Abstract
Biometric authentication in wearable devices is different from the common biometric authentication systems. First of all, sensitive information such as fingerprint and iris of a user is stored in a wearable device owned by the user rather than being stored in a remote database. Wearable devices are portable, and there is a risk that the devices might be lost or stolen. In addition, the quality of the extracted image from the wearable devices is lower than that of the common biometric acquisition sensor. In the paper, we propose a novel cancelable fingerprint template which is irreversible to the original biometrics and has excellent accuracy even in low quality images.
1. Introduction
Biometrics is a physical or behavioral characteristic of an individual. Commonly, knowledge-based and token-based recognition can be easily forgotten, lost, stolen, or shared. Biometrics is more difficult to be forgotten, lost, or shared. And it has universality, distinctiveness, and permanence [1]. Therefore, biometrics is used as a tool for authentication in a variety of environments. With advances in sensor technology, user biometric recognition on wearable devices has become popular in recent years. Authentication with sensor-equipped wearable devices offers many advantages over existing authentication methods. Previous authentication has fixed sensors and biometric information is stored on connected databases managed by the third party. On the other hand, biometrics used in the wearable devices can perform continuous authentication of a user, and biometric information of the user is stored on a wearable device [2]. This means that the user does not need to share sensitive information with third parties. However, this approach causes other security problems. First, due to the property of wearable devices, sensors are limited in size. Then the quality of biometric information measured is necessarily low, resulting in a high error rate. Second, wearable devices can be worn and carried around by the user, which can cause the device to be lost or stolen. The adversary then has a chance to get the user biometrics. Cancelable template is suitable for this application. It makes it possible to revoke a compromised template and reissue by a new one. Cancelable template protection scheme is required to satisfy the following requirements [3]:(i)Revocability: The transformed template should be possible to be revoked and replaced. The requirement is necessary, because if the transformed biometric template is compromised, it should be revoked and replaced with a new one based on the same user’s biometric information.(ii)Unlinkability: It should be impossible to link the transformed templates of the same user. The requirement is necessary, because if the user has made a new transformed template after the user’s old transformed template is revoked, it might be desirable that the two transformed templates look independent.(iii)Noninvertibility: It must be computationally difficult to obtain the original template from the transformed template. Consequently, the template matching must be done between the transformed templates(iv)Performance: The performance of the biometric recognition using template transformation should be plausibly efficient compared to the performance of the biometric recognition without transformation.
Design of cancelable fingerprint template is divided into alignment methods and alignment-free methods. Alignment methods need the position and orientation of the singular points and align minutiae with them. So, accuracy of alignment based technique depends on how precise the singular points are extracted. However, it is hard to precisely determine the core and delta (singular) points [4]. Alignment-free methods rely on the local structures of minutiae which is invariant rotation and translation. Minutiae extraction is much simpler than singular extraction. Then alignment-free based technique has higher accuracy in low quality images.
We propose a novel alignment-free features of the Delaunay triangle which is robust against low quality fingerprint images [5, 6]. We organized rest of the paper as follows. In Section 2, we review cancelable fingerprint template approaches. In Section 3, we present the proposed method. We comparing existing cancelable fingerprint template with experimental results are analysed in Section 4. The last section includes conclusion.
2. Related Works
The simple approach to protect sensitive information like biometrics is to use encryption or hash function. It is hard to infer from the transformed information to original information. This is an important property in protecting information. However, these functions produce a dramatically different output even with small changes in the input. In practice, all biometric traits are easily affected by the environment. For example, changes in illumination can make a large variation in the appearance of faces. The biometric encryption schemes are promising in some environments, but they might not be directly used in the other environments. We note that the encrypted template should be decrypted in order to be matched with the query template, and thus we need to trust the server.
To overcome limitations of the existing biometric authentication system, many biometric template protection methods have been proposed. Ratha et al. analyzed the vulnerabilities of the existing system and first proposed the concept of a cancelable biometric as a way to resolve them [7]. Ahn et al. have proposed alignment-free fingerprint cancelable template using minutia triplets [8]. Ahmad et al. used rotation- and translation-free polar coordinate instead of Cartesian coordinate for information between minutia points [9]. Ferrara et al. have developed cancelable fingerprint template based on MCC (Minutia Cylinder-Code) [10–12]. Sandhya et al. have utilized Delaunay triangulation for creation fingerprint features [13]. Wang et al. have proposed a cancelable fingerprint template formed zoned minutia pair [14].
Yang et al. have proposed a cancelable fingerprint template on mobile devices [15]. To mitigate the effect of distortion, the authors combined two features, polar coordinate-based features, and Delaunay triangulation-based features. Therefore, their scheme requires more storages to store the combined features. For example, the fingerprint image 1_1.tif in FVC2002 DB2 is transformed as the protected template whose size is 148.2 KB [15]. On the other hand, our scheme requires just 2.27 KB for the same image 1_1.tif. Therefore, our proposed scheme is about 65 times more efficient than the Yang et al.’s scheme and thus more suitable for wearable devices with limited storage.
Even though all these researches have the EER less than 1% of medium and high quality fingerprint images in FVC databases, they have high EER almost 10% on low quality images in FVC2002 DB3 and FVC2004 DB2 fingerprint databases. Our proposed approach in this paper provides a solution to prior studies and satisfy requirements of cancelable fingerprint template.
3. Noise-Resistant Cancelable Fingerprint Template
The main idea of the proposed method for cancelable fingerprint template is to generate 4-dimensional points using the extracted triangles that belong to the individual. These 4-dimensional points are used as a secured fingerprint template for user authentication.
3.1. Delaunay Triangulation Net
Extract the minutiae points , where is the number of minutiae, in the fingerprint image. and represent the coordinates and orientation of minutiae, respectively. A Voronoi diagram which divides the entire region into some small partitions is generated from the minutiae points. In each small region, a minutia point is only one. Other points in neighbor areas are closer to than other minutiae points. Then, Delaunay triangulation net is created by connecting between the minutiae of every region and its neighbor regions [5] (see Figure 1). The reason for using the Delaunay triangulation net is that it is structurally more stable under distortion. If any variable distortion is occurring in fingerprint image, every minutia holds the same vicinity structure as long as the minutiae under tolerance region. And several spurious minutiae are added or missed affects only those regions that contain the minutiae [6].
(a)
(b)
(c)
3.2. Noise-Resistant Feature Extraction
We used interior angles of each triangle as a feature in the Delaunay triangulation net. The main steps of extraction features are the following:(i)Select a triangle from Delaunay triangulation net as shown in Figure 2(a).(ii)Compute the directions of the vectors from the centroid of the triangle to each vertex .(iii)Calculate the included angle (interior angle) between the normalized vectors from each minutia to the remaining minutiae.(iv)Align the calculated interior angles in ascending order of .(v)Repeat the above procedures for each triangle.
(a)
(b)
Figure 2(b) shows the diagram of proposed triangle features. If triangles are present in the fingerprint, the proposed feature set is a matrix of interior angles.
3.3. Generation of 4D Feature Set
Using the user-specific key, features set of 3-dimensional point is projected to 4-dimensional space. It is set differently by applications, which enables 4D template to be diverse. The user-specific key is 3 by 4 matrix which elements are randomly chosen in the range . The projected 4-dimensional features set is calculated by multiply 3-dimensional features set and user-specific key. Figure 3 shows the process of creating the proposed feature.
The size of the key matrix is determined experimentally. We conducted an experiment with various feature dimensions, from 1 to 5 dimensions (see Table 1). As the dimension increases, the EER (Equal Error Rate, mentioned in Section Experimental Analysis) greatly decreases. On the other hand, the size of the template is linearly increased proportional to the dimension of features. We note that the EER with the four dimensions seems to be sufficient for many applications. And the template size with the four dimensions is still small and thus adequate for devices with the limited storage.
3.4. Matching
Matching between the enrolled template and the query template depends on how many triangles are matched each other. Assuming that the numbers of triangles matched between and are , the numbers of triangles of and are and , respectively, the similarity score is calculated byIf is larger than a threshold, then these two templates are regarded as a match.
4. Experimental Analysis
In this section, we evaluate the proposed technique on FVC2002 DB1, DB2, DB3, and FVC2004 DB2 fingerprint databases, using the Fingerprint Verification Competition protocol [16].
4.1. Experimental Procedure
The trial version of Neurotechnology VeriFinger SDK 11 which is commercial software is used to extract minutiae from the fingerprint images [17]. Each FVC databases contain 800 fingerprint sample images from 100 distinct subjects (i.e., each subject has 8 different images from same finger). These databases have different quality images because they were created using different types of fingerprint sensors. Details of each database are in Table 2.
To assess whether the proposed method meets the requirements of the cancelable template, focus on the following:(i)Performance of lost key scenario(ii)Revocability and unlinkability(iii)Security
Our experiments use Equal Error Rate (EER), False Accept Rate (FAR), and False Reject Rate (FRR) to measure performance. FAR is the probability that two fingerprint templates from different subjects successfully matched. FRR is the probability that two fingerprint templates from the same subject failed to match. EER means the probability that FAR and FRR are equal. The values indicating performance are calculated from the genuine test and the imposter test. According to the FVC protocol, the genuine test compares the subject’s fingerprint template with the remaining fingerprint templates of the same subject and calculates the distribution of the similarity score (i.e., test results in this case). The imposter test compares the subject’s first fingerprint template with the other subject’s first fingerprint template and calculates the distribution of the similarity score (i.e., test results in this case).
4.2. Performance of The Lost Key Scenario
Lost key scenario is the worst scenario, assuming that the user has lost the secret key or that the attacker knows the secret key. We simulated this scenario by applying the same key to all of the subjects being tested. The differences between the proposed technique and the previous alignment-free cancelable fingerprint techniques are summarized in Table 3. In previous methods, the EER was very high in low quality images (FVC2002 DB3, FVC2004 DB2), but the proposed technique did not change EER significantly in low quality images. The existing methods used fingerprint features were the relative angles and distances between minutiae. To calculate orientation of minutia, the orientation map or direction of ridge must be exactly calculated. In low quality fingerprint images, and it is difficult to maintain the accuracy of calculations due to noise. Figure 4 shows the different directions of the same minutia. Our method shows powerful performance on FVC2002 DB3 and FVC2004 DB2, and this performance is similar to the accuracy of other methods on FVC2002 DB1 and DB2.
(a)
(b)
4.3. Revocability and Unlinkability
To satisfy the revocability, even if the template is compromised by the adversary, the new template from the same biometric data to be replaced should not be related to the previous template. We assess the robustness of the proposed method against revoked template attack [11]. In the revoked template attack, there are following two scenarios: Type-I: a revoked template is used to match a new template from same fingerprint image using different key Type-II: a revoked template is used to match a new template from different fingerprint image of same fingerprint using different key
These scenarios have been measured under medium security level (used matching threshold is 0.1% FAR) and high security level (used matching threshold is 0% FAR) on four databases. Table 4 shows the success rate of simulated attacks.
Unlinkability is important property of cancelable template aspect to privacy. If two templates created by same fingerprint in different applications are not associated, it is said to satisfy unlinkability. To simulate unlinkability, our experiment sets two systems. For System 1, we randomly chose the secret key in the range and chose randomly the secret key in the range for System 2. Each fingerprint template in System 1 is compared with fingerprint template of same subject in System 2 to evaluate the Pseudogenuine score. Figure 5 shows that Genuine/Pseudo-Genuine score distributions. We used the separability measure proposed by Lee et al. [24]. (i) and : the means of genuine and pseudo-genuine score distributions(ii) and : the variances of genuine and pseudo-genuine score distributions
(a)
(b)
(c)
(d)
The histograms are well separated. The separability of FVC2002 DB1, DB2, DB3, and FVC2004 DB2 is 7.33, 8.7, 7.9, and 9.57, respectively. It means that the template generated by proposed method has robustness against cross-matching.
4.4. Security
Noninvertibility of cancelable template ensures that it is computationally impossible to reconstruct the original biometrics from the transformed template. For the security analysis, [13] assume that the adversary attacks the feature set scenario. In [13], they have used three sides of Delaunay triangle to make a feature set. The triangles in the Delaunay triangulation net are adjacent to each other. Therefore, the adjacent triangles have the same length with respect to one of side lines. Finally, the Delaunay triangulation net made of the minutia points can be reconstructed from the feature set. This helps to know the approximate fingerprint minutia positions. Our feature set does not include the length of the triangle sides, and thus it is impossible to reconstruct the Delaunay triangles from our feature set. Note that our feature set includes only the information about the interior angles, and thus it is difficult to find the adjacent triangles for a given triangle.
5. Conclusion
This paper presented a new method to create accurate cancelable fingerprint templates even in low quality databases. Our method is based on the novel feature set from Delaunay triangles for fingerprint minutiae. Our proposed scheme meets revocability, unlinkability, security, and performance, which are required for template protection. The proposed approach is suitable for environments with limited sensor performance, such as wearable devices. This method will further improve the accuracy of user authentication using wearable devices.
Data Availability
Data used to support the findings of this study are included with in the article
Conflicts of Interest
The authors declare that there are no conflicts of interest regarding the publication of this paper.
Acknowledgments
This research was supported by the MIST (Ministry of Science and ICT), Korea, under the National Program for Excellence in SW supervised by the IITP (Institute for Information & communications Technology Promotion) (2015-0-00936).