Biometrics & Security Seminar Fingerprint-based Fuzzy Vault: Implementation and Performance Based on the journal article of K. Nandakumar, A. K. Jain and S. Pankanti Presenter: Marko Pascan Seminar instructors: Laila El Aimani and Deniz Sarier B-IT Bonn, 14.12.2009
Contents Cryptography Vs Biometric Cryptosystems Motivation for Fuzzy Vault Background and Definitions Fuzzy Vault Fingerprint Fuzzy Vault Proposed Implementation Helper Data and Fingerprint alignment Experimental Results Vulnerability of Fuzzy Vault Conclusion
Contents Cryptography Vs Biometric Cryptosystems Motivation for Fuzzy Vault Background and Definitions Fuzzy Vault Fingerprint Fuzzy Vault Proposed Implementation Helper Data and Fingerprint alignment Experimental Results Vulnerability of Fuzzy Vault Conclusion
Cryptography Vs Biometric Cryptosystems Traditional cryptography Widely used, high, proven security Assumption : cryptographic keys are only known to legitimate user (keys must be kept secret) AES, RSA, ... Encryption: C = E KE (P) (P-plain text, KE-encryption key) Decryption: P = D KD (C) (C-cipher text, KD-decryption key) Need long keys, e.g. 128 bits for AES Main challenge : maintain the secrecy of the keys Store keys in a secure location, use alternative auth. mechanism (e.g. password based auth.) to control access to keys Problem : passwords stolen or forgotten Password problem: Simple password: easy to remember, compromise security Complex password: difficult to remember, expensive to maintain [1]
Cryptography Vs Biometric Cryptosystems (contd.) Alternative: biometric authentication Identity established based on anatomical and behavioral traits: face, fingerprint, speech (voice), eye (iris), hand, etc Stronger: biometric traits cannot be lost or forgotten Biometric Cryptosystems Biometrics Cryptography
Contents Cryptography Vs Biometric Cryptosystems Motivation for Fuzzy Vault Background and Definitions Fuzzy Vault Fingerprint Fuzzy Vault Proposed Implementation Helper Data and Fingerprint alignment Experimental Results Vulnerability of Fuzzy Vault Conclusion
Motivation for Fuzzy Vault Security and privacy of biometric systems major issue How robust is the system against attacks? What happens if biometric template is stolen? Can privacy of the users be preserved when a security breach occurs? Protect the user template (stored locally or centrally) Need method that can compensate for intra- class variations in the biometric data (samples of biometric traits obtained over a period of time): different angles, amounts of pressure, chapped skin, etc.
Contents Cryptography Vs Biometric Cryptosystems Motivation for Fuzzy Vault Background and Definitions Fuzzy Vault Fingerprint Fuzzy Vault Proposed Implementation Helper Data and Fingerprint alignment Experimental Results Vulnerability of Fuzzy Vault Conclusion
Background and Definitions Fingerprint Unique, immutable for each individual Made of a series of ridges and furrows on the surface of the finger Uniqueness of a fingerprint can be determined by the pattern of ridges and furrows as well as the minutiae points Minutiae points are local ridge characteristics that occur at either a ridge bifurcation or a ridge ending. y x Matching of two fingerprints. Illustration of Input fingerprint Fingerprint with minutiae intra-class variability [2]
Background and Definitions (contd.) Finite Field (Algebra) Galois field -a field that contains finitely many elements Example: Galois Field with (cardinality) 65536 elements: F = GF (2 16 ) In presented implementation of fuzzy vault arithmetic is done in GF (2 16 ) CRC (Cyclic Redundancy Check) Hash-function used to detect accidental changes in raw data In presented implementation of fuzzy vault 16-bit CRC code was used (CRC-16) Unordered sets Relative positions of set elements do not change the characteristics of the set, i.e. {2, -5, 1} conveys the same information as {-5, 1, 2}
Background and Definitions (contd.) Lagrange Interpolation Interpolating set of data points with a interpolation polynomial in Lagrange form (Lagrange polynomial) Formally: given a set of k +1 data points ( x 0 , y 0 ),..., (x k , y k ), where no two x j are the same, interpolation polynomial in the Lagrange form is linear combination of Lagrange basis polynomials:
Contents Cryptography Vs Biometric Cryptosystems Motivation for Fuzzy Vault Background and Definitions Fuzzy Vault Fingerprint Fuzzy Vault Proposed Implementation Helper Data and Fingerprint alignment Experimental Results Vulnerability of Fuzzy Vault Conclusion
Fuzzy Vault Introduced by Juels and Sudan (2002) Cryptographic construction designed to work with (biometric) features represented as unordered sets In brief: Alice places a secret K in a vault and locks it with unordered set A Bob uses an unordered set B to unlock the vault and access K Successful iff B and A overlap substantially [1]
Fuzzy Vault: Example 1 Alice selects a polynomial p of variable x that encodes secret k 1 (e.g fixes coefficients of p according to k ) k = (1, -3, 1), she chooses deg (p) =2: p (x) = x 2 - 3x + 1 Alice's unordered set: A = {-1, -2, 3, 2} 2 Alice computes the polynomial projections of A: 3 {A, p (A)} = {(-1,5),(-2,11),(3,1), (2,-1)} She adds some (let's say 2) randomly generated chaff points 4 that do not lie on p: C = {(0,2), (1,0)} Final point set R = {(-1,5),(-2,11),(3,1), (2,-1), (0,2), (1,0)} 5 Bob has unordered set B = {4, 2, -2, 3}. To access secret k he 6 needs to separate 3 (deg (p) + 1) genuine points from R to reconstruct p A ∩ B = {-2, 3, 2}, which is substantial overlap 7
Fuzzy Vault (contd.) Security is based on infeasibility of polynomial reconstruction problem Definition: Polynomial Reconstruction Problem 〈 i , y i 〉 } i=1..n , and Given a set of points in a finite field { x parameters n, k and w, output any polynomial p such that degree of p is less then k and p(x i )=y i for at least n-w values of index i. [3] Differently put: solve for the degree D polynomial P, given D+1 points passing through it A genuine finger can separate at least D + 1 genuine points from chaff points and use them to reconstruct P
Fuzzy Vault: Parameters r – number of points in the vault that lie on the polynomial p e.g number of minutiae that can be extracted from fingerprint s – number of chaff points -> security of the vault n – degree of polynomial p -> tolerance to errors in biometric data
Contents Cryptography Vs Biometric Cryptosystems Motivation for Fuzzy Vault Background and Definitions Fuzzy Vault Fingerprint Fuzzy Vault Proposed Implementation Helper Data and Fingerprint alignment Experimental Results Vulnerability of Fuzzy Vault Conclusion
Fingerprint Fuzzy Vault Fuzzy vault operating on the fingerprint minutiae features Minutiae represented as triplet ( u, v, Θ ) Fuzziness from the variability of biometric data Requires pre-aligned biometric templates or alignment during decoding of fuzzy vault Pre-aligned biometric templates non-realistic v assumption u
Fingerprint Fuzzy Vault: Example [5]
Contents Cryptography Vs Biometric Cryptosystems Biometric Cryptosystem Modes Motivation for Fuzzy Vault Background and Definitions Fuzzy Vault Fingerprint Fuzzy Vault Proposed Implementation Helper Data and Fingerprint alignment Experimental Results Vulnerability of Fuzzy Vault Conclusion
Proposed Implementation Uses both location of minutiae points in the image (u,v) and orientation attribute ( Θ ) -> more chaff points possible (harder to decode by attacker) u,v – indicate the row and the column indicies in the image Θ – orientation of the minutiae with respect to the horizontal axis (1 < Θ < 360 ) Generate several candidate secrets (Lagrange interpolation) and use CRC to detect correct polynomial Template and query automatically aligned before decoding (helper data) Higher computational cost – large number of interpolations
Vault Encoding 1 Obtain template minutiae set M T = {m i T }, i = 1, .., N T N T - number of minutiae in T Estimate quality of each minutia in T -> q T = {q(m i T )}, i = 1, .., N T Quality index in spatial domain: partition given image into a lattice of blocks b x b. Estimates the local coherence of gradients (gray) in non- overlapping blocks [6] Extract helper data (explained later) => template helper data H T
Vault Encoding (contd.) 2 Sort minutiae based on their quality, select best-quality minutiae Select only well-separated minutiae (unique values in field F ) – minimal distance is greater then some threshold δ 1 (configurable) where Δ(Θ i , Θ j ) = min (|Θ i , Θ j |, 360 - |Θ i , Θ j |) , β M =0.2 (determined empirically in order to eliminate as many chaff points as possible when unlocking) Selected minutiae: SM T = {m j T }, j=1, .., r Possible failure to capture (FTC) error if N T < r
Recommend
More recommend
