Johannes Merkle

Biometric template protection

ZusammenfassungBiometrische Systeme sind zwar technisch weit ausgereift und bieten heute Erkennungsleistungen, die noch vor 10 Jahren unerreichbar waren. Jedoch ist ein weit verbreiteter Einsatz von biometrischen Authentisierungsverfahren durch Bedenken hinsichtlich des notwendigen Schutzes von Referenzdaten gebremst. Eine sichere und datenschutzfreundliche Verarbeitung von biometrischen Daten wird möglich, wenn Template Protection Verfahren zum Einsatz kommen. Diese Verfahren wurden in einer wissenschaftlichen Studie (BioKeyS-Pilot-DB Teil 2) des Bundesamtes für Sicherheit in der Informationstechnik (BSI) untersucht. Dieser Artikel berichtet über die Ergebnisse im Projekt. Er zeigt auf, wie Mechanismen zum Schutz von biometrischen Daten mit Zusatzinformationen z.B. Passwörtern verknüpft und wie die Verfahren auch in Identifikationssystemen eingesetzt werden können.

Improved Fuzzy Vault Scheme for Alignment-Free Fingerprint Features

The fuzzy vault scheme is one of the most prominent tools for protecting fingerprint templates, typically being minutiae-based. However, there exist two major problems. Firstly, the fuzzy vault scheme is vulnerable to attacks correlating different templates of the same user. Secondly, auxiliary alignment data may leak information about the protected fingerprints which negatively affects security and privacy. In this paper, we tackle both problems. Our implementation uses alignment-free fingerprint features and fusions thereof, thereby removing the need to store alignment parameters. Furthermore, the features are passed through a quantization scheme and then dispersed in a maximal number of chaff, thereby thwarting correlation attacks.

Enhanced template protection with passwords for fingerprint recognition

Template protection is an important supplementary to biometric systems for enhancing security and privacy protection. Its recognition and security performance is limited by inherent properties of the biometric modalities and the biometric systems used. Combining additional secret information such as PIN or password will be a promising way to improve the performance. The fuzzy vault is a widely-used cryptographic scheme to protect fingerprint minutiae. In this paper, we propose a novel method, which generates artificial minutiae from a PIN or password. A fused feature set including genuine and artificial minutiae is used to generate a protected template. The insertion of artificial minutiae increases the secret length as well as the robustness in the fuzzy vault. Our experimental results on the NIST SD 14 database show that both false match rate and false non-match rate are reduced in comparison with the original fuzzy vault method. Mean-while, the crucial security factors such as the degree of the polynomial and the length of secret are enlarged. Additionally, the original method is vulnerable to linkage attacks. The proposed method improves the resistance against this attack.

Provable Security for the Fuzzy Fingerprint Vault

We investigate the security of privacy enhancing techniques for biometric applications. The fuzzy vault of Jules and Sudan is a technique that allows error tolerant authentication, while preserving the privacy of the reference data. Several publications have proposed its application to fingerprints in order to implement privacy-enhanced biometric authentication. While the heuristic security estimates given are promising, no rigid security analysis has been presented so far. We explore if and under what circumstances a provably secure fuzzy fingerprint vault can be implemented. Based on bounds on the loss of entropy for the general fuzzy vault and realistic models for minutiae distributions, we deduce lower bounds for attacks that attempt to recover the template. Furthermore, we show how to select optimal parameters and evaluate both, minimum minutiae match rates and minimum number of minutiae needed to obtain an appropriate security level. Our results indicate that a provable secure scheme is hard to achieve with current fingerprint technology.

Xtarp: Improving the Tented Arch Reference Point Detection Algorithm

In 2013, Tams et al. proposed a method to determine directed reference points in fingerprints based on a mathematical model of typical orientation fields of tented arch type fingerprints. Although this Tented Arch Reference Point (TARP) method has been used successfully for pre-alignment in biometric cryptosystems, its accuracy does not yet ensure satisfactory error rates for single finger systems. In this paper, we improve the TARP algorithm by deploying an improved orientation field computation and by integrating an additional mathematical model for arch type fingerprints. The resulting Extended Tented Arch Reference Point (xTARP) method combines the arch model with the tented arch model and achieves a significantly better accuracy than the original TARP algorithm. When deploying the xTARP method in the Fuzzy Vault construction of Butt et al., the false non-match rate (FNMR) at a security level of 20 bits is reduced from 7.4% to 1.7%.