Leakage-resilient biometric-based remote user authentication with fuzzy extractors

Abstract

Fuzzy extractors convert biometrics and other noisy data into a cryptographic key for security applications such as remote user authentication. Leakage attacks, such as side channel attacks, have been extensively modelled and studied in the literature. However, to the best of our knowledge, leakage attacks to biometric-based remote user authentication with fuzzy extractors have never been studied rigorously. In this paper, we propose a generic framework of leakage-resilient and privacy-preserving biometric-based remote user authentication that allows an authorized user to securely authenticate herself to a remote authentication server using her biometrics. In particular, the authorized user relies only on her secret biometrics to perform a valid authentication — which is suitable for user authentications in a cross-platform setting.