Biometric Hash Research Articles

Vulnerabilities in One Time Passwords and Protection Method Using Secret Key and Biometric Hash Code

In the present era, conducting financial transactions online is both simple and widely embraced for its convenience. However, engaging in internet-based financial transactions exposes individuals to potential threats like password attacks, malware, phishing, and other illicit activities. Recognizing these risks, many banks have enhanced security measures by incorporating One-Time Password (OTP) authentication alongside traditional login credentials. Despite these improvements, security issues persist in online transactions. To mitigate such concerns, OTPs can be delivered via SMS to the account owner's mobile number. Even with heightened security, internet banking remains susceptible to various attacks, including online phishing, Man-in-the-Middle attacks, SQL injection, and brute force attacks. To address these challenges, this proposed model introduces a Biometric mobile OTP-based transaction authentication method.

Co-Learning to Hash Palm Biometrics for Flexible IoT Deployment

Security enhancement via trustworthy identity authentication in Internet of Things (IoT) has soared recently. Biometrics offers a promising remedy to improve the security and utility of IoT and play a role in securing a variety of low-power and limited computing capability IoT devices to address identity management challenges. This article proposes an IoT-compliant co-learned biometric hashing network derived from palm print and palm vein dubbed PalmCohashNet. The PalmCohashNet comprises two hashing subnetworks, one for each palm modality, and is trained collaboratively to generate shared hash codes for respective modality (co-hash codes). A cross-modality hashing (CMH) loss is devised to encourage co-hash codes of palm vein and palm print from the same identity to be adjacent and consistent; meanwhile, pull the co-hash codes of each identity to a preassigned identity-specific hash centroid that is shared by both palm modalities. Two palm-based co-hash codes of a person can be generated simultaneously for deployment. The binary co-hash code is IoT compliant attributed to its highly compact form for storage and fast matching. A trained PalmCohashNet can be flexibly deployed under four operation modes: single-modality matching (print versus print or vein versus vein), multimodality matching where both print and vein are utilized, and cross-modality matching (print versus vein) depending on the IoT service context. Our empirical results on four publicly available palm databases show that the proposed method consistently outperforms state-of-the-art methods.

A general framework for secure biometric hashing against reconstruction attacks

A general framework for secure biometric hashing against reconstruction attacks

Secure biometric hashing against relation-based attacks via maximizing min-entropy

With its irreversibility, low computational cost, and high storage efficiency, biometric hashing is widely used in privacy-preserving biometric recognition systems, yet its security has been recently challenged due to the emergence of relation-based attacks (RA). To address this issue, we model and analyse the RA, and discover that maximizing the conditional min-entropy of the signs of inter-class distance differences in the original space and hash space can minimize the leakage of the distance relation on the original biometric. Consequently, we develop a Secure Biometric Hashing scheme against Relation-Based Attacks (SBH-RA). SBH-RA maximizes the conditional min-entropy by using the cosine function as a distance mapping function. Meanwhile, it learns hash codes by a classification loss and quantization loss to ensure the accuracy of recognition. Our study demonstrates that SBH-RA not only offers higher security but also yields comparable or even superior recognition performance over existing biometric hashing methods experimentally and theoretically. Given 1024 bits hash codes from SBH-RA, it brings a decrease of 21% in Equal Error Rate on face dataset LFW compared with widely used Biohashing. Besides, even under white-box attacks, the probability of a successful attack is smaller than 1.69×2−346.

Long sequence biometric hashing authentication based on 2D-SIMM and CQCC cosine values

Long sequence biometric hashing authentication based on 2D-SIMM and CQCC cosine values

A deep biometric hash learning framework for three advanced hand‐based biometrics

A deep biometric hash learning framework for three advanced hand‐based biometrics

Masquerade attack on biometric hashing via BiohashGAN

Masquerade attack on biometric hashing, which reconstructs the original biometric image from the given hashcode, has been given much attention recently. It is mainly used to validate the security of biometric recognition system or expand existing biometric databases like face or iris. However, an existing state-of-the-art method tends to ignore the perceptual quality of synthesized biometric images in the attack, and consequently, the synthetic images can be easily differentiated from real images. To obtain the high-perceptual-quality image which can simultaneously pass the validation of recognition system, we introduce a new target combining semantic invariability in hashing space and perceptual similarity in biometric space. In order to simulate the mapping from images to hashcodes and tackle the derivative problem related to discrete hashcodes in hashing space, we propose a DNN-based network named SimHashNet. Then we incorporate the SimHashNet into a generative adversarial network as our model named BiohashGAN to generate synthetic images form hashcodes. Experiment result on dataset CASIA-IrisV4.0-Interval and CMU PIE demonstrates that the synthetic images obtained from our model can pass the validation of recognition system and simultaneously maintain high perceptual quality.

Deep Secure Quantization: On secure biometric hashing against similarity-based attacks

Abstract The widespread application of biometric recognition has emerged solid protection on the privacy of biometric templates. Non-invertible transformations such as random projections are popular solutions for this purpose, yet their security has been recently challenged due to the advent of similarity-based attacks (SA). To address this issue, we developed Deep Secure Quantization (DSQ), a new biometric hashing scheme for privacy-preserving biometric recognition. DSQ essentially takes into account the information leakage between the original distance and the hashed distance, which is the security blind spot of existing hashing models. This leakage is further incorporated into an optimal hashing objective which well balances between security and utility. Hashing is then modeled as a highly nonlinear problem solved by a novel deep neural network. Experiments on CASIA-v4-interval demonstrate that DSQ not only offers strong resistance to SA but also yields comparable or even superior recognition performance over existing biometric hashing methods, including deep framework-based ones.

A Novel Digital Signature Algorithm based on Biometric Hash

A Novel Digital Signature Algorithm based on Biometric Hash

Practical security and privacy attacks against biometric hashing using sparse recovery

Biometric hashing is a cancelable biometric verification method that has received research interest recently. This method can be considered as a two-factor authentication method which combines a personal password (or secret key) with a biometric to obtain a secure binary template which is used for authentication. We present novel practical security and privacy attacks against biometric hashing when the attacker is assumed to know the user’s password in order to quantify the additional protection due to biometrics when the password is compromised. We present four methods that can reconstruct a biometric feature and/or the image from a hash and one method which can find the closest biometric data (i.e., face image) from a database. Two of the reconstruction methods are based on 1-bit compressed sensing signal reconstruction for which the data acquisition scenario is very similar to biometric hashing. Previous literature introduced simple attack methods, but we show that we can achieve higher level of security threats using compressed sensing recovery techniques. In addition, we present privacy attacks which reconstruct a biometric image which resembles the original image. We quantify the performance of the attacks using detection error tradeoff curves and equal error rates under advanced attack scenarios. We show that conventional biometric hashing methods suffer from high security and privacy leaks under practical attacks, and we believe more advanced hash generation methods are necessary to avoid these attacks.

Error-Correcting Output Codes Guided Quantization for Biometric Hashing

In this paper, we present a new biometric verification system. The proposed system employs a novel biometric hashing scheme that uses our proposed quantization method. The proposed quantization method is based on error-correcting output codes which are used for classification problems in the literature. We improve the performance of the random projection based biometric hashing scheme proposed by Ngo et al. in the literature [5]. We evaluate the performance of the novel biometric hashing scheme with two use case scenarios including the case where an attacker steals the secret key of a legitimate user. Simulation results demonstrate the superior performance of the proposed scheme.

An Authentication Protocol Based on Combined RFID-Biometric System

Radio Frequency Identification (RFID) and biometric technologies saw fast evolutions during the last years and which are used in several applications, such as access control. Among important characteristics in the RFID tags, we mention the limitation of resources (memory, energy, …). Our work focuses on the design of a RFID authentication protocol which uses biometric data and which confirms the secrecy, the authentication and the privacy. Our protocol requires a PRNG (Pseud-Random Number Generator), a robust hash function and Biometric hash function. The Biometric hash function is used to optimize and to protect biometric data. For Security analysis of protocol proposed, we will use AVISPA and SPAN tools to verify the authentication and the secrecy.

Securing fuzzy vault schemes through biometric hashing

The fuzzy vault scheme is a well-known technique to mitigate privacy, security, and usability related problems in biometric identification applications. The basic idea is to hide biometric data along with secret information amongst randomly selected chaff points during the enrollment process. Only the owner of the biometric data who presents correct biometrics can recover the secret and identify himself. Recent research, however, has shown that the scheme is vulnerable to certain types of attacks. The recently proposed ``correlation attack'', that allows linking two vaults of the same biometric, pose serious privacy risks that have not been sufficiently addressed. The primary aim of this work is to remedy those problems by proposing a framework based on distance preserving hash functions to render the correlation attack inapplicable. We first give definitions which capture the requirements such hash functions must posses. We then propose a specific family of hash functions that fulfills these requirements and lends itself to efficient implementation. We also provide formal proofs that the proposed family of hash functions indeed protects the fuzzy vault against correlation attacks. We implement a hashed fuzzy vault using fingerprint data and investigate the effects of the proposed method on the false accept and false reject rates (FAR and FRR, respectively) extensively. Implementation results suggest that the proposed method provides a complete protection against correlation attacks at the expense of small degradation in the FRR.

Secure Hashing of Dynamic Hand Signatures Using Wavelet-Fourier Compression with BioPhasor Mixing and Discretization

We introduce a novel method for secure computation of biometric hash on dynamic hand signatures using BioPhasor mixing and 2N discretization. The use of BioPhasor as the mixing process provides a one-way transformation that precludes exact recovery of the biometric vector from compromised hashes and stolen tokens. In addition, our user-specific 2N discretization acts both as an error correction step as well as a real-to-binary space converter. We also propose a new method of extracting compressed representation of dynamic hand signatures using discrete wavelet transform (DWT) and discrete fourier transform (DFT). Without the conventional use of dynamic time warping, the proposed method avoids storage of user's hand signature template. This is an important consideration for protecting the privacy of the biometric owner. Our results show that the proposed method could produce stable and distinguishable bit strings with equal error rates (EERs) of 0% and 9.4% for random and skilled forgeries for stolen token (worst case) scenario, and 0% for both forgeries in the genuine token (optimal) scenario.

Biometric hash: high-confidence face recognition

In this paper, we describe a biometric hash algorithm for robust extraction of bits from face images. While a face-recognition system has high acceptability, its accuracy is low. The problem arises because of insufficient capability of representing features and variations in data. Thus, we use dimensionality reduction to improve the capability to represent features, error correction to improve robustness with respect to within-class variations, and random projection and orthogonalization to improve discrimination among classes. Specifically, we describe several dimensionality-reduction techniques with biometric hashing enhancement for various numbers of bits extracted. The theoretical results are evaluated on the FERET face database showing that the enhanced methods significantly outperform the corresponding raw methods when the number of extracted bits reaches 100. The improvements of the postprocessing stage for principal component analysis (PCA), Wavelet Transform with PCA, Fisher linear discriminant, Wavelet Transform, and Wavelet Transform with Fourier-Mellin Transform are 98.02%, 95.83%, 99.46%, 99.16%, and 100%, respectively. The proposed technique is quite general, and can be applied to other biometric templates. We anticipate that this algorithm will find applications in cryptographically secure biometric authentication schemes.

Handwriting: Feature Correlation Analysis for Biometric Hashes

In the application domain of electronic commerce, biometric authentication can provide one possible solution for the key management problem. Besides server-based approaches, methods of deriving digital keys directly from biometric measures appear to be advantageous. In this paper, we analyze one of our recently published specific algorithms of this category based on behavioral biometrics of handwriting, the biometric hash. Our interest is to investigate to which degree each of the underlying feature parameters contributes to the overall intrapersonal stability and interpersonal value space. We will briefly discuss related work in feature evaluation and introduce a new methodology based on three components: the intrapersonal scatter (deviation), the interpersonal entropy, and the correlation between both measures. Evaluation of the technique is presented based on two data sets of different size. The method presented will allow determination of effects of parameterization of the biometric system, estimation of value space boundaries, and comparison with other feature selection approaches.