Privacy-Enhancing Fingerprint Authentication Using Cancelable Templates with Passwords

Biometric-based authentication can provide strong security guarantee about the identity of users. However, security of biometric data is particularly important as the compromise of the data will be permanent. To protect the biometric data, we need to store it in a non-invertible transformed version. Thus, even if the transformed version is compromised, the actual biometric data remains safe. In this paper, we propose an approach to protect fingerprint templates by using the idea of the fuzzy vault. Fuzzy vault is a recently developed cryptographic construct to secure critical data with the fingerprint data in a way that only the authorized user can access the secret by providing the valid fingerprint. We modify the fuzzy vault to protect fingerprint templates and to perform fingerprint verification with the protected template at the same time. This is challenging because the fingerprint verification is performed in the domain of the protected form. Based on the experimental results, we confirm that the proposed approach can perform the fingerprint verification with the protected template.

Biometric Cryptography is the biometric tokenization used for authentication with public-key infrastructure (PKI). In particular, biometric cryptography provides the convenience of authentication via fingerprint, face, eye, voice, palm, etc. - with none of the risks posed by having the biometrics take the form of a shared secret. With comfort, biometric verification gives more security than as it were conventional cryptography-based confirmation. Since biometric highlights of each human being are distinctive from each other, that makes it difficult to get to in an unauthorized way and it jams the privacy at the time of verification since there's no plausibility of snooping. In this manner, these days the utilization of biometric-based confirmation has expanded and utilized in versatile, portable workstation, and numerous other gadgets are utilizing biometric-based verification and biometric information stored in biometric gadgets and programmers are exceptionally shrewd they can render biometric information, can take it, and not at all like username or password biometric information can not alter, due to unique feature of biometrics. It implies, compromising biometric information will be until the end of life, and programmers can take advantage of it, so the security of biometric information is a vital issue. This paper gives some idea about cryptography methods that are capable to secure biometric data and we have presented four cryptography methods which are Biometric Encryption, Blockchain, Cancelable biometrics, and Visual cryptography. This paper also provides some challenges, issues in biometric, and future direction.

Template-Protection-Techniken stellen eine wichtige Ergänzung zu biometrischen Systemen, um das gewünschte Sicherheitsniveau zu erreichen und die Anforderungen an den Schutz der Privatsphäre zu erfüllen. Diese Techniken ermöglichen Erneuerung und Widerruf der Referenzendaten in biometrischen Systemen. In dieser Arbeit wird ein systematisches Evaluierungsframework entwickelt, das sich an die wesentlichen Kriterien und Anforderungen an biometrische Template-Protection-Verfahren festhält. Seine Anwendbarkeit wird durch die Analyse der verschiedenen Algorithmen demonstriert. Die in dieser Arbeit präsentierte Evaluierung ist grundlegend für eine vollständige Analyse. Darüber hinaus ermöglicht es einen Nachweis der Sicherheit und Einhaltung der Privatsphäre. Es schafft eine Basis für Zertifizierung und Benchmark der Template-Protection-Verfahren.

Fingerprint recognition provides an effective user authentication solution for mobile computing systems. However, as a fingerprint template protection scheme, fingerprint fuzzy vault is subject to cross-matching attacks, since the same finger might be registered for various applications. In this paper, we propose a fingerprint-based biometric security scheme named the cancellable and fuzzy fingerprint scheme, which combines a cancellable non-linear transformation with the client/server version of fuzzy vault, to address the cross-matching attack in a mobile computing system. Experimental results demonstrate that our scheme can provide reliable and secure protection to the mobile computing system while achieving an acceptable matching performance.

Biometric cryptosystem has emerged as a promising solution in information security. Fuzzy vault is a widely accepted scheme that binding biometric data and cryptography effectively. In vault encoding, random chaff points which are not on the polynomial are added to protect genuine points. In vault decoding, query biometric data is generated to retrieve the genuine points by measuring the distance between the registered data and query data. However, because of the within-class differences and randomness of chaff points, it is difficult to distinguish the genuine data from chaff data. This paper proposes a novel 3D fuzzy vault scheme that selects unused data from template feature vector and inserts it into the genuine points. In our scheme, every point in the vault has three dimensions, two of which could be used for distance measurement. The precision of the data matching is improved by the new inserted data and genuine points could be recognized more accurately. Experimental results based on HA-BJTU database show the better performances compared to traditional fuzzy vault.

The article analyzes the personal data security issue. The authors have given historical examples of personal data security in different countries of the world, as well as the classification of personal data types. The separate considered issue is the legal regulation of the biometric personal data protection, first of all, the issue of compliance of the Federal legislation of the Russian Federation with international treaties and conventions. Based on the analysis results, the authors provide recommendations on formation of the common legal framework for internal security of the international community.

Biometric-based authentication can provide a strong security guarantee of the identity of users. However, the security of biometric data is particularly important as any compromise of the biometric data will be permanent. In this paper, we propose a secure and efficient protocol to transmit fingerprint images from a fingerprint sensor to a client by exploiting the characteristics of the fingerprint images. Because the fingerprint sensor is computationally limited, a standard encryption algorithm may not be applied to the full fingerprint images in real-time to guarantee the integrity and confidentiality of the fingerprint images transmitted. To reduce the computational workload on the resource-constrained sensor, we apply the encryption algorithm to a nonce for integrity and to a specific bitplane of each pixel of the fingerprint image for confidentiality. Experimental results show that the integrity and confidentiality of the fingerprint images can be guaranteed without any leakage of the fingerprint ridge information and can be completed in real-time on embedded processors.

The article examines the implementation of artificial intelligence (AI) technologies for processing biometric data in Ukraine’s criminal proceedings. Emphasis is placed on the potential of AI use for identifying individuals by fingerprints, facial features, voice, and other biometric characteristics, which can enhance the efficiency of investigations and evidence gathering. At the same time, a number of risks are outlined: possible algorithm errors and false matches that could lead to unjustified suspicions or arrests; the issue of reliability and transparency of AI “black box” models, whereby parties in a trial cannot verify how a result was obtained; and privacy threats associated with the mass collection and use of sensitive personal (biometric) data without sufficient legal safeguards. It is determined that current Ukrainian legislation lacks clear provisions on the admissibility of evidence obtained through AI, in particular results of automated facial recognition or other biometric identifications. The need for improving the regulatory framework is substantiated: defining the procedural status of data generated by AI; introducing criteria for verifying their accuracy (through expert assessment, validation of methods, etc.); as well as establishing special procedures for judicial oversight over the use of such technologies at the pre-trial investigation and trial stages. Examples of foreign experience are provided: in some cases U.S. courts have admitted AI-driven analyses (e.g., DNA expert reports) as evidence, whereas other rulings have excluded evidence obtained via facial recognition technologies due to concerns about their reliability and the lack of disclosure of the AI methods. At the European level, a cautious approach is observed: the European Parliament advocates significant restrictions on the use of mass biometric surveillance systems, allowing them only in exceptional situations subject to a court order. It is highlighted that the introduction of AI into criminal justice practice must be accompanied by not only technical, but also legal and ethical safeguards. The conclusion is drawn that a comprehensive approach is required to balance the innovative capabilities of AI with human rights protections – from amending the Criminal Procedure Code to record and evaluate AI-derived evidence to taking into account international standards (GDPR, the EU AI Act) and creating mechanisms of independent oversight. Proper judicial control and tailored legal regulation will minimize risks and ensure the admissibility and objectivity of using AI-processed biometric data in criminal proceedings.

Security of cryptographic keys is an important issue in today's unprotected world. Most reliable solution of this problem is state of art fuzzy vault which is an application of bio-cryptosystems. These systems use biometric trait for locking and unlocking the keys. During unlocking, it is necessary to do alignment of query biometric data with enrolled biometric data because of large variation in two samples of a biometric trait of a user taken over the short span of time. Complexity of alignment is increased due to absence of original fingerprint template during alignment. That's why helper data or additional information is required for alignment. There are number of techniques developed for automatic alignment of fingerprints till now. This paper gives the review of most of those methods.

In recent years the security breaches and fraud transactions are increasing day by day. So there is a necessity for highly secure authentication technologies. The security of an authentication system can be strengthened by using Biometric system rather than the traditional method of authentication like Identity Cards (ID) and password which can be stolen easily. A biometric system works on biometric traits and fingerprint has the maximum share in market for providing biometric authentication as it is reliable, consistent and easy to capture. Although the biometric system is used to provide security to many applications but it is susceptible to different types of assaults too. Among all the modules of the biometric system which needs security, biometric template protection has received great consideration in the past years from the research community due to sensitivity of the biometric data stored in the form of template. A number of methods have been devised for providing template protection. Fuzzy vault is one of the cryptosystem based method of template security. The aim of fuzzy vault technique is to protect the precarious data with the biometric template in a way that only certified user can access the secret by providing valid biometric. In this paper, a modified version of fuzzy vault is presented to increase the level of security to the template and the secret key. The polynomial whose coefficients represent the key is transformed using an integral operator to hide the key where the key can no longer be derived if the polynomial is known to the attacker. The proposed fuzzy vault scheme also prevents the system from stolen key inversion attack. The results are achieved in terms of False Accept Rate (FAR), False Reject Rate (FRR), Genuine Acceptance Rate (GAR) by varying the degree of polynomial and number of biometric samples. It was calculated that for 40 users GAR was found to be 92%, 90%, 85% for degree of polynomial to be 3, 4 and 5 respectively. It was observed that increasing the degree of polynomial decreased the FAR rate, thus increasing the security

Are biometric data always personal data ? Until today, this question is raised repeatedly, as well as whether biometric data are ‘sensitive’ data. The Chapter provides answers based on a detailed analysis of the concepts from a national and European law perspective. The guidance of the Article 29 Working Party on these questions is hereby commented in a critical way, also taking into account the opinions WP192 and WP193 of 2012. The author also suggests a definition of biometric data, indispensible for framing later proposals. Biometric data is further compared with biological material and DNA, for which more detailed regulation exists. Many esteem that DNA analysis will soon be possible in ‘real time’ as well. The author concludes with sketching the privacy and data protection framework, now also both fundamental rights as proclaimed in the EU Charter, in which biometric data processing shall fit in. Varying national approaches surface as an omen for diverging interpretations and guidance for processing biometric data.

Adding machine learning (ML) and artificial intelligence (AI) logic models to authentication is an inevitable process. In this work, we show that the combination of qualitative and quantitative verification over model created on training data may significantly reduce false access probability, even if the user's credentials ID and password are compromised. We propose three layers of authentication based on user ID and password, silent signals, and biometrical data. The system uses supervised ML to determine the user's risk level. Basic model and associate implementation performance shows that we can, with high probability, identify an intruder based on silent signals, historical data, and behavioural biometrics. The system is compositional, so further improvement by introducing more silent signals and behavioural analytics can, theoretically, eliminate false acceptance. Whenever the risk level is higher than some threshold, an additional verification is required. The threshold may increase over time and in that case, the probability of additional verification of a legitimate user decreases.

We describe a simple and novel cryptographic construction that we refer to as a fuzzy vault. A player Alice may place a secret value ? in a fuzzy vault and "lock" it using a set A of elements from some public universe U. If Bob tries to "unlock" the vault using a set B of similar length, he obtains ? only if B is close to A, i.e., only if A and B overlap substantially. In constrast to previous constructions of this flavor, ours possesses the useful feature of order invariance, meaning that the ordering of A and B is immaterial to the functioning of the vault. As we show, our scheme enjoys provable security against a computationally unbounded attacker. Fuzzy vaults have potential application to the problem of protecting data in a number of real-world, error-prone environments. These include systems in which personal information serves to authenticate users for, e.g., the purposes of password recovery, and also to biometric authentication systems, in which readings are inherently noisy as a result of the refractory nature of image capture and processing.

Several recent works have proposed and implemented cryptography as a means to preserve privacy and security of patients health data. Nevertheless, the weakest point of electronic health record (EHR) systems that relied on these cryptographic schemes is key management. Thus, this paper presents the development of privacy and security system for cryptography-based-EHR by taking advantage of the uniqueness of fingerprint and iris characteristic features to secure cryptographic keys in a bio-cryptography framework. The results of the system evaluation showed significant improvements in terms of time efficiency of this approach to cryptographic-based-EHR. Both the fuzzy vault and fuzzy commitment demonstrated false acceptance rate (FAR) of 0%, which reduces the likelihood of imposters gaining successful access to the keys protecting patients protected health information. This result also justifies the feasibility of implementing fuzzy key binding scheme in real applications, especially fuzzy vault which demonstrated a better performance during key reconstruction.

The authors of this work claim that the legislation of the European Union does not adequately protect biometric data, due to the actuality that the protection of biometric data after the death of a person is unresolved within the legal field of personal data protection. The General Data Protection Regulation (GDPR) does not apply to deceased individuals, meaning that biometric data that was processed under the GDPR during the individual's lifetime continues to be at risk of re-processing after the individual's death, meaning that businesses can potentially avoid GDPR when the person has died, and decide the fate of the deceased's biometrics at their own discretion. Taking into account the above, the authors of the work consider it necessary to orient special legislation to overcome the specified legal gap, and since the regulation on the protection of personal data is vague to solve the problem, the research proposal of the authors consists in the application of legal guarantees not only under the GDPR but also in conformity with civil law. Therefore, the authors aim to initiate provisions for potential legislation, including the consolidation of the processing of biometric data of the deceased as part of a person's last will. The development of legal norms that would protect the biometric data of deceased persons by classifying them as non-property rights is especially recommended for countries with a civil law system. The research paper also warns that privileges that belong to the non-property rights of an individual do not, as a rule, automatically pass to heirs. In this regard, in the absence of a person's will to decide the future fate of biometric data that is continuously processed at the time or after death, the authors offer to allow family members and other close persons to exercise the right to the protection of personal data, such as the right to be forgotten, on behalf of the deceased, and to demand the condition of appropriate technical and organizational guarantees in the event of such performance. In this matter, according to the authors, it is expedient to conclude agreements between interested parties and family members to determine the fate of biometric data. However, in order to avoid the realization of the right to the protection of personal data, which the deceased did not have time to realize during his lifetime, and if during the life of the person Article, 9 (2, a) GDPR confirmed as the basis for the permitted biometric data processing because it is subject to the consent of the person, then following the human-centric approach of the European Union, it is proposed to design and indicate in such consent a clause where the individual could specifically determine and decide the fate of the biometric data upon death, for example, to (i) delete, (ii) transfer for the research purposes. Consequently, the authors predict the development of legal regulation of biometric data by assigning it to the category of non-property rights. Hence, the adoption of special provisions for the protection of the deceased biometric data and ensuring the realization of the right to personal data protection is expected not only during life but also after death.