Pattern Recognition Letters

Transcription

1 Pattern Recognton Letters 31 (21) Contents lsts avalable at ScenceDrect Pattern Recognton Letters journal homepage: A hybrd bometrc cryptosystem for securng fngerprnt mnutae templates q Abhshek Nagar a, *, Karthk Nandakumar b, Anl K. Jan a,c a Mchgan State Unversty, East Lansng, MI, USA b Insttute for Infocomm Research, A*STAR, Fusonopols, Sngapore , Sngapore c Department of Bran and Cogntve Engneerng, Korea Unversty, Anam-dong, Seoul, , Korea artcle nfo abstract Artcle hstory: Avalable onlne 14 July 29 Keywords: Bometrcs Template securty Fuzzy vault Mnutae descrptors Securty concerns regardng the stored bometrc data s mpedng the wdespread publc acceptance of bometrc technology. Though a number of bo-crypto algorthms have been proposed, they have lmted practcal applcablty due to the trade-off between recognton performance and securty of the template. In ths paper, we mprove the recognton performance as well as the securty of a fngerprnt based bometrc cryptosystem, called fngerprnt fuzzy vault. We ncorporate mnutae descrptors, whch capture rdge orentaton and frequency nformaton n a mnuta s neghborhood, n the vault constructon usng the fuzzy commtment approach. Expermental results show that wth the use of mnutae descrptors, the fngerprnt matchng performance mproves from an FAR of.7% to.1% at a GAR of 95% wth some mprovement n securty as well. An analyss of securty whle consderng two dfferent attack scenaros s also presented. A prelmnary verson of ths paper appeared n the Internatonal Conference on Pattern Recognton, 28 and was selected as the Best Scentfc Paper n the bometrcs track. Ó 29 Elsever B.V. All rghts reserved. 1. Introducton Pervasve use of bometrcs s mmnent due to ts numerous advantages over the surrogate denttes, e.g. passwords and smart cards. Bometrc trats have very hgh dscrmnatve capablty to dentfy an ndvdual and at the same tme, unlke ID cards and passwords, one does not have to worry about losng them (Jan et al., 28a). However, protectng stored bometrc templates s mportant due to potental msuse of the stolen templates. Cappell et al. (27) and Ross et al. (27) have shown that commonly used templates, that are supposed to be compact, nformatve and usable representaton of bometrc trats, have not been desgned wth the objectve of ther secure storage. Thus f an adversary s able to access a template, he can create a spoof bometrc (e.g. gummy fnger) from the template (Cappell et al., 27) and present t to the system. Due to lmted lveness detecton capablty of current bometrc readers, the spoof may be accepted by the system provdng an llegtmate access to the adversary. Further, an adversary can cross lnk the stolen templates wth other bometrc databases, allowng hm to track the actvtes of an enrolled person, thereby compromsng hs prvacy. Most template protecton approaches can be categorzed nto followng two classes: () transformaton based approaches and () bometrc cryptosystems (Jan et al., 28b). Transformaton q Research supported by Army Research Offce Grant W911NF * Correspondng author. Tel.: E-mal addresses: nagarabh@cse.msu.edu (A. Nagar), knandakumar@2r.a-star. edu.sg (K. Nandakumar), jan@cse.msu.edu (A.K. Jan). based approaches transform the bometrc features usng a user specfc password such that the matchng can be performed n the transformed doman. Such a technque s secure snce at no tme the orgnal bometrc s explctly present n the database. Though a number of transformaton based schemes have been proposed (Teoh et al., 27; Ratha et al., 27; Savvdes and Vjaya Kumar, 24; Boult et al., 27), an optmal transformaton that s non-nvertble and at the same tme preserves the matchng accuracy to a large extent s yet to be found. Bometrc cryptosystems (Dods et al., 26; Hao et al., 26; Nandakumar et al., 27; Sutcu et al., 27), on the other hand, are technques that assocate an external key wth a user s bometrc to obtan helper data. The helper data should not reveal any sgnfcant nformaton about the template or the key and at the same tme t can be used to recover the key when the orgnal bometrc s presented. In ths paper we shall focus on mprovng the matchng performance and securty of a fngerprnt based bometrc cryptosystem, called fngerprnt fuzzy vault (Nandakumar et al., 27). A fuzzy vault s preferred to secure fngerprnts because of ts ablty to secure bometrc data that s represented as an unordered set of ponts; fngerprnt mnutae fall n ths category. In order to construct a fuzzy vault, the external key s converted nto a polynomal and the mnutae are evaluated on that polynomal. These evaluatons are stored along wth the orgnal mnutae as tuples. The bometrc nformaton s then secured by storng the tuples among a large number of randomly generated chaff ponts. Durng authentcaton, the query bometrc s used to dentfy the legtmate mnutae n the set contanng the mnutae as well as the chaff ponts. The evaluatons, or the ordnate values, correspondng /$ - see front matter Ó 29 Elsever B.V. All rghts reserved. do:1.116/j.patrec

2 734 A. Nagar et al. / Pattern Recognton Letters 31 (21) to the secured polynomal are then used to reconstruct the polynomal thereby revealng the key. Though fuzzy vault s able to effectvely secure the fngerprnt templates, the recognton accuracy of the resultant system s sgnfcantly lower compared to the accuracy on the orgnal template. One reason for ths s the nablty of the fuzzy vault to effectvely utlze salent nformaton n a fngerprnt other than mnutae. We address ths lmtaton of fuzzy vault by ncorporatng mnutae descrptors n the vault constructon. Fgs. 1 and 4 show the fuzzy vault encodng and decodng procedures along wth the technque to ncorporate mnutae descrptors. Mnuta descrptors consst of the rdge frequency and rdge orentaton nformaton around a mnuta pont (Feng, 28). Note that storng the descrptors along wth mnutae n the vault s not recommended as the descrptors can be used to verfy whether two neghborng mnutae belong to the same fngerprnt or not. Thus, nstead of explctly storng the mnutae descrptors n the vault, we encrypt the ordnate values correspondng to the mnutae usng the assocated mnutae descrptors. Due to the ntra-user varatons n the mnutae descrptor values, standard cryptographc algorthms such as the Advanced Encrypton Standard (AES) cannot be used to encrypt the ordnate values. Therefore, another bo-crypto algorthm called the fuzzy commtment technque (Juels and Wattenberg, 1999) s used to assocate the ordnate value, whch serves as the key, wth a mnuta descrptor. Snce the actual matchng descrptors wll be able to decrypt the ordnate values, and hence decode the vault wth a hgher probablty than a non-matchng descrptor, the proposed hybrd cryptosystem mproves the matchng performance as well as securty of the vault. One lmtaton of a fuzzy commtment scheme desgned usng typcal algebrac codes [e.g. BCH codes (Reed and Chen, 1999)] s that these codes do not meet the Hammng bound (see Reed and Chen, 1999, p. 15). As a result, such codes may produce a decodng falure when one attempts to use a non-matchng descrptor to release the key. Consequently, an adversary can decrypt the ordnate values ndvdually by tryng all possble descrptors (whch s not dffcult gven the low dscrmnablty of descrptors). We expermentally show that such an attack s ndeed feasble when the dmensonalty of descrptor s hgh (see Secton 6). Further, we show that prncpal component analyss (Duda et al., 2) and sequental forward floatng search (Pudl et al., 1994) can be effectvely used to reduce the dmenson of the descrptors thereby reducng the chances of a successful attack. A technque for encryptng ordnate values usng just mnuta orentaton was also proposed by Mhalescu (27) but wthout any mplementaton. Secton 2 descrbes the helper data extracton procedure whch conssts of () fuzzy vault encodng and () securng ordnate values usng fuzzy commtment. Secton 3 descrbes the authentcaton procedure. In Secton 4, dfferent stages nvolved n obtanng a bnary vector from a mnuta descrptor are descrbed. Secton 5 provdes the expermental results correspondng to dfferent bnarzaton schemes used for descrptors. Secton 6 descrbes technques to measure the securty mprovement usng the proposed approach. In ths secton, we also dscuss some strateges that an adversary can use to compromse the system and the securty of our system aganst those strateges. Secton 7 summarzes our conclusons and the future enhancements. 2. Helper data extracton (enrollment) In the proposed fngerprnt cryptosystem, helper data extracton conssts of two man steps: () fuzzy vault encodng and () securng ordnate values (see Fg. 1). The frst step conssts of securng the mnutae locaton and drecton usng the fuzzy vault framework as descrbed n (Nandakumar et al., 27). In the second step, the ordnate values of the vault are secured usng the mnutae descrptors through the fuzzy commtment approach Fuzzy vault encoder Durng vault encodng a 16-bt Cyclc Redundancy Check (CRC) code s appended to a 16n-bt key K and dvded nto (n þ 1) blocks of 16 bts each. These (n þ 1) values serve as the coeffcents of a polynomal f of degree n n the Galos feld GFð2 16 Þ. The template mnutae are sorted accordng to ther qualty and well-separated mnutae (Nandakumar et al., 27) are selected for constructng the vault. If the desred number of well-separated mnutae (say r) cannot be obtaned, we count t as a Falure to Capture Error (FTCR). The locaton and orentaton of each mnuta s encoded as an element n GFð2 16 Þ. The mnutae x ; ¼ 1;...; r along wth ther correspondng polynomal evaluatons f ðx Þ; ¼ 1;...; r are stored n the vault V. A set of s chaff ponts fðy j ; z j Þ; j ¼ 1;...; sg s generated randomly such that y j x ; 8 ¼ 1;...; r; j ¼ 1;...s and z j f ðy j Þ; 8j ¼ 1;...; s. The chaff pont set s added to the vault V whch can now be represented as V ¼ðA; BÞ, where A and B are the sets of (r þ s) abscssa and ordnate values n the vault, respectvely. Ponts wth hgh rdge curvature are extracted from the fngerprnt and stored along wth the vault to be used for algnment durng authentcaton Securng ordnate values The securty of the vault descrbed n Secton 2.1 depends only on the dffculty n dentfyng the genune ponts n the set A. Once ðn þ 1Þ genune ponts are dentfed, Lagrange nterpolaton can be used to reconstruct the polynomal f, thereby revealng the key K. But f ordnate values correspondng to each pont n the vault are encrypted, an adversary wll not be able to reconstruct the polynomal even f he correctly guesses the genune ponts from the vault. We use mnutae descrptors (Feng, 28) n order to encrypt the ordnate values usng fuzzy commtment approach. Fg. 1. Helper data extracton n the proposed fngerprnt cryptosystem.

3 A. Nagar et al. / Pattern Recognton Letters 31 (21) Orentaton Desc. Value Pont ndex (b) (a) Frequency Desc. Value Pont ndex (c) Fg. 2. Mnutae descrptor: (a) postons of 76 ponts around a mnutae; thckness of each lne and ts orentaton correspond to frequency and orentaton descrptors, (b) orentaton and (c) frequency descrptors. Fg. 3. Dfferent stages nvolved n obtanng a bnary vector of desred length from raw mnutae descrptors. A mnuta descrptor conssts of rdge orentaton and frequency at 76 equdstant ponts, unformly spaced on four concentrc crcles around a mnuta. The four concentrc crcles, wth radus 27, 45, 63 and 81 pxels, contan 1, 16, 22 and 28 ponts, respectvely (see Fg. 2). Ths confguraton of ponts s based on the crtera that the dfference between rad of two consecutve concentrc crcles and that between two sampled ponts on a crcle should be twce the rdge perod. Samplng the ponts n ths manner captures maxmum nformaton contaned n the neghborhood of a mnuta (Tco and Kuosmanen, 23). In order to use a mnuta descrptor n a fuzzy commtment scheme, the descrptor needs to be converted to an m-bt bnary vector, say D b. Length of D b s decded based on avalablty of an effcent error correctng code of the same length. The bnarzaton procedure conssts of four stages desgned to capture the maxmum possble dscrmnablty n the mnutae descrptors: () mssng value estmaton, () dmensonalty reducton, () bnary encodng usng Gray codes, and (v) dscrmnable bts selecton. We explan the above stages n detal n Secton 4. Next, the ordnate value for each mnuta s used to obtan a codeword from an error correctng code. If the dmenson of the code beng used s larger than the number of bts n the ordnate value, requred number of randomly generated bts are appended to the ordnate value. In case the dmenson of the code s smaller than the number of bts n ordnate value, frst k bts are used as the message, where k s the dmenson of the code. Let D b ; ¼ 1;...; ðr þ sþ be the descrptor n bnary format and C be a codeword generated from the correspondng 16-bt ordnate value B. Now, nstead of the ordnate value B, only the secure ordnate value, G ð¼ ðd b C ÞÞ, s stored n the vault. 1 Note that the 1 denotes the XOR operaton. descrptors for the chaff ponts are chosen at random from the set of all the descrptors n the database. The set of abscssa values A, the set of secure ordnate values G and the hgh curvature ponts together consttute the helper data n our fngerprnt cryptosystem. 3. Authentcaton Durng authentcaton (see Fg. 4), the query fngerprnt s frst algned usng the hgh curvature ponts of the template and query fngerprnts as descrbed n (Nandakumar et al., 27). Then, r well separated and good qualty mnutae are selected from the query and matched wth the ponts n the vault n order to flter out most of the chaff ponts. Further, the mnutae descrptors are extracted from the fngerprnt and are bnarzed usng the same procedure as n the enrollment stage. An XOR operaton s appled between the descrptor (say D b ) assocated wth each selected query mnuta and the correspondng secure ordnate value to obtan the correspondng word C. Ths word s then decoded to obtan the message, whch represents the ordnate value correspondng to that mnuta (see Fg. 5). If the ordnate value s correctly decoded for some mnmum number (n þ 1) of genune ponts n the vault, the polynomal f s correctly reconstructed ndcatng a successful match. 4. Descrptor bnarzaton The fuzzy commtment scheme requres the bometrc features to be n the form of bnary vectors. Further, t s desrable that the Hammng dstance between the matchng and non-matchng descrptors be as far apart as possble. In order to acheve ths, we follow a four stage bnarzaton scheme consstng of (see Fg. 3)

4 736 A. Nagar et al. / Pattern Recognton Letters 31 (21) Fg. 4. Authentcaton usng the proposed fngerprnt cryptosystem. Fg. 5. Fuzzy commtment and de-commtment procedure for securng ordnate values. () Mssng value estmaton () Dmensonalty reducton () Bnary encodng usng Gray codes (v) Dscrmnable bts selecton 4.1. Estmatng mssng values for mnutae descrptors The descrptors correspondng to mnutae near the fngerprnt boundary tend to have many mssng values because only a part of the neghborhood of such mnutae les wthn the fngerprnt regon (foreground). We estmate the mssng values from the k-nearest descrptors of a gven descrptor n the database. The nearest neghbor based approach s expected to provde realstc and relable estmates as t selects the mssng values from smlar descrptors. The mssng values n the descrptors are estmated n the followng manner. Frst, we fnd the k-nearest neghbors of the gven descrptor among a set of desred descrptors n the database. A set of desred descrptors s selected such that 75% of the values avalable n the gven descrptor are avalable n the selected descrptors as well. The mssng values are then estmated as the average of the avalable values n the k-nearest neghbors. The nearest neghbors and mssng values are computed separately for the orentaton values and the frequency values. In case of orentaton values, dstance between two descrptors s computed as the normalzed sum of the dstance between the ndvdual values. Let the set of orentaton values of two descrptors D 1 and D 2 beng matched be D 1 o ¼fd1 o1 ; d1 o2 ;...; d 1 om g and D2 o ¼fd2 o1 ; d2 o2 ;...; d2 omg. The dstance between two orentaton descrptors s gven by P m dðd 1 o ; D2 o Þ¼ ¼1 mnðjd1 o d2 o j; 18 jd1 o d2 o jþmask o P m ¼1 mask ; ð1þ o where mask o has a value 1 f both the d 1 o and d2 o are nsde the fngerprnt regon (foreground) and otherwse. If the k nearest neghbors of th descrptor are D ð1þ o ; Dð2Þ o ;...; DðkÞ o then the estmated orentaton descrptors are gven by: d oj ¼ 1 P k! 2 atan l¼1 snð2dðlþ oj ÞmaskðlÞ oj P k ; ð2þ l¼1 cosð2dðlþ oj ÞmaskðlÞ oj where mask ðlþ oj has value 1 f d ðlþ oj s n the foreground. The mssng values for the rdge frequency are also computed n a smlar way by changng the dstance measure between descrptors and the functon that combnes multple descrptors to estmate the mssng value. Dstance between two frequency descrptors s gven by dðd 1 f ; D1 f Þ¼ P m ¼1 jd1 f d2 f jmask f P m ¼1 mask f and frequency values estmated from the k neghbors of th descrptor are gven by P k d fj ¼ l¼1 dðlþ fj maskðlþ fj P k ; ð4þ l¼1 maskðlþ fj where mask ðlþ fj has value 1 f d ðlþ fj s n foreground. A small fracton of the descrptor values that could not be estmated usng the above procedure can be nterpolated as weghted average of the neghborng values. Fg. 6 compares the orentaton component of the descrptors where mssng values were estmated usng the nearest neghbor approach and the smple nterpolaton scheme. We observe that the values estmated usng the nearest neghbor based technque s more smlar to the real descrptor values n a matchng descrptor (obtaned from the same mnutae n a dfferent mpresson of the same fnger) compared to the smple nterpolaton scheme. ð3þ

5 A. Nagar et al. / Pattern Recognton Letters 31 (21) Fg. 6. Estmatng mssng values n descrptors: (a) orentaton of two matchng descrptors overlad where mssng values were estmated usng the nearest neghbor approach; (b) orentaton of the same descrptors when smple nterpolaton s used for estmatng the mssng values. It can be observed that there are very few nconsstent orentaton values n case nearest neghbor approach s used Dmensonalty reducton for mnutae descrptors As noted n (Nagar et al., 28), use of long bnary mnutae descrptors degrade the system securty. Ths s because the error correctng codes compatble wth such descrptors are more lkely to produce decodng falures when an adversary attempts to decrypt an ordnate value usng a non-matchng descrptor (see Secton 6). A decodng falure occurs when the dstance between the corrupted word and any codeword s larger than the error correcton capablty of the code. To mtgate ths problem, we reduce the dmensonalty of the mnutae descrptor usng prncpal component analyss (PCA) (Duda et al., 2) and sequental forward floatng search (Pudl et al., 1994) n order to detect the most nformatve components. One of the motvatons for usng PCA s the fact that the dfferent elements of mnutae descrptors are hghly correlated resultng n strongly correlated bts n the bnarzed descrptor. The use of PCA s expected to lead to uncorrelated bts n the bnarzed descrptor. Snce the orentaton values do not belong to Eucldean space, drect applcaton of PCA s not expected to produce meanngful components. Thus, orentaton descrptor s now represented as: D o ¼ ½cosð2d o1 Þsnð2d o1 Þcosð2d o2 Þsnð2d o2 Þ...cosð2d om Þsnð2d om ÞŠ: ð5þ The complete descrptor thus becomes D ¼ ½cosð2d o1 Þ snð2d o1 Þ cosð2d o2 Þ snð2d o2 Þ...cosð2d om Þ snð2d om Þd f 1 d f 2...d fm : PCA s now appled to the descrptor represented n Eq. (6) to obtan the uncorrelated components. Further, snce certan components mght be very nosy, we apply a supervsed feature selecton. Among the varous feature selecton algorthms avalable (Peng et al., 25; Jan and Zongker, 1997), sequental forward floatng selecton algorthm (SFFS) (Pudl et al., 1994) s smple to mplement and provdes good performance. We use the False Accept Rate (FAR) at the 98% Genune Accept Rate (GAR) as the objectve functon for selectng salent features usng SFFS. The descrptors are matched usng the Eucldean dstance. Once the desred number of features are selected, they are bnarzed usng the scheme descrbed n Secton Bnarzng mnutae descrptors The man objectve of a mnuta descrptor bnarzaton scheme s to generate bnary descrptors havng small dmensonalty that ð6þ retan the maxmum possble dscrmnablty. Large dscrmnablty wll allow correct decodng of ordnate values usng descrptors for genune matches and at the same tme lmt the correct decodng for an mpostor par. Small dmensonalty on the other hand wll lmt the decodng falures leadng to greater securty aganst mpostor attacks. Bnarzaton of a contnuous value feature conssts of two parts: () quantzaton, and () bt assgnment. We perform unform quantzaton for the descrptor values based on ther maxmum and mnmum values. The number of bns used for quantzaton s of the form 2 a where a s a postve nteger. Due to the ntra-user varaton n the mnutae descrptors, t s desrable that the number of bt dfferences among the representatons of the adjacent quanta should be mnmum. That s, f a value les close to the boundary of a quantum and due to ntra class varaton, t shfts to the next quantum n the matchng descrptor, the penalty pad n terms of the Hammng dstance of the bnarzed descrptors should be mnmum.e. only 1 bt. Gray codes (Gray, 1953) are well known codes desgned specfcally for ths purpose. Table 1 shows a 3-bt Gray code. A notceable fact about the gray codes s that the frst and the last quanta also have only a sngle bt dfference. Ths fact s benefcal n case the relatve orentaton values are drectly bnarzed wthout dmensonalty reducton snce the relatve orentaton value of 9 s the same as the orentaton value of 9. Snce the total number of bts generated from a mnuta descrptor may not be the same as the length of a desrable error correctng code, t s desrable to approprately select certan bts. To ths end, we employ a supervsed bt selecton procedure. Ths procedure selects a set of bts such that they have mnmum varaton among the matchng descrptors and maxmum varaton among the non-matchng descrptors. In order to obtan a measure of the ntra-class and nter-class varatons of a partcular bt, we frst obtan the genune and mpostor matchng mnutae from the database. The varaton n genune matchng descrptors corresponds to the fracton of genune matches that have dfferent values for the partcular bt n consderaton. The varaton n mpostor matchng descrptors thus corresponds to the fracton that have dfferent bt values for the mpostor matches. Let the ntra-class varaton of the th bt be r G and nter-class varaton be r I. The dscrmnablty ndex for each bt s gven by C ¼ a d r I ð1 a d Þr G ; ð7þ where a d 2f; 1g s constant. A total of c bts havng the largest dscrmnablty ndex are selected to consttute the bnary descrptor. 5. Experments We used the FVC22 DB2 fngerprnt database to compare the fuzzy vault performance wth and wthout mnutae descrptors. As n (Nandakumar et al., 27), only the frst two mpressons of the 1 dfferent fngers the database were used n the experments, one as the template and the other as the query. Durng both Table 1 3-Bt Gray code. Note that adjacent quanta dffer n only a sngle bt. Quantum ndex Gray code

6 738 A. Nagar et al. / Pattern Recognton Letters 31 (21) enrollment as well as authentcaton, the mssng descrptor values are estmated usng the 1-nearest neghbor approach as descrbed n Secton 4.1. The nearest neghbors are found among the descrptors correspondng to all the mnutae extracted from all mages n FVC2 DB2; there are around 27, descrptors n all. The orentaton and frequency values of the descrptors are quantzed separately nto 2 5 and 2 4 values, respectvely, and bnarzed usng Gray codes as descrbed n Secton 4.3 to obtan 684 bts. From these 684 bts, 511 bts are selected usng the bt selecton scheme as descrbed n Secton 4.3. The BCH(511,19) error correctng scheme s used for generatng the fuzzy commtment that can correct up to 119 errors. Fg. 7 shows the GAR and FAR values correspondng to the fuzzy vault mplementaton n (Nandakumar et al., 27) (wthout descrptors) and the proposed mplementaton where mnutae descrptors are used (Desc (511,19)). Falure to capture rate n both cases s 2%. We observe that the use of mnutae descrptors reduces the FAR of the system sgnfcantly, whle the GAR remans nearly the same. For nstance, when the degree of the polynomal s 6, the GAR s 95% for both the scenaros. However, the FAR s.7% when the descrptors are not used and.1% when the proposed cryptosystem s used. These estmates of GAR and FAR are based on 1 genune matches and 99 mpostor matches. The prncpal component analyss (PCA) s further used to reduce the dmensonalty of the descrptors as descrbed n Secton (a) Genune Accept Rate (b) False Accept Rate Desc (511,19) PCADesc (31,6) PCADesc (15,5) Wthout Descrptor Degree of polynomal (n) Desc (511,19) PCADesc (31,6) PCADesc (15,5) Wthout Descrptor Degree of polynomal (n) Fg. 7. GAR (a) and FAR (b) for the fuzzy vault wth and wthout descrptors. Desc (511,19) corresponds to case when orentaton values are quantzed nto 2 5 quanta, rdge frequency values are quantzed nto 2 4 quanta and 511 bts are extracted from them. Here the fuzzy commtment scheme s constructed usng BCH(511,19) code. PCADesc (31,6) and PCADesc (15,5) correspond to cases when 1 prncpal components are extracted and each value s dvded nto 2 7 quanta. In PCADesc (31,6), 31 bts are extracted and BCH(31,6) code s used for fuzzy commtment whereas n PCADesc (15,5) 15 bts are extracted and BCH(15,5) code s used. BCH(511,19) corrects up to 119 errors, BCH(31,6) corrects up to seven errors and BCH(15,5) corrects up to three errors The covarance matrx of the descrptors values, that s requred for computng the prncpal components, s computed usng the descrptors avalable n the database. Frst 1 prncpal components are retaned and each one s quantzed nto 2 7 bns. A 7-bt Gray code s used to bnarze each of the 1 components. Note that PCA and the desred components can be computed off-lne once for all. Fg. 7 shows the FAR as well as the GAR correspondng to 31-bt as well as 15-bt descrptors obtaned by selectng 31 and 15 bts, respectvely, from the avalable 7bts. It can be seen there s slght degradaton n the GAR because of dmensonalty reducton from 95% to 94% and 93%, respectvely, for 31 and 15 bts descrptors. However, as descrbed n Secton 6, the securty s ncreased by around 1 bts n case a 15-bt descrptor s used. 6. Securty analyss Nandakumar (28) showed that the mn-entropy (Dods et al., 26) of the mnutae template M T gven the vault V can be computed as 1 r H 1 ðm T nþ1 jvþ ¼ A; ð8þ rþs nþ1 where r, n and s have the same meanng as n Secton 2.1. Ths dervaton s based on the assumpton that both the mnutae locaton and mnutae orentaton are unformly dstrbuted. The fuzzy vault mplementaton n (Nandakumar et al., 27) uses the values of r ¼ 24, s ¼ 2 and n ¼ 8 for the typcal vault constructon. Based on the above analyss, the securty of the fngerprnt fuzzy vault mplementaton n (Nandakumar et al., 27) s approxmately 31 bts. Ths s equvalent to a randomly chosen four character password whch requres around a bllon trals on average to break the system. In the proposed fngerprnt fuzzy vault the true ordnate values can be obtaned n two ways: () drectly guessng the 16-bt ordnate values and () guessng the descrptors assocated wth each mnuta. Snce the ordnate values of the genune ponts are obtaned through an evaluaton of a randomly generated secure polynomal, t s reasonable to assume that the dffculty of drectly guessng an ordnate value s approxmately 16 bts (assumng there are more than 16 nformaton bts n the error correctng code, otherwse t s the number of nformaton bts of the code). Also snce the adversary has to smultaneously guess ðn þ 1Þ ordnate values correctly, ths corresponds to approxmately 16ðn þ 1Þ bts of securty. In order to estmate securty aganst guessng the descrptor, let the entropy of a mnuta descrptor D be I D bts and say q bts out of these should be corrected. As shown by Hao et al. (26), the dffculty n guessng a mnutae descrptor s approxmately. R ¼ logð2 I D I D Þ bts. Snce the adversary has to smultaneously dqe guess ðn þ 1Þ mnutae descrptors correctly, usng mnutae descrptors provdes approxmately ðn þ 1ÞR bts of securty. Although the length of descrptor s N bts, there s a strong correlaton between the descrptor bts leadng to reducton n effectve entropy of the descrptor bts.e. I D. We emprcally determne that approxmately N=4 bt errors need to be corrected n order to preserve the GAR to a large extent. Thus q can be approxmated as I D =4. Thus, f n ¼ 8 and I D ¼ 6 bts, then R 2 bts. In ths scenaro, the proposed scheme ncreases the securty of the fuzzy vault by approxmately 18 bts so the overall securty now becomes 49ð31 þ 18Þ bts. Ths s equvalent to a sx character password. The above securty analyss assumes the use of a perfect error correcton codng scheme (a w-error correctng bnary code of sze 2 N s sad to be perfect f for every word C, there s a unque

7 A. Nagar et al. / Pattern Recognton Letters 31 (21) Table 2 The values correspondng to p df, p, max ðp Þ and T a for the dfferent representatons of descrptors consdered. Descrptor format Mn Max Medan p df Desc (511,19) PCADesc (31,6) PCADesc (15,5) p Desc (511,19) PCADesc (31,6) PCADesc (15,5) max ðp Þ Desc (511,19) PCADesc (31,6) PCADesc (15,5) codeword C such that the Hammng dstance between C and C s at most w bts). It has, however, been proven that any non-trval perfect code over a prme-power alphabet has the parameters of a Hammng code or a Golay code (Hll, 1988). Note that Hammng codes correct only sngle error whereas Golay codes correct only up to three errors n code of length 24 bts and thus would not be applcable to the current problem. If the codng scheme s not perfect, some of the words may result n a decodng falure whch would ndcate an ncorrect mnuta descrptor beng used to de-commt the ordnate value. Due to unknown dstrbuton of bometrc features, t s mportant to emprcally estmate the number of decodng falure and ncorrect decodngs whle usng a partcular error correctng code. Note that even f all the ncorrect descrptors lead to decodng falure, the securty s at least as good as the securty of the orgnal fuzzy vault. When an adversary apples a descrptor to decode the secure ordnate value, followng stuatons can arse: T a Desc (511,19) PCADesc (31,6) PCADesc (15,5) () () () a decodng falure s detected, the correct codeword c s obtaned and an ncorrect codeword c ð cþ s obtaned. We are nterested n estmatng the relatve frequency of these three events as they provde an estmate of ambguty about the Fg. 8. Varaton of bts of securty nduced by descrptors as u ¼ tð1 p df Þ ncreases for PCADesc (15,5). Here u s the number of descrptors tred and p df s the fracton of descrptors leadng to decodng falure. Abscssae represents u and the ordnates represents the number of bts of securty. The 2 dfferent graphs show the varaton for the 2 dfferent randomly selected descrptors. In many cases a mnmum securty of around 1 bts can be mparted to the system leadng to a total securty of 41 (31 + 1) bts.

8 74 A. Nagar et al. / Pattern Recognton Letters 31 (21) true codeword. Let the relatve frequency of the three events be: p df, p, and p ; ¼ 1; 2;... n order. One strategy an adversary mght employ would be to try decodng the ordnate value wth a large number of descrptors one by one and select the frst ordnate value decoded. Here the adversary would be successful wth probablty p ðnþ1þ p a ¼ P ¼ p p ðnþ1þ ; ð9þ where p ¼ P p p. Thus the number of bts of securty added would be equal to T a ¼ log 2 p a. In order to estmate p df ; p and p, we randomly selected 2 dfferent descrptors and tred to decode those usng the database contanng 27, descrptors. Table 2 shows the values correspondng to p df, p, max p and T a for the dfferent representatons of descrptors consdered. It can be seen that BCH(31,6) provdes around 7 bts of securty on average whereas that BCH(15,5) provdes around 28 bts. In our experments wth the mperfect codes havng hgh dmenson e.g. BCH(511,19) or BCH(31,5), t has been observed that p p. Ths can be explaned by the fact that f the dfference between two matchng descrptors s less than the error correcton capacty of the code, whch s often the case, there are an acceptable number of errors ntroduced n the codeword leadng to correct decodng. On the other hand, when a randomly selected descrptor s used to decode the fuzzy commtment, a large number of errors beyond the error correctng capacty are ntroduced nto the codeword. Due to ths the codeword s shfted to a nondecodable regon wth hgh probablty leadng to a decodng falure. Note that n case of BCH(511,19), theoretcal estmate of the fracton of space that s not decodable s , that for BCH(31,6) s :9 and for BCH(15,5), t s :44 whch s consstent wth the probabltes of decodng falure reported n Table 2. Also no ncorrect decodng was detected n case of usng BCH(511,19) due to large fracton of non-decodable regon. Another strategy that an adversary can employ s to apply t dfferent descrptors for decodng each secure ordnate value and get the ordnate value that occurred maxmum number of tmes. Note that, on average, there would be u ¼ tð1 p df Þ dfferent descrptors that wll not produce decodng falures. Thus the adversary wll succeed f there are more than up max correctly decoded ordnate values among the set of u decoded values, where p max ( ) maxfp ; ¼ 1; 2;...g ¼ : ð1þ P p Thus the probablty of successful attack s gven by p a ¼ ðnþ1þ p #ðcorrect codewordsþ > dupmaxe ; ð11þ where p ð#ðcorrect codewordsþ > lþ ¼ Xu ¼lþ1 u p l ð1 p Þ u : ð12þ Note that the securty n terms of number of bts s gven by T a ¼ log 2p a. Fg. 8 shows the varaton of bts of securty as u ncreases correspondng to the case when the descrptor s represented as a 15- bt vector. It s noted that n more than half of the cases around 1 bts of securty can be mparted to the fuzzy vault n case the degree of polynomal secured by the fuzzy vault,.e. n, s 8. The sawtooth shape of the curves s due to the fact that n Eq. 11, dup max e remans the same even f u ncreases and that change n dup max e leads to larger reducton n the probablty of attack as compared to the effect of ncreasng u. Note that the curves correspondng to descrptors that have larger values of p max have sharper teeth and have hgh chances of leadng to greater securty. Although, the securty depends on p as well. The ncrease n the number of descrptors tred by the adversary,.e. t, also leads to ncreased computatonal complexty of the attack. Thus even though no addtonal nformaton theoretc securty s mparted n case of BCH(511,19), there s sgnfcant computatonal cost to the adversary n order to compromse the system due to large p df leadng to mprovement n securty to a certan extent. Note that gven u, t s drectly proportonal to p df. 7. Conclusons Template securty s crtcal to the ntegrty of a bometrc system. In ths paper we have shown that both the matchng performance and securty of a fngerprnt fuzzy vault can be mproved by ncorporatng mnutae descrptors. Experments on a publc doman fngerprnt database demonstrates that the use of mnutae descrptors leads to an order of magntude reducton n the False Accept Rate wthout sgnfcantly affectng the Genune Accept Rate. Further, the vault securty measured n terms of number of tres an adversary has to make n order to guess the secure key s ncreased. As future work, we plan to nvestgate nearest neghbor decodng mplementatons of certan error correctng codes n order to reduce the decodng falures. Snce the descrptors correspondng to neghborng mnutae are correlated, we plan to nvestgate f an adversary can leverage such nformaton to ncrease hs chances of a successful attack and to what extent. References Boult, T.E., Scherer, W.J., Woodworth, R., 27. Fngerprnt revocable botokens: Accuracy and securty analyss. In: Proc. CVPR. Mnneapols, pp Cappell, R., Lumn, A., Mao, D., Malton, D., 27. Fngerprnt mage reconstructon from standard templates. IEEE Trans. Pattern Anal. Machne Intell. 29 (9), Dods, Y., Ostrovsky, R., Reyzn, L., Smth, A., 26. Fuzzy extractors: How to generate strong keys from bometrcs and other nosy data. Tech. Rep. 235, Cryptology eprnt Archve. Duda, R.O., Hart, P.E., Stork, D.G., 2. Pattern Classfcaton. Wley-Interscence. Feng, J., 28. Combnng mnutae descrptors for fngerprnt matchng. Pattern Recognton 41 (1), Gray, F., Pulse code communcaton. US Patent 2,632,58. Hao, F., Anderson, R., Daugman, J., 26. Combnng crypto wth bometrcs effectvely. IEEE Trans. Comput. 55 (9), Hll, R., A Frst Course n Codng Theory. Oxford Unversty Press, p. 12. Jan, A.K., Flynn, P., Ross, A.A., 28a. Handbook of Bometrcs. Sprnger. Jan, A.K., Nandakumar, K., Nagar, A., 28b. Bometrc template securty. EURASIP J. Adv. Sgnal Process. 28, Artcle ID , 17pp. Jan, A.K., Zongker, D., Feature selecton: Evaluaton, applcaton, and small sample performance. IEEE Trans. Pattern Anal. Machne Intell. 19 (2), Juels, A., Wattenberg, M., A fuzzy commtment scheme. In: Proc. 6th ACM Conf. on Computer and Comm. Securty, Sngapore, pp Mhalescu, P., 27. The Fuzzy Vault for Fngerprnts s Vulnerable to Brute Force Attack. Avalable at: Nagar, A., Nandakumar, K., Jan, A.K., 28. Securng fngerprnt template: Fuzzy vault wth mnutae descrptors. In: Internat. Conf. for Pattern Recognton, Tampa. Nandakumar, K., 28. Multbometrc systems: Fuson strateges and template securty. Ph.D. Thess, Department of Computer Scence and Engneerng, Mchgan State Unversty. Nandakumar, K., Jan, A.K., Pankant, S., 27. Fngerprnt-based fuzzy vault: Implementaton and performance. IEEE Trans. Inform. Forenscs Securty 2 (4), Peng, H.C., Long, F., Dng, C., 25. Feature selecton based on mutual nformaton: Crtera of max-dependency, max-relevance, and mn-redundancy. IEEE Trans. Pattern Anal. Mach. Intell. 27 (8), Pudl, P., Novovcova, J., Kttler, J., Floatng search methods n feature selecton. Pattern Recognton Lett. 15, Ratha, N.K., Chkkerur, S., Connell, J.H., Bolle, R.M., 27. Generatng cancelable fngerprnt templates. IEEE Trans. PAMI 29 (4),

9 A. Nagar et al. / Pattern Recognton Letters 31 (21) Reed, I.S., Chen, X., Error-Control Codng for Data Networks. Kluwer Academc Publshers. Ross, A.K., Shah, J., Jan, A.K., 27. From templates to mages: Reconstructng fngerprnts from mnutae ponts. IEEE Trans. Pattern Anal. Machne Intell. 29 (4), Savvdes, M., Vjaya Kumar, B.V.K., 24. Cancellable bometrc flters for face recognton. In: Proc. ICPR, vol. 3, Cambrdge, pp Sutcu, Y., L, Q., Memon, N., 27. Protectng bometrc templates wth sketch: Theory and practce. IEEE Trans. Inform. Forenscs Securty 2 (3), Teoh, A.B.J., Toh, K.-A., Yp, W.K., N dscretsaton of bophasor n cancellable bometrcs. In: Proc. ICB, Seoul, pp Tco, M., Kuosmanen, P., 23. Fngerprnt matchng usng an orentaton-based mnuta descrptor. IEEE Trans. Pattern Anal. Mach. Intell. 25 (8),