Proceedings of the 2012 International Conference on Wavelet Analysis and Pattern Recognition, Xian, 15-17 July, 2012

TWO-DIMENSIONAL CANCELABLE BIOMETRIC SCHEME

LU LENG1, SHUAI ZHANG2

, XUE B13, MUHAMMAD KHURRAM~

ISichuan Province Key Lab of Signal &Information Processing, Southwest Jiaotong University, Chengdu 610031, China2Information Center, Integrated Management Department, CSR Sifang Co. Ltd., Qingdao 266000, China3School of Information Science and Technology, Southwest Jiaotong University, Chengdu 610031, China

"Center of Excellence in Information Assurance, King Saud University, Riyadh, Saudi ArabiaE-MAIL: drluleng@gmail.com.mkhurram@ksu.edu.sa

Abstract:Most existing cancelable biometric frameworks are based

on one-dimensional (ID) vectors rather than two-dimensional(2D) images or feature matrices. 2D cancelable biometrics,generated directly from images of feature matrices, wereproposed based on two-directional two-dimensional fusionsparse random projection «2D)2FSRP) and two-directionaltwo-dimensional plus sparse random projection «2D)2pSRP),so the storage and computational costs are both reduced.(2D)2FSRP methods play complementary advantages of 2Dsparse random projection (2DSRP) and two-dimensionalprincipal component analysis (2DPCA) or two-dimensionallinear discriminant analysis (2DLDA), but they do not haveideal performance when all users have different tokens, so(2D)2pSRP methods were proposed to generate 2D cancelableface and palmprint. 2D cancelable face and palmprint schemes,which satisfactorily meet the requirements of cancelablebiometric, were determined by the experimental results andanalysis.

Keywords:2D cancelable biometric; (2D)2FSRP; (2D)2pSRP; 2DSRP;

Cancelable face; Cancelable palmprint

1. Introduction

Original biometrics are not changeable, so they can notbe revoked and reissued even when they are stolen.Recently, a lot of biometric identification and verificationsystems have mushroomed, so it is likely that differentdatabases store a user's same biometric template. If theuser's biometric template in one database is attackedsuccessfully, the user's biometric templates in the otherdatabases are not secure anymore. Besides, originalbiometrics are likely to leak users' private information, suchas gene defects, disease and so on. Since a user possessesonly few biometric features, e.g. two irises and one face, soit is very important to protect biometrics.

The schemes to improve biometric security and protectbiometric privacy include four main methods as follows:

978·1-4673·1535·7/121$31.00 ©2012 IEEE

(1) Information-hiding-based methodsKhan et al. proposed information-hiding-based

schemes to avoid biometrics being hacked, modified, andreused [1], [2], but the original templates have to berestored when matched.

(2) Biometric encryption methodsBiometric encryption methods can be further

categorized into two subclasses. a) The first subclass isbiometric key generation that extracts invariable featuresfrom biometric as cipher key in cryptosystem. The criticalproblem of biometric key generation is how to compromisethe contradiction between encryption sensibility andintra-user variance. Two widely used solutions are FuzzyCommitment [3] and Fuzzy Vault [4]. Moreover,Leng-Zhang developed "Dual-key-binding CancelablePalmprint Cryptosystem" to generate biometric key ofcancelable ability [5]. b) The second subclass is to encryptbiometrics to generate protected biometric templates [6].However, a lot of sophisticated classifiers are not directlyapplicable for encrypted binary biometric templates. XORoperation in encryption does not have one-way property.Besides, encrypted templates have to be restored whenmatched unless the original biometric templates are binary.

(3) Transform-based methodsThe critical problem of transform-based methods is the

balance between verification performance and security. Twocases should be considered to evaluate the verificationperformance of cancelable schemes. In best case, each userhas a unique token, that is, all users' tokens are different. Inworst case (i.e., stolen-token scenario), an imposter isalways able to steal genuine users' tokens successfully, thatis, all users' tokens are the same. Teoh et al. proposedBioHashing framework with ideal accuracy in best case [7].However, Kong et al. stated that the performance ofBioHashing degrades obviously in worst case [8].

(4) Hybrid methodsTwo or more methods are combined in hybrid methods

to improve performance [9]. The critical problems of hybrid

164

Proceedings of the 2012 International Conference on Wavelet Analysis and Pattern Recognition, Xian, 15-17 July, 2012

The experimental results in Section 3 will show thatthe verification performance of (2D)2FSRP methods is notgood in best case. Thus we proposed (2D)2pSRP methodsthat have similar verification performance to (2D)2FSRPmethods in worst case and have ideal verification

The computational cost of 2DSRP is less thanone-dimensional methods, but 2DSRP needs a mass ofcoefficients to represent cancelable biometric template.(2D)2FSRP methods need less coefficients than 2DSRP andplay complementary advantages of 2DSRP and2DPCAl2DLDA. Four methods of (2D)2FSRP, combining2DSRP with 2DPCAl2DLDA, were proposed, namely(2D)2SRPPCA, (2D)2PCASRP, (2D)2SRPLDA and(2D)2LDASRP. X and Y denote original high-dimensionalimage or feature matrix and projected low-dimensionalspace feature matrix, respectively. (2D)2FSRP methodsproject X to Y at row-direction and column-directionsynchronously with different methods by the followingformulas, respectively.

The superscript of A or B indicates the dimensionalityreduction method that generates the mapping matrix A or B.

The procedure of 2D cancelable biometric based onfour (2D)2FSRP methods can be described as follows:

Step 1. Assume the size of original biometric image ismxn. Use a token to generate a set ofpseudo-randomnumber t'uv, u=I,2, ... ,n, v=1,2,... ,d, n>d (or r'ij, i=I,2, ... ,b,j=I,2, ... ,m, m>b). r: and r', denote the entries ofT and R,respectively.

Step 2. Use a threshold r to obtain binarypseudo-random number tuv (or rij)by Formula (1).

Step 3. Generate mapping matrix ofdimensionalityreduction by 2DPCA (or 2DLDA) at row-direction (orcolumn-direction).

Step 4. Compute 2D cancelable biometric based on(2D)2FSRP by Formula (4}-Formula (7), respectively.

(2)

(3)

(4)

(5)

(6)

(7)

Y =R "bxn bxm mxn

Ybxd = A~:"mxnB:~

Ybxd =A:~"mxnB~Ybxd =A::"mxnB~:

Ybxd =A~~"mxnB~::

column-direction by Formula (3).

Ymxd ="mxnTnxd

2DSRP methods directly project the image or featurematrix X in high-dimensional space to Y inlow-dimensional space at row-direction by Formula (2) or

Assume the size of original biometric image is mxn.Use a token to generate a set ofpseudo-random number t'uv,

u=I,2, ... ,n, v=1,2,... ,d, n>d (or r'« i=I,2, ... ,b,j=I,2,... ,m,m>b). t'uv and r'ij denote the entries of T and R,respectively.

Use a threshold r to obtain binary pseudo-randomnumber tuv (or rij)by [12]:

t ={-I, if t:n, < 'Z" 7.. ={-I, if 'I; <7: (1)uv 1,if t:n, > 'Z" lJ 1,if r~ > 'Z"

2. 2D cancelable biometric schemes

methods are the possible mutual interference amongmultiple methods and intensive complexity.

The storage and computational costs are both great inexisting transform-based cancelable biometric frameworks,because a biometric image or feature matrix has to bereshaped to a vector before cancelable biometric templategeneration. We propose two-dimensional (2D) cancelablebiometric scheme to address the aforementioned problem.Because face and palmprint are widely used for biometricidentification and verification [10], [11], the experiments inthis paper are performed on face and palmprint databases.

The rest of the paper is organized as follows: Section 2elaborates 2D cancelable biometric schemes. Section 3presents the experimental results and discussions. Finallywe draw conclusions in Section 4.

2.1. 2DSRP

Two-directional two-dimensional fusion sparserandom projection «2D)2FSRP) and two-directionaltwo-dimensional plus sparse random projection«2D)2pSRP) were proposed which directly project imagesfrom high-dimensional space to low-dimensional space for2D cancelable biometric template generation. The storageand computational complexity of the two proposed schemesare less than those in existing cancelable biometric schemes.Because some advantages of principal component analysis(PCA) and linear discriminant analysis (LDA) do notbelong to random projection (RP), two proposedframeworks methods play complementary advantages of2D sparse random projection (2DSRP) and2DPCAl2DLDA. Unfortunately, (2D)2FSRP methods havenot ideal performance in best case, so (2D)2pSRP methodsare compared and selected to generate cancelable 2D faceand palmprint.

165

Proceedings of the 2012 International Conference on Wavelet Analysis and Pattern Recognition, Xian, 15-17 July, 2012

performance in best case.Four (2D)2pSRP methods are (2D)2SRPPPCA,

(2D)2pCAPSRP, (2D)2SRPPLDA and (2D)2LDAPSRP. Thefour (2D)2pSRP methods project image matrix or featurematrix from high-dimensional space X to low-dimensionalspace Z at row-direction and column-direction in turn withdifferent methods by the following formulas, respectively.

Zbxd =(A::Xmxn)B:: =YbxnB:~ (8)

Zbxd =A~ (XmxnB=) =A:~Ymxd (9)

Zbxd =(A::Xmxn)B~:=YbxnB~: (10)

Zbxd =A~~(XmxnB~::)=A~~Ymxd (11)

Where Y denotes the matrix after dimensionalityreduction by 2DSRP firstly. In (2D)2pSRP, unlike(2D)2FSRP, the dimensionality reduction matrix of 2DPCAor 2DLDA is computed by Y whose dimension has beenreduced by 2DSRP firstly, In other words, 2DPCA or2DLDA is performed after 2DSRP.

The procedure of 2D cancelable biometric based onfour (2D)2pSRP methods can be described as follows:

Step 1. ""-J Step 2. The same as (2D)2FSRP.Step 3. Computer Y by 2DSRP at row-direction (or

column-direction).Step 4. Compute 2D cancelable biometric based on

(2D)2pSRP by Formula (8)""-JFormula (11), respectively.

3. Experimental results and discussion

(2D)2SRPPLDA and (2D)2LDAPSRP. The results in Fig. 2are similar to those in Fig. 1, so the analysis ofFig. 1 is alsoavailable to Fig. 2.

From the above analysis, (2D)2LDASRP and(2D)2LDAPSRP fit to 2D cancelable face generation whend<10; while (2D)2PCASRP and (2D)2pCAPSRP fit to 2Dcancelable face generation when d>12. (2D)2SRPLDA and(2D)2SRPPLDA fit to 2D cancelable palmprint generation.Receiver operating characteristic (ROC) was employed toconfirm the verification performance when d=10.

The experiments are performed on ORL face databaseand PolyU palmprint database to evaluate the proposedmethod. The height and width are down-scaled to be thehalfof the original height and width.

Verification performance: Equal error rate (EER) wasemployed to confirm the verification performanceaccording to different dimensions after dimensionalityreduction. All EER comparisons in this section wereperformed in worst case. The size of 2D cancelablebiometric template is dxd. The x-coordinate in the Figure 1. Comparison ofEER among (2D)2FSRPmethods (worst case)following figures represents d.

Fig. 1 shows the comparison of EER among(2D)2FSRP, including (2D)2SRPPCA, (2D)2PCASRP,(2D)2SRPLDA and (2D)2LDASRP. The experiments show:

(1) (2D)2SRPLDA has lowest EER on PolyU database.(2) (2D)2SRPPCA is less stable than (2D)2PCASRP;

while (2D)2SRPLDA is less stable than (2D)2LDASRP.(3) The performance of (2D)2SRPLDA degrades

greatly with the dimension increase on ORL database.Fig. 2 shows the comparison of EER among

(2D)2pSRP, including (2D)2SRPPPCA, (2D)2pCAPSRP,

166

Proceedings of the 2012 International Conference on Wavelet Analysis and Pattern Recognition, Xian, 15-17 July, 2012

One-way property: Consider 2D cancelable biometrictemplate and sparse random projection matrix are bothknown when the token is used once. The system ofequations has infmite number of solutions, so the originalbiometric images can't be recovered even if the impostersuccessfully steals the user's 2D cancelable biometrictemplate and token.

Storage and computational cost: Assume the sizes oforiginal biometric images and 2D cancelable biometrictemplates are mxn and bxd, respectively; the length of IDcancelable biometric template is k. Table 1 and Table 2 arethe comparisons of the storage cost and computational cost,respectively. The costs are all for one user's one time 2Dbiometric template generation. Table 2 excludes thecomputational costs of 2DPCA and 2DLDA. (L) and (R)denote the left mapping matrix and the right mappingmatrix for 2D cancelable biometric generation, respectively.Three types of operation are considered, including randomnumber, multiplicative and addition. Random numbermeans the amount of the binary pseudo-random numbersgenerated by Formula (1). (2D)2FSRP methods have twocomputational costs according to the different order ofdimensionality reduction at row-direction andcolumn-direction. 2D-methods require a mass ofcoefficients for cancelable biometric templaterepresentation, so it is appropriate to employ (2D)2-methodsas 2D cancelable biometric schemes.

Figure 2. Comparison ofEER among (2D)2pSRP methods (worst case)

Fig. 3 shows the comparison of ROC among 2Dcancelable biometric schemes. (2D)2pSRP methods havethe similar performance to (2D)2FSRP methods in worstcase. (2D)2FSRP methods do not have good performance inbest case. In contrast, (2D)2pSRP methods have idealperformance in best case. Thus (2D)2pSRP methods aremore appropriate to generate 2D cancelable biometric.

Diversity: Since each user can change his/her owntoken to regenerate a set of pseudo-random numbers toconstitute random matrix, many cancelable templates canbe generated by mixing the same original biometric anddifferent random matrices. Thus many different 2Dcancelable biometric templates can be securely stored invarious databases.

Revocability/reusability: It is easy to revoke the oldcancelable template and reissue a new cancelable templatewith token update if the old cancelable template iscompromised. The similarity between the old and new 2Dcancelable templates generated by the proposed scheme inthis paper is low, so the old cancelable template is no longervalid after cancelable template update.

167

Proceedings of the 2012 International Conference on Wavelet Analysis and Pattern Recognition, Xian, 15-17 July, 2012

advantages by fusing 2DSRP and 2DPCA/2DLDA. Theperformance of (2D)2pSRP is better than that of (2D)2FSRPin best case. The feasible 2D cancelable face and palmprintschemes are determined by comparisons and analysis.

Acknowledgements

The authors would like to thank the editor andanonymous reviewers for their comments, whichsignificantly helped to improve this paper. The authorswould also like to express their sincere thanks to theBiometric Research Center at Hong Kong PolytechnicUniversity for providing us with the palmprint database.

This paper is supported by NPST Program by KingSaud University Project under Grant 09-INF883-02.

/ memory units X R T Y

IDSRP(L) mnxl kxmn 0 kxlSRP(R) IXmn 0 mnxk lxk

2D2DSRP(L) mxn bxm 0 bXn2DSRP(R) mxn 0 nxd mxd

(2D)2 (2DiFSRP mxn bxm nxd bxd [2](2D)2pSRP mxn bxm nxd bxd

Figure 3. Comparison of ROC among 2D cancelable biometricschemes

TABLE 1. COMPARISON OF STORAGE COST

TABLE 2. COMPARISON OF COMPUTATIONAL COST

I memory unitsRandom

Multiplicative Additionnumber

IDSRP(L) /eXmn mnxk (mn-I)xkSRP(R) mnxk mnxk (mn-I)xk

2D2DSRP(L) bxm bxmxn bx(m-I)xn2DSRP(R) nxd mxnxd mx(n-I)xd

(2DiSRPPCAbxmxnrbnnxd bx(m-I)xn+bx(n-I)xd

1(2DiSRPLDAbxm or or

bxmxdsmxnxd bx(m-I)xd+mx(n-I)xd

(2DipCASRPbxmxnrbnnxd bx(m-I)xn+bx(n-I)xd

(2Di 1(2DiLDASRPnxd or or

bxmxdsmxnxd bx(m-I)xd+mx(n-I)xd(2DrSRPPPCA

bxm bxmxnrbnnxd bx(m-I)xn+bx(z-I)xd1(2DiSRPPLDA(2D)2pCAPSRP

nxd bxmxd-mxnxd bx(m-I)xd+mx(n-I)xd1(2DiLDAPSRP

4. Conclusions

2D cancelable biometric framework directly projectsbiometric images or feature matrices fromhigh-dimensional space to low-dimensional space, so itreduces the storage and computational costs greatly. Since2D-methods need a mass of coefficients to representcancelable biometric template, it is appropriate to employ(2D)2-methods to generate 2D cancelable biometrictemplates. Two 2D cancelable biometric schemes, namely(2D)2FSRP and (2D)2pSRP, were employed to generate 2Dcancelable biometric template, which play complementary

References

[1] Muhammad. K. Khan, Ling Xie, and Jiashu Zhang,"Chaos and NDFT-based concealing offingerprint-biometric data into audio signals fortrustworthy person authentication", Digital SignalProcessing, Vol. 20, No.1, pp. 179-190, Jan. 2010.Muhammad. K. Khan, Jiashu Zhang, and Lei Tian,"Chaotic secure content-based hidden transmission ofbiometric templates", Chaos, Solitons & Fractals, Vol.32,No.5,pp.1749-1759,Jun.2007.

[3] A. Juels, and M. Wattenberg, "A fuzzy commitmentscheme", Proceeding of Sixth ACM Conference onComputer and Communications Security, Singapore,pp. 28-36, November 1999.

[4] A. Juels, and M. Sudan, "A fuzzy vault scheme",Designs, Codes and Cryptography, Vol. 38, No.2, pp.237-257, Feb. 2006.

[5] Lu Leng, and Jiashu Zhang, "Dual-key-bindingcancelable palmprint cryptosystem for palmprintprotection and information security", Journal ofNetwork and Computer applications, Vol. 34, No.6,pp. 1979-1989, Nov. 2011.

[6] HengJian Li, Jiashu Zhang, and Zutao Zhang,"Generating cancelable palmprint templates viacoupled nonlinear dynamic filters and multipleorientation palmcodes", Information Science, Vol. 180,No. 20, pp. 3876-3893, Oct. 2010.

[7] A.B.J. Teoh, D.C.L. Ngo, and A. Goh, "BioHashing:two factor authentication featuring fingerprint data andtokenised random number", Pattern Recognition, Vol.37, No. 11, pp. 2245-2255, Nov. 2004.

[8] A. Kong, K.H. Cheung, D. Zhang, M. Kamel, and J.You, "An analysis of BioHashing and its variants",

168

Proceedings of the 2012 International Conference on Wavelet Analysis and Pattern Recognition, Xian, 15-17 July, 2012

Pattern Recognition, Vol. 39, No.7, pp. 1359-1368,Jul. 2006.

[9] Y.C. Feng, P.C. Yuen, and A.K. Jain, "A hybridapproach for generating secure and discriminating facetemplate", IEEE Transactions on InformationForensics and Security, Vol. 5, No.1, pp. 103-107, Jan.2010.

[10] Lu Leng, Jiashu Zhang, Muhammad. K. Khan, XiChen, and K. Alghathbar, "Dynamic weighteddiscrimination power analysis: a novel approach forface and palmprint recognition in DCT domain",International Journal of the Physical Sciences, Vol. 5,No. 17, pp. 2543-2554, Dec. 2010.

[11] Lu Leng, Jiashu Zhang, Jing Xu, Muhammad. K.Khan, and K. Alghathbar, "Dynamic weighteddiscrimination power analysis in DCT domain for faceand palmprint recognition", Proceeding ofInternational Conference on Information andCommunication Technology Convergence, Jeju,pp.467-471, November 2010.

[12] D. Achlioptas, "Database-friendly random projections:Johnson-Lindenstrauss with binary coins", Journal ofComputer and System Sciences, Vol. 66, No.4, pp.671-687, Jun. 2003.

169