.ieee.org/lpdocs/epic03/wrapper.htm?arnumber=6743948.

Jin, Zhe, Andrew Beng Jin Teoh, Thian Song Ong, and Connie Tee. 2012. “Fingerprint Template Protection with Minutiae-Based Bit-String for Security and Privacy Preserving.” Expert Systems with Applications 39 (6) (May): 6157–6167. doi:10.1016/j.eswa.2011.11.091. http://linkinghub.elsevier.com/retrieve/pii/S095741741101637X.

Jin, Zhe, ABJ Teoh, TS Ong, and Connie Tee. 2009. “Secure Minutiae-Based Fingerprint Templates Using Random Triangle Hashing.” Visual Informatics: Bridging Research and Practice: 521–531. http://link.springer.com/chapter/10.1007/978-3-642-05036-7_49.

Johnson, R. C., Walter J. Scheirer, and Terrance E. Boult. 2013. “Secure Voice-Based Authentication for Mobile Devices: Vaulted Voice Verification.” Edited by Ioannis Kakadiaris, Walter J. Scheirer, Laurence G. Hassebrook, and Shishir Shah. SPIE Defense, Security, and Sensing 8712 (May 31): 87120P–87120P–13. doi:10.1117/12.2015649. http://proceedings.spiedigitallibrary.org/proceeding.aspx?doi=10.1117/12.2015649.

Juels, Ari, and Madhu Sudan. 2006. “A Fuzzy Vault Scheme.” In Designs Codes and Cryptography, 38:237–257. IEEE. doi:10.1007/s10623-005-6343-z. http://www.springerlink.com/index/10.1007/s10623-005-6343-z.

Juels, Ari, and Martin Wattenberg. 1999. “A Fuzzy Commitment Scheme.” Proceedings of the 6th ACM Conference on Computer and Communications Security CCS 99: 28–36. http://dl.acm.org/citation.cfm?id=319714.

Júnior, PRM. 2010. “A Complete System for Fingerprint Authentication Using Delaunay Triangulation.” http://www.decom.ufop.br/menotti/rp102/TrabalhoFinal-papers/02-Fingerprint.pdf.

Kaizhi, Chen, and Hu Aiqun. 2013. “An Enhancing Fingerprint Template Protection Method.” 2013 5th International Conference on Computational Intelligence and Communication Networks (September): 275–279. doi:10.1109/CICN.2013.65. http://ieeexplore.ieee.org/lpdocs/epic03/wrapper.htm?arnumber=6657999.

Kenneth, Ko. “User’s Guide to NIST Biometric Image Software (NBIS).”

Kumar, Gaurav, Sergey Tulyakov, and Venu Govindaraju. 2010. “Combination of Symmetric Hash Functions for Secure Fingerprint Matching.” 2010 20th International Conference on Pattern Recognition (August): 890–893. doi:10.1109/ICPR.2010.224. http://ieeexplore.ieee.org/lpdocs/epic03/wrapper.htm?arnumber=5596072.

Li, Chun-Ta, and Min-Shiang Hwang. 2010. “An Efficient Biometrics-Based Remote User Authentication Scheme Using Smart Cards.” Journal of Network and Computer Applications 33 (1) (January): 1–5. doi:10.1016/j.jnca.2009.08.001. http://linkinghub.elsevier.com/retrieve/pii/S1084804509001192.

47

Li, Huixian, Longfei Ju, Liaojun Pang, and Xuan Wang. 2013. “Remote Biometric Authentication Scheme with Privacy Protection” 2 (20096102120045): 455–462.

Li, Peng, Xin Yang, Hua Qiao, Kai Cao, Eryun Liu, and Jie Tian. 2012. “An Effective Biometric Cryptosystem Combining Fingerprints with Error Correction Codes.” Expert Systems with Applications 39 (7) (June): 6562–6574. doi:10.1016/j.eswa.2011.12.048. http://linkinghub.elsevier.com/retrieve/pii/S0957417411017192.

Li, Xiong, Jian-Wei Niu, Jian Ma, Wen-Dong Wang, and Cheng-Lian Liu. 2011. “Cryptanalysis and Improvement of a Biometrics-Based Remote User Authentication Scheme Using Smart Cards.” Journal of Network and Computer Applications 34 (1) (January): 73–79. doi:10.1016/j.jnca.2010.09.003. http://linkinghub.elsevier.com/retrieve/pii/S1084804510001657.

Maio, D, and D Maltoni. 2002. “FVC2002: Second Fingerprint Verification Competition.” Pattern Recognition, 2002. Proceedings. 16th International Conference On. (September): 0–3. http://ieeexplore.ieee.org/xpls/abs_all.jsp?arnumber=1048144.

Matsumoto, Tsutomu, Hiroyuki Matsumoto, Koji Yamada, and Satoshi Hoshino. 2002. “Impact of Artificial ‘Gummy’ Fingers on Fingerprint Sytems.” In Optical Security and Counterfeit Deterrence Techniques 4, edited by Rudolf L. van Renesse, 4677:275–289. doi:10.1117/12.462719. http://proceedings.spiedigitallibrary.org/proceeding.aspx?articleid=878135.

Mirmohamadsadeghi, Leila, and Andrzej Drygajlo. 2013. “A Template Privacy Protection Scheme for Fingerprint Minutiae Descriptors.” In Biometrics Special Interest Group (BIOSIG), 2013 International Conference of the. IEEE. http://ieeexplore.ieee.org/xpls/abs_all.jsp?arnumber=6617156.

Moon, Daesung, Sungju Lee, Seunghwan Jung, and Yongwha Chung. 2007. “Fingerprint Template Protection Using Fuzzy Vault.” Computational Science and Its Applications–ICCSA: 1141–1151. http://link.springer.com/chapter/10.1007/978-3-540-74484-9_100.

Moon, Ki Young, and Daesung Moon. 2012. “Biometrics Information Protection Using Fuzzy Vault Scheme.” 2012 Eighth International Conference on Signal Image Technology and Internet Based Systems (November): 124–128. doi:10.1109/SITIS.2012.28. http://ieeexplore.ieee.org/lpdocs/epic03/wrapper.htm?arnumber=6395084.

Nagar, Abhishek, and S Chaudhury. 2006. “Biometrics Based Asymmetric Cryptosystem Design Using Modified Fuzzy Vault Scheme.” Pattern Recognition 2006, 18th International Conference on 4: 2–5. http://ieeexplore.ieee.org/xpls/abs_all.jsp?arnumber=1699897.

Nagar, Abhishek, Karthik Nandakumar, and Anil K. Jain. 2009. “A Hybrid Biometric Cryptosystem for Securing Fingerprint Minutiae Templates.” Pattern Recognition Letters 31 (8) (June): 733–741. doi:10.1016/j.patrec.2009.07.003. http://linkinghub.elsevier.com/retrieve/pii/S0167865509001652.

Nandakumar, Karthik. 2007. “Fingerprint-Based Fuzzy Vault: Implementation and Performance.” Information Forensics and Security, IEEE Transactions on 2 (4): 744–757. http://ieeexplore.ieee.org/xpls/abs_all.jsp?arnumber=4378259.

Parziale, Giuseppe, and Albert Niel. 2004. “A Fingerprint Matching Using Minutiae Triangulation.” Biometric Authentication: 241–248. http://link.springer.com/chapter/10.1007/978-3-540-25948-0_34.

Scheirer, W, and T Boult. 2009. “Bipartite Biotokens: Definition, Implementation, and Analysis.” Advances in Biometrics: 775–785. http://www.springerlink.com/index/Y6854128XJ40W511.pdf.

Scheirer, W., B. Bishop, and T. Boult. 2010. “Beyond PKI: The Biocryptographic Key Infrastructure.” 2010 IEEE International Workshop on Information Forensics and Security (December): 1–6. doi:10.1109/WIFS.2010.5711435. http://ieeexplore.ieee.org/lpdocs/epic03/wrapper.htm?arnumber=5711435.

Scheirer, WJ, and TE Boult. 2007. “Cracking Fuzzy Vaults and Biometric Encryption.” Biometrics Symposium, 2007 29 (4) (April): 544–60. doi:10.1109/TPAMI.2007.1018.

Stallings, William. 2011. Cryptography and Network Security: Principles and Practice. 5th ed. Practice Hall.

Teoh, Andrew B J, Alwyn Goh, and David C L Ngo. 2006. “Random Multispace Quantization as an Analytic Mechanism for BioHashing of Biometric and Random Identity Inputs.” IEEE Transactions on Pattern Analysis and Machine Intelligence 28 (12) (December): 1892–901. doi:10.1109/TPAMI.2006.250. http://www.ncbi.nlm.nih.gov/pubmed/17108365.

48

Teoh, Andrew Beng Jin, and Jaihie Kim. 2007. “Secure Biometric Template Protection in Fuzzy Commitment Scheme.” IEICE Electronics Express 4 (23): 724–730. doi:10.1587/elex.4.724. http://joi.jlc.jst.go.jp/JST.JSTAGE/elex/4.724?from=CrossRef.

Wagner, David. 2002. “A Generalized Birthday Problem.” In Advances in Cryptography CRYPTO 2002, 288–304.

Wang, Ruifang, Xin Yang, Xia Liu, Sujing Zhou, Peng Li, Kai Cao, and Jie Tian. 2010. “A Novel Fingerprint Template Protection Scheme Based on Distance Projection Coding.” 2010 20th International Conference on Pattern Recognition (August): 886–889. doi:10.1109/ICPR.2010.223. http://ieeexplore.ieee.org/lpdocs/epic03/wrapper.htm?arnumber=5596071.

Wang, Song, and Jiankun Hu. 2014. “Design of Alignment-Free Cancelable Fingerprint Templates via Curtailed Circular Convolution.” Pattern Recognition 47 (3) (March): 1321–1329. doi:10.1016/j.patcog.2013.10.003. http://linkinghub.elsevier.com/retrieve/pii/S0031320313004093.

Watson, CI, MD Garris, and E Tabassi. 2007. “User’s Guide to Nist Biometric Image Software (nbis).” http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.152.7698.

Wilber, Michael J., and Terrance E. Boult. 2012. “Secure Remote Matching with Privacy: Scrambled Support Vector Vaulted Verification.” 2012 IEEE Workshop on the Applications of Computer Vision (WACV) (January): 169–176. doi:10.1109/WACV.2012.6163018. http://ieeexplore.ieee.org/lpdocs/epic03/wrapper.htm?arnumber=6163018.

Wilber, Michael J., Walter J. Scheirer, and Terrance E. Boult. 2012. “PRIVV: Private Remote Iris-Authentication with Vaulted Verification.” 2012 IEEE Computer Society Conference on Computer Vision and Pattern Recognition Workshops (June): 97–104. doi:10.1109/CVPRW.2012.6239222. http://ieeexplore.ieee.org/lpdocs/epic03/wrapper.htm?arnumber=6239222.

Xi, K., and J. Hu. 2009. “Biometric Mobile Template Protection: A Composite Feature Based Fingerprint Fuzzy Vault.” 2009 IEEE International Conference on Communications (June): 1–5. doi:10.1109/ICC.2009.5198785. http://ieeexplore.ieee.org/lpdocs/epic03/wrapper.htm?arnumber=5198785.

Yang, Bian, Christoph Busch, Patrick Bours, and Davrondzhon Gafurov. 2010. “Robust Minutiae Hash for Fingerprint Template Protection.” Edited by Nasir D. Memon, Jana Dittmann, Adnan M. Alattar, and Edward J. Delp III 7541 (February 4): 75410R–75410R–9. doi:10.1117/12.838998. http://proceedings.spiedigitallibrary.org/proceeding.aspx?articleid=777191.

Yang, W, Jiankun Hu, Song Wang, and Jucheng Yang. 2013. “Cancelable Fingerprint Templates with Delaunay Triangle-Based Local Structures.” Cyberspace Safety and Security: 81–91. http://link.springer.com/chapter/10.1007/978-3-319-03584-0_7.

Yang, Wencheng, Jiankun Hu, and Song Wang. 2012. “A Delaunay Triangle-Based Fuzzy Extractor for Fingerprint Authentication.” 2012 IEEE 11th International Conference on Trust, Security and Privacy in Computing and Communications (June): 66–70. doi:10.1109/TrustCom.2012.23. http://ieeexplore.ieee.org/lpdocs/epic03/wrapper.htm?arnumber=6295959.

Yang, Wencheng, Jiankun Hu, Song Wang, and Milos Stojmenovic. 2014. “An Alignment-Free Fingerprint Bio-Cryptosystem Based on Modified Voronoi Neighbor Structures.” Pattern Recognition 47: 1309–1320. http://www.sciencedirect.com/science/article/pii/S003132031300407X.

Zhang, Ning, Xin Yang, Yali Zang, Xiaofei Jia, and Jie Tian. 2013. “Generating Registration-Free Cancelable Fingerprint Templates Based on Minutia Cylinder-Code Representation.” 2013 IEEE Sixth International Conference on Biometrics: Theory, Applications and Systems (BTAS) (September): 1–6. doi:10.1109/BTAS.2013.6712731. http://ieeexplore.ieee.org/lpdocs/epic03/wrapper.htm?arnumber=6712731.

Zheng, Jian-De, Yuan Gao, and Ming-Zhi Zhang. 2009. “Fingerprint Matching Algorithm Based on Similar Vector Triangle.” 2009 2nd International Congress on Image and Signal Processing (October): 1–6. doi:10.1109/CISP.2009.5304556. http://ieeexplore.ieee.org/lpdocs/epic03/wrapper.htm?arnumber=5304556.

49