MySQL and MATLAB Interfacing for Biometric Template Protection with Encryption M.Mani Roja

Transcription

1 MySQL and MATLAB Interfacing for Biometric Template Protection with Encryption M.Mani Roja Dr.Sudhir Sawarkar Research Scholar, Principal, Sant Gadge Baba Amravati University, Datta Meghe College of Engineering, Asso. Professor, TSEC, Mumbai Mumbai. Abstract A new approach for biometric database management is presented with enhanced security features. This paper attempts to improve the security of biometric database system by interfacing with MySQL server. The signature templates are acquired for the database using digital pen tablet, encrypted using a simple pseudo noise based algorithm and then stored on the MySQL server. During the authentication phase, the signatures are brought from the database for feature extraction. After decryption, they are compared with query template. Since, the database is password protected, it provides double security against adversary attacks. 1. Introduction Biometric recognition (recognizing of individuals based on their anatomical or behavioural traits) is emerging as the mainstay of person authentication. This is primarily driven by the inherent reliability and convenience of biometric systems over traditional authentication mechanisms (such as passwords or tokens) that can be easily shared, guessed, lost, or stolen. Traditionally, a combination of ID cards (tokenbased security) and PINs/passwords (knowledge-based security) has been used to validate the identity of an individual. These methods are, however, vulnerable to the wiles of an impostor and cannot be reliably used in large-scale applications such as border control, where the throughput is required to be in the order of thousands of users per day. The advent of biometrics has introduced a secure and efficient alternative to traditional authentication schemes. Biometrics is the science of establishing or determining an identity based on the physiological or behavioural traits of an individual. These traits include fingerprints, facial features, iris, hand geometry, voice, signature, etc. In conjunction with traditional authentication schemes, biometrics is a potent tool for establishing identity [1-4]. 2. Biometric System Modules Every biometric system is composed of four main modules [4-5]. 2.1 Sensor module Sensor is the interface between the user and the authentication system. Its function is to scan the biometric trait of a user and makes a digital description of it. 2.2 Feature extraction module This module processes the scanned biometric trait and generates the template. Feature vectors are extracted from the template. These feature vectors are useful in distinguishing between different users. 2.3 Matcher module The matcher module accepts two biometric feature sets, template and test image and outputs a match score indicating the correlation between the two sets. 2.4 Decision module The decision module makes the identity decision and initiates a response based on the matching score. 3. Biometric Security Attacks Ratha et.al [6] identified eight points of attack in a biometric system as shown in fig 1. Fig 1. Various attacks on Biometric System These attacks are 1. Sensor level attack: If the sensor is unable to distinguish between the fake and genuine 114

2 biometric traits, the adversary easily intrudes the system by presenting a fake biometric sample such as fake finger or a face mask, 2. Replay attack: This attack is also known as the attack on the channel between the scanner and the feature extractor. In this type, the adversary intercepts the unsecured communication channel between the sensor and the feature extractor to steal the biometric traits and store it somewhere. The adversary can replay the stolen biometric traits like an old copy of a signature image or a recorded voice sample to the feature extractor to bypass the scanner. 3. Trojan horse attack: This is an attack on the software module. The executable program in the feature extractor module is modified with a Trojan horse such that it always outputs the values desired by the adversary. Trojan Horses in general can be controlled remotely. Hence the adversary simply sends the commands to the Trojan horse to send desired feature values to matching module. 4. Spoofing the biometric feature: Here the adversary attacks the channel between the feature extraction module and matching module. This attack is similar to Trojan horse attack. The difference is that the adversary intercepts the communication channel to steal feature values of a legitimate user and replay them to the matching module at a later time 5. Attack on matching module: This attack is similar to Trojan horse attack. Here, the adversary replaces the matching module with a Trojan horse. He can control the Trojan horse to generate high matching scores and accepts the application to bypass the biometric authentication system. In a similar manner, the adversary can produce a very low matching score and send a rejection to the legitimate user all the time causing a denial of service. 6. Database attack: This is one of the most potentially damaging attacks on a biometric system. This attack targets the biometric templates stored in the system data base. Attacks on the template can lead to the following effects. A legitimate user s template can be replaced by an impostor s template. An adversary can delete the templates present in the data base or he can add new templates in the database. As a result, either an impostor is granted authentication or a legitimate user faces a denial of service. 7. Attack on the channel between the system data base and matching module: Since the stored templates are transmitted to the matching module through the communication channel, the adversary intercepts the channel to change the data present in the channel. 8. Attack on the decision process: In this type of attack, the final decision can be altered by the adversary. 4. Template Protection The template protection schemes proposed in the literature can be broadly classified into two categories namely feature transformation approach and biometric cryptosystem [7, 8]. In feature transform approach, a transformation function is applied to the biometric template and only the transformed template is stored in the database. The same transformation function is applied to the template under test and the transformed test template is directly matched against the transformed reference template. Biometric crypto systems are developed for the purpose of either securing a cryptographic key using biometric features or directly generating a cryptographic key from biometric features. Some template protection schemes make use of more than one approach. Such techniques are called as hybrid schemes. 5. Proposed System We have designed a signature based authentication system for low level authentication system. The signature samples are collected using Wacom digital pen tablet. We have collected 5 samples from 70 users. Hence our database consists of 350 samples. The signature is resized to a size of 128 by 256 and after applying pre-processing steps like binarization and thinning, biometric signature template is included in the database. Fig 2 Wacom Digital Pen tablet In our work, first we are using a simple Pseudo noise (PN) based encryption scheme for encrypting the 115

3 sample signatures collected from the users. This encryption gives first level of security. These encrypted templates are saved in password protected data base to give double protection with database attack to protect the templates which enhances the security of the system. The proposed block diagram is shown in fig 3. 1). Decide the password. For example, maniroja is taken as a password. 2).Allot the corresponding numerical values to the password. Assigning numerals 1 to 26 corresponding to the alphabets a to z, the values corresponding to maniroja are found as 13 for m, 1 for a, 14 for n and so on. 3). Add all the numerical values. For the selected example, we get 81. 4). The resulting number is reversed in order and will be used as a seed state. Hence we get 18 as the seed state for the PN sequence generator. Since the seed state is known only to the authorized user, an intruder trying to access the database will not be able to decrypt the templates. For generating the PN image we have used the following MATLAB command with the derived seed number 18, Randint (256, 256, [0,255], 18) This command produces a random image of size 256 x 256. The gray levels of the generated image are in the range 0 to 255. Fig 3. Bio Metric Database Management System 6. Encryption for Template Protection The role of Encryption is to secure information when it is stored or in transit [9]. In cryptography, encryption is the process of transforming information (referred to as plaintext) using an algorithm to make it unreadable to anyone except those possessing special knowledge, usually, referred to as a key. The result of this process is encrypted information (in cryptography, referred to as cipher text). 6.1 PN Sequence for encryption PN sequences look like a random noise but they are not purely random in nature. When we multiply the PN sequence with the signature template, the resulting image resembles noise. However, during decryption, this noise-like signal can be used to exactly reconstruct the original image by multiplying it by the same pseudorandom sequence. Using this scheme, the initial seed state which is nothing but the key is only needed to generate exactly the same sequence of length. We have decided the following algorithm to generate the seed state for the PN sequence generator. 7. MySQL for Database Management MySQL is the most popular open source SQL database management system distributed by Oracle Corporation. The SQL part of MySQL stands for structured Query language. MySQL server was originally developed to handle large databases much faster than existing solutions. Its connectivity, speed and security make MySQL server highly suited for accessing databases on the internet [10]. A data base is a structure that comes in two types: a flat data base and a relational database. A relational database is much oriented to the human mind and is often preferred over flat database that are just stored on the hard drives like a text file. MySQL is a relational database. In relational database, the data is stored in a tabular format. The columns define which kind of information will be stored in the table. An individual column must be created for each type of data you wish to store like age, weight and height. On the other hand, a row contains the actual values for these specified columns. Each row will have one value for each and every column. For example, a table with columns name, age and weight could have a row with values John, 15, 75. Important features of MySQL are 1. It works on different platforms. 116

4 2. It has lots of column types like signed and unsigned integers upto 8 bytes long, float double, blob, char and varchar 3. A privilege and password system which is very flexible and secure 4. Handles large database 8. Interfacing MATLAB with MySQL To improve the security of the system, we have stored our templates in the password protected MySQL server. Only the authorized user will be able to access the data base. Matlab database toolbox does not support the data types blob and long blob. Hence custom functions were developed in Matlab which were written in native java for long blob database calls. To store the templates in the server, we have followed the following steps. In the first step, we have initialized MySQL server by entering the server name, user name and the password. 1. Since we are dealing with signature recognition, we have created a table in the data base with the name, signature. 2. The row and columns of the table are initialized such that the row entry consists of the identity of the image and the column entry will have the binary values associated with the given image. Now the MySQL server is ready to accept the signature templates. 3. Through the following Matlab subroutine, the connection between the MYSQL server and Matlab is established. function con = getdbconnection() url 'jdbc:mysql://localhost:3306/'; Database = input('enter database name '); url = [url Database]; username = input('enter user name for database); password = input('enter password '); con java.sql.drivermanager.getconnection (url,username,password); 4. The templates which we want to protect in the data base have been imported to Matlab work space using the following subroutine function out = copyimg2workspace(di) cpdir = input('enter the directory path to copy '); imgdir = [pwd '\' di]; copyfile(cpdir,imgdir); addpath([pwd '\' di]); out = imgdir; 5. We have written the matlab function which will specify the source folder in Matlab workspace and the Destination folder in the database to copy the templates into the database. Once we run the function, the complete template folder will be moved into the database. function out = insertimg2db(con,imgdir,dbtable) import java.io.file import java.io.fileinputstream import java.sql.preparedstatement import javax.activation.mimetypesfiletypemap 6. To modify the database, another Matlab function is written which will specify a folder in Matlab workspace as a destination folder and the source folder as the database folder. Once the modifications are done like adding some templates and deleting some templates, again we can store the database in the server. function out = getdb2im (con,imgdir,format,imgtable) import java.io.file import java.sql.preparedstatement import java.awt.image.bufferedimage import javax.imageio.imageio query = ['SELECT * FROM ' imgtable]; smt = con.preparestatement(query); res = smt.executequery(); imgdir = [pwd '\' imgdir]; Since the entire operation is password protected, for an adversary without knowing the password, it will be difficult to access the database. Hence we have improved the security of our database. 9.Implementation and Results During the enrolment phase, the collected signature samples are preprocessed, and then encrypted using the PN image. The cipher templates thus generated are saved in the MySQL server. During the authentication phase, the person who wants to be authenticated is provided with the digital tablet for the purpose of collecting query signature sample. Feature vectors from this test signature are extracted using discrete wavelet transform (DWT) [11, 12]. Now the data base has been brought to Matlab workspace from MySQL server for comparison. Since the store templates are in encrypted form, first they are decrypted by combining with same the PN sequence which is generated using seed number 18. As 117

5 M Mani Roja et al,int.j.computer Techology & Applications,Vol 3 (1), a result, we get the original signature template. The following fig.4 shows the encryption and decryption process of an example signature template. Signature Template PN image 9. Acknowledgement Our sincere thanks to Mr. Jaikumar Bhambhwani, TSEC, who has contributed towards interfacing MATLAB with MySQL server. Encrypted Template Decrypted Template Fig 4: Encryption and Decryption of Signature Template Now the Feature vectors are extracted from the restored templates and compared with query template feature vectors. Match scores are generated using Euclidean distance classifier. If there is a match, authentication is granted otherwise, the person is rejected. Once the decision is taken, the data base signatures after encryption have been removed from the Matlab workspace and then sent back to MySQL server to maintain security. 8. Conclusion We have developed an easy and secure approach for the protection of biometric database protection using MySQL server. Since, the templates are stored in encrypted form; the security of the system is enhanced. Our system is found to be working successfully. In future to improve the security, we are planning to store the hash function of the given biometric template along with the template in the database. Once the image is called for training purpose from the database, the same hash function will be generated and it will be compared with the extracted database. REFERENCES [1] Anil K. Jain, Arun Ross and Salil Prabhakar, An Introduction to Biometric Recognition, IEEE Transactions on Circuits and Systems for Video Technology, Special Issue on Image- and Video-Based Biometrics, Vol. 14, No. 1, January [2] Sulochana Sonkamble, Ravindra Thool, Balwant Sonkamble, Survey of Biometric Recognition Systems and their applications, Journal of Theoretical and Applied Information Technology, [3] Payman Moallem1, Seyed Amirhassan Monadjemi, Dynamic Online Signatures Recognition using a novel Signature base normalized feature string and MLP Neural Network, Iranian Journal of Engineering sciences, Vol.1, No.1,2007. [4] Lin Hong and Anil Jain, Integrating Faces and Fingerprints for Personal Identification, IEEE Transactions on Pattern Analysis and Machine Intelligence, Vol.20, No.12, December [5] Arun Ross, Anil Jain, Information fusion in biometrics, Pattern Recognition Letters 24, (2003) [6] N. K. Ratha, J. H. Connell, and R. M. Bolle, An analysis of minutiae matching strength, in Proceedings of the 3rd International Conference on Audio- and Video-Based Biometric Person Authentication (AVBPA 01), pp , Halmstad, Sweden,June [7] Anil K. Jain, Karthik Nandakumar, and Abhishek Nagar, Biometric Template Security, EURASIP Journal on Advances in Signal Processing, Volume 2008, Article ID [8]Manvjeet Kaur, Sanjeev Sofat and Deepak Saraswat, Template and Database Security in Biometric Systems: A Challenging Task, International Journal of Computer Applications, Volume 4-No.5, July [9] William Stallings Network Secrity and Cryptograpgy, Pearson Education 4 th editon. [10] reference date 28 th of May [11] Rafael C. Gonzalez, Richard E. Woods, Digital Image Processing, 2 nd edition, Prentice Hall,Newyork, Sept [12] S. Jayaraman, S Esakkirajan, T Veerakumar, Digital Image Processing, by Mc Graw Hill,