Ulrike Korte

Biometric template protection

ZusammenfassungBiometrische Systeme sind zwar technisch weit ausgereift und bieten heute Erkennungsleistungen, die noch vor 10 Jahren unerreichbar waren. Jedoch ist ein weit verbreiteter Einsatz von biometrischen Authentisierungsverfahren durch Bedenken hinsichtlich des notwendigen Schutzes von Referenzdaten gebremst. Eine sichere und datenschutzfreundliche Verarbeitung von biometrischen Daten wird möglich, wenn Template Protection Verfahren zum Einsatz kommen. Diese Verfahren wurden in einer wissenschaftlichen Studie (BioKeyS-Pilot-DB Teil 2) des Bundesamtes für Sicherheit in der Informationstechnik (BSI) untersucht. Dieser Artikel berichtet über die Ergebnisse im Projekt. Er zeigt auf, wie Mechanismen zum Schutz von biometrischen Daten mit Zusatzinformationen z.B. Passwörtern verknüpft und wie die Verfahren auch in Identifikationssystemen eingesetzt werden können.

Improved Fuzzy Vault Scheme for Alignment-Free Fingerprint Features

The fuzzy vault scheme is one of the most prominent tools for protecting fingerprint templates, typically being minutiae-based. However, there exist two major problems. Firstly, the fuzzy vault scheme is vulnerable to attacks correlating different templates of the same user. Secondly, auxiliary alignment data may leak information about the protected fingerprints which negatively affects security and privacy. In this paper, we tackle both problems. Our implementation uses alignment-free fingerprint features and fusions thereof, thereby removing the need to store alignment parameters. Furthermore, the features are passed through a quantization scheme and then dispersed in a maximal number of chaff, thereby thwarting correlation attacks.

Enhanced template protection with passwords for fingerprint recognition

Template protection is an important supplementary to biometric systems for enhancing security and privacy protection. Its recognition and security performance is limited by inherent properties of the biometric modalities and the biometric systems used. Combining additional secret information such as PIN or password will be a promising way to improve the performance. The fuzzy vault is a widely-used cryptographic scheme to protect fingerprint minutiae. In this paper, we propose a novel method, which generates artificial minutiae from a PIN or password. A fused feature set including genuine and artificial minutiae is used to generate a protected template. The insertion of artificial minutiae increases the secret length as well as the robustness in the fuzzy vault. Our experimental results on the NIST SD 14 database show that both false match rate and false non-match rate are reduced in comparison with the original fuzzy vault method. Mean-while, the crucial security factors such as the degree of the polynomial and the length of secret are enlarged. Additionally, the original method is vulnerable to linkage attacks. The proposed method improves the resistance against this attack.

Xtarp: Improving the Tented Arch Reference Point Detection Algorithm

In 2013, Tams et al. proposed a method to determine directed reference points in fingerprints based on a mathematical model of typical orientation fields of tented arch type fingerprints. Although this Tented Arch Reference Point (TARP) method has been used successfully for pre-alignment in biometric cryptosystems, its accuracy does not yet ensure satisfactory error rates for single finger systems. In this paper, we improve the TARP algorithm by deploying an improved orientation field computation and by integrating an additional mathematical model for arch type fingerprints. The resulting Extended Tented Arch Reference Point (xTARP) method combines the arch model with the tented arch model and achieves a significantly better accuracy than the original TARP algorithm. When deploying the xTARP method in the Fuzzy Vault construction of Butt et al., the false non-match rate (FNMR) at a security level of 20 bits is reduced from 7.4% to 1.7%.

Die Technische Richtlinie zur vertrauenswürdigen elektronischen Langzeitspeicherung (TR-VELS)

ZusammenfassungIn vielen Bereichen der öffentlichen Verwaltung, der Justiz und der Unternehmen besteht das Bestreben, Geschäftsprozesse umfassend zu digitalisieren und damit ausschließlich in elektronischer Form durchzuführen. Ziel der TR-VELS ist es, ein Rahmenwerk für die vertrauenswürdige elektronische Langzeitspeicherung zu definieren, um so die Authentizität, Integrität und Verkehrsfähigkeit gespeicherter Daten während der gesetzlichen Aufbewahrungsfristen sicherzustellen.