Privacy Protection in Distributed Fingerprint-based Authentication

Abstract

Biometric authentication is getting increasingly popular due to the convenience of using unique individual traits, such as ngerprints, palm veins, irises. Especially ngerprints are widely used nowadays due to the availability and low cost of ngerprint scanners. To avoid identity theft or impersonation, ngerprint data is typically stored locally, e.g., in a trusted hardware module, in a single device that is used for user enrollment and authentication. Local storage, however, limits the ability to implement distributed applications, in which users can enroll their ngerprint once and use it to access multiple physical locations and mobile applications afterwards.In this paper, we present a distributed authentication system that stores ngerprint data in a server or cloud infrastructure in a privacy-preserving way. Multiple devices can be connected and perform user enrollment or veri cation. To secure the privacy and integrity of sensitive data, we employ a cryptographic construct called fuzzy vault. We highlight challenges in implementing fuzzy vault-based authentication, for which we propose and compare alternative solutions. We conduct a security analysis of our biometric cryptosystem, and as a proof of concept, we build an authentication system for access control using resource-constrained devices (Raspberry Pis) connected to ngerprint scanners and the Microsoft Azure cloud environment. Furthermore, we evaluate the ngerprint matching algorithm against the well-known FVC2006 database and show that it can achieve comparable accuracy to widely-used matching techniques that are not designed for privacy, while remaining e cient with an authentication time of few seconds.

A Tutorial on the Interoperability of Self-sovereign Identities

“…For example, Shamir Secret Sharing allows the division of the seed phrase and recovery with n out of N parts of the seed phrase [41]. These recovery types can be used as-is or with the help of applications like SeedQuest, FuzzyVault, or the Horcrux Protocol, which help recover seed phrases by playing a game [42], use of biometric data [43], and instantiating Shamir Secret Sharing [44] respectively.…”

Mobile Cloud Computing Services Authentication Scheme

“…The messages < M 1, M 2, M 4 > are preserved as a hashed value using SHA3, and because of the difficulty of the discrete logarithm problem, inverting the one-way hash function H( •) to retrieve sensitive user information is impossible. While < M 3 > that containsthe locked fuzzy vault information is preserved without hashing but remains secure, it requires the expected attempts of the adversary to interpolate the secret with a precision of approximately 1.86 × 10 9 as calculated in [25]. This corresponds to a 30-bit security level of 1.86 × 10 9 ≈ 2 30 .…”

A fuzzy vault development based on iris images

“…Second, it was used to create fuzzy vault sets as an iris extraction algorithm based on the Independent Component Analysis (ICA). In [10], the author suggested that several models for a user be protected as a single entity. A fuzzy vault system was used to derive one multi-biometric template from individual templates.…”

“…This leaves (c s = v s -g s ) pair subsets were containing genuine pairs but include at least one pair of pairs of vaults. If the chaff vault pair is only one member of the candidate sub-set (n+1), the secret polynomial fails because the chaff vault pair does not lie on the secret polynomial [10]. The attacker doesn't know which vault pairs have genuine points, so they can only pick one sub-set, again and again, to interpolate at random.…”