Biometric Privacy Research Articles

The Use of Fuzzy Vault Technology to Find Out Fingerprint Differences

Fuzzy vault technology is different from biometric security and information recovery. In this article, we explore the utilization of fuzzy vaults in healthcare, because we can acquire crucial information like the vital signs of a person and the specific details of their fingerprint, even when there is limited information about the individual. We discuss both the conceptualized ideas that serve as the foundation for fuzzy vaults, as well as the practical application of these ideas to secure biological templates via biometric means. Our research involves both computer-simulated and actual case history data. Through this, we attempt to balance between preserving biometric privacy while still achieving a degree of identificable physiological variation. In our presentation, we demonstrate a hybrid of tabular data alongside visual illustrations that illustrate the association between different parameters regarding accuracy and the degree of difficulty associated with information recovery via fuzzy vaults. Let's consider the benefits and drawbacks of our options- elements like strength in security, precision, or the potential for application in limited spaces. To conclude this discussion without a definitive conclusion, but by pointing out what additional investigations should be conducted regarding the subject; likely medical advances caused by the adoption of new methods in medical settings should be noted.

PEBASI: A Privacy preserving, Efficient Biometric Authentication Scheme based on Irises

We introduce a novel privacy-preserving biometric authentication scheme based on irises that allows a user to enroll once at a trusted biometric certification authority (BCA) and authenticate to online service providers (SPs) multiple times without involving the BCA during the authentication. Our scheme preserves the user’s biometric privacy from the SPs and transactional privacy from the BCA, while providing security against a malicious user. During the enrollment, the BCA issues a signed token that encrypts the user’s biometrics. We introduce techniques enabling the SP and the user to perform secure computation of biometric matching between such encrypted biometrics and the user’s biometrics captured at the authentication time. We provide a prototype implementation, a performance evaluation, and a security analysis of the protocol.

PrivacyProber: Assessment and Detection of Soft–Biometric Privacy–Enhancing Techniques

PrivacyProber: Assessment and Detection of Soft–Biometric Privacy–Enhancing Techniques

Out of Hand: Why Federal Protection of Biometric Privacy is a Pressing Issue in U.S. Employment

Out of Hand: Why Federal Protection of Biometric Privacy is a Pressing Issue in U.S. Employment

A Secure, Flexible, and PPG-Based Biometric Scheme for Healthy IoT Using Homomorphic Random Forest

Advances in the Internet of Things such as biosensing and camera-capturing technologies have also resulted in biometric-based authentication approaches becoming more viable. Photoplethysmography (PPG), for example, can be leveraged to provide better biometric features for continuous authentication, in comparison to other biometrics such as fingerprint. However, the fewer morphological features in PPG signals can complicate the accurate authentication of PPG signals. Furthermore, one has to also consider transmission security and PPG template storage security. These two considerations are typically not taken into consideration in most existing PPG-based authentication schemes. Therefore, we design a secure PPG-based biometric system to achieve accurate authentication with biometric privacy protection. In our design, Homomorphic Random Forest is adopted to classify the homomorphically encrypted biometric features, thus protecting the user’s PPG biometrics from being compromised in authentication. Furthermore, beat qualification screening is set up to avoid the interference of unqualified signals, and 19 features with the least redundancy from the 541 features extracted are selected as the biometric features of the user. Doing so allows us to ensure the accuracy of authentication, as demonstrated in our evaluations using five PPG databases collected by three different collection methods (contact, remote, and monitor). In addition, our experiments adopt PPG signals acquired from remote cameras, which are not considered in other PPG-based biometric systems. The experimental results show that the average accuracy of our biometric system is 96.4%, the F1 score is 96.1%, the EER is 2.14%, and the authentication time is about 0.5s.

A Blurry Lens: Assessing the Complicated Legal Landscape of Biometric Privacy Through the Perspective of Mobile Apps

A Blurry Lens: Assessing the Complicated Legal Landscape of Biometric Privacy Through the Perspective of Mobile Apps

An effective iris biometric privacy protection scheme with renewability

Iris is considered a unique, robust biometric that can be used as an authentication factor. Privacy protection of individuals’ iris templates is an essential requirement. The essential attributes needed to ensure privacy of biometrics are irreversibility, renewability, and unlinkability. Information distortion is an effective way to achieve the privacy. However, this may lead to some degradation of recognition performance. A trade-off between recognition performance and the privacy level provided by the authentication system arises when it tries to provide both simultaneously. This paper proposes a novel approach that ensures the privacy of each individual's iris by distorting iris feature information. At the meantime, this approach balances the trade-off mentioned above up to a tolerable level. The binary feature templates of iris biometrics are transformed into another irreversible binary representation by manipulating them block-wise. The results obtained against two datasets using proposed approach illustrate excessive Genuine Acceptance Rates (GAR) when the approach accepts imposters at a rate which is reduced to 0.01 %. The proposed approach satisfies the three attributes that a biometric system should fulfil, namely irreversibility, renewability, and unlinkability. The renewability attribute induces the cancellability of iris biometric template. Compared to the existing works, the proposed approach maintains Equal Error Rate (EER) at 0.18 %.

A Symmetric Key and Elliptic Curve Cryptography-Based Protocol for Message Encryption in Unmanned Aerial Vehicles

Unmanned aerial vehicles have found applications in fields such as environmental monitoring and the military. Although the collected data in some of these application domains are sensitive, public channels are deployed during the communication process. Therefore, many protocols have been presented to preserve the confidentiality and integrity of the exchanged messages. However, numerous security and performance challenges have been noted in the majority of these protocols. In this paper, an elliptic curve cryptography (ECC) and symmetric key-based protocol is presented. The choice of ECC was informed by its relatively shorter key sizes compared to other asymmetric encryption algorithms such as the Rivest–Shamir–Adleman (RSA) algorithm. Security analysis showed that this protocol provides mutual authentication, session key agreement, untraceability, anonymity, forward key secrecy, backward key secrecy, and biometric privacy. In addition, it is robust against smart card loss, password guessing, known secret session temporary information (KSSTI), privileged insider, side-channeling, impersonation, denial-of-service (DoS), and man-in-the-middle (MitM) attacks. The comparative performance evaluation showed that it has relatively low computation, storage, and communication complexities.

Biometric privacy protection: What is this thing called privacy?

AbstractWe are at the wake of an epochal revolution, the Information Revolution. The Information Revolution has been accompanied by the rise of a new commodity, digital data, which is changing the world including methods for human recognition. Biometric systems are the recognition technology of the new age. So, privacy scholars tend to frame biometric privacy protection chiefly in terms of biometric data protection. The author argues that this is a misleading perspective. Biometric data protection is an extremely relevant legal and commercial issue but has little to do with privacy. The notion of privacy, understood as a personal intimate sphere, is hardly related to what is contained in this private realm (data or whatever else), rather it is related to the very existence of a secluded space. Privacy relies on having the possibility to hide rather than in hiding anything. What really matters is the existence of a private sphere rather than what is inside. This also holds true for biometric privacy. Biometric privacy protection should focus on bodily and psychological integrity, preventing those technology conditions and operating practices that may lead to turn biometric recognition into a humiliating experience for the individual.

Attacks and Countermeasures on Privacy-Preserving Biometric Authentication Schemes

Based on the Threshold Predicate Encryption (TPE), the biometric authentication scheme <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">PassBio</i> aims to correctly authenticate genuine end-users without leaking their biometric privacy information. However, this article proposes two impersonation attacks to <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">PassBio</i> by merely sending very few query messages. Specifically, an attacker is able to cheat the authentication server with probability 50% by sending the server a random query, or almost 100% by sending the server a collusion of old genuine queries, without being identified. Moreover, in order to defeat the impersonation attacks, this article presents a Verifiable Threshold Predicate Encryption (VTPE) scheme which includes three components: (1) a multi-segment TPE for reducing the computational cost and communication overhead significantly; (2) a segment-wise watermarking for defeating the random attacks; and (3) a challenge-response mechanism for defeating the replay and collusion attacks. In addition, the watermarking also creates a secure channel between the querying user and the server. The experiments on both simulated feature vectors and real face images demonstrate that the present attacks and countermeasures are effective and efficient.

FedFV: A Personalized Federated Learning Framework for Finger Vein Authentication

Most finger vein authentication systems suffer from the problem of small sample size. However, the data augmentation can alleviate this problem to a certain extent but did not fundamentally solve the problem of category diversity. So the researchers resort to pre-training or multi-source data joint training methods, but these methods will lead to the problem of user privacy leakage. In view of the above issues, this paper proposes a federated learning-based finger vein authentication framework (FedFV) to solve the problem of small sample size and category diversity while protecting user privacy. Through training under FedFV, each client can share the knowledge learned from its user’s finger vein data with the federated client without causing template leaks. In addition, we further propose an efficient personalized federated aggregation algorithm, named federated weighted proportion reduction (FedWPR), to tackle the problem of non-independent identically distribution caused by client diversity, thus achieving the best performance for each client. To thoroughly evaluate the effectiveness of FedFV, comprehensive experiments are conducted on nine publicly available finger vein datasets. Experimental results show that FedFV can improve the performance of the finger vein authentication system without directly using other client data. To the best of our knowledge, FedFV is the first personalized federated finger vein authentication framework, which has some reference value for subsequent biometric privacy protection research.

Transferability analysis of adversarial attacks on gender classification to face recognition: Fixed and variable attack perturbation

Most deep learning-based image classification models are vulnerable to adversarial attacks that introduce imperceptible changes to the input images for the purpose of model misclassification. It has been demonstrated that these attacks, targeting a specific model, are transferable among models performing the same task. However, models performing different tasks but sharing the same input space and model architecture were never considered in the transferability scenarios presented in the literature. In this paper, this phenomenon was analysed in the context of VGG16-based and ResNet50-based biometric classifiers. The authors investigate the impact of two white-box attacks on a gender classifier and contrast a defence method as a countermeasure. Then, using adversarial images generated by the attacks, a pre-trained face recognition classifier is attacked in a black-box fashion. Two verification comparison settings are employed, in which images perturbed with the same and different magnitude of the perturbation are compared. The authors’ results indicate transferability in the fixed perturbation setting for a Fast Gradient Sign Method attack and non-transferability in a pixel-guided denoiser attack setting. The interpretation of this non-transferability can support the use of fast and train-free adversarial attacks targeting soft biometric classifiers as means to achieve soft biometric privacy protection while maintaining facial identity as utility.

Key factors driving the adoption of behavioral biometrics and continuous authentication technology: an empirical research

PurposeFor the success of future investments in the implementation of continuous authentication systems, we should explore the key factors that influence technology adoption. The authors investigate the effect of various factors of behavioral intention through the new incorporation of a modified technology acceptance model (TAM) and diffusion of innovation theory (DOI). Also, the authors have created a new theoretical framework with constructs such as security and privacy risks (SPR), biometrics privacy concerns (BPC) and perceived risk of using the technology (PROU). In this paper, the authors conducted a structural equation modeling empirical research. This research is designed in such a way to respond to the trade-off between users’ concern for the protection of their biometrics privacy and their protection from risks.Design/methodology/approachThe authors provide an extensive conceptual framework for both existing models (TAM and DOI) and the new constructs that the authors have added to the model. In addition, this research explores external factors, such as trust in technology (TT) and innovativeness (Innov). In addition, the authors have introduced significant constructs, to overcome the limitations of the TAM and to adapt it to the needs of the present research. The new theoretical framework the authors introduce in the present research concerns the constructs SPR, BPC and PROU.FindingsThe authors found that the main facilitators of behavioral intention to adopt the technology (BI) are TT, followed by compatibility (COMP), perceived usefulness (PU) and Innov. This research also shows that individuals are less interested in the ease of use of the technology and are willing to sacrifice it to achieve greater security. COMP and Innov also play a significant role. Individuals who believe that the usage of the behavioral biometrics continuous authentication (BBCA) technology would fit into their lifestyle and would like to experiment with new technologies have a positive intention to adopt the BBCA technology. The new constructs the authors have added are SPR, BPC and PROU. The authors’ results support the hypotheses that SPR is a facilitator to PU and PU acts as a facilitator to BI. Consequently, the hypothesis that individuals do not feel adequately protected by classical methods will consider the usefulness of the BBCA as a technology for their extra protection against risks is confirmed by the model. Also, with the constructs BPC and PROU, the authors examined if individuals’ concerns regarding their biometrics privacy act as inhibitors in the BI. The authors concluded that individuals consider that the benefits of using BBCA technology are much more important than the risks for their biometrics privacy since the hypothesis that the major inhibitor of BI is PROU is not supported by the model.Originality/valueTo the best of the authors’ knowledge, this research is among the first in the field that examines the factors that influence the individuals’ decision to adopt BBCA technology.

Trilateral Filterative Hermitian feature transformed deep perceptive fuzzy neural network for finger vein verification

Automated person recognition is an essential field to preserve individual privacy in biometrics. A conventional system performs the recognition, but inaccurate detection of finger-vein lines causes lesser verification accuracy. To address this problem, a novel Trilateral Filterative Hermitian Feature Transformation based Deep Perceptive Fuzzy Neural Network (TFHFT-DPFNN) model is introduced for the capability of learning biometric features that offers robust and accurate vein image verification with minimum time. The proposed TFHFT-DPFNN model performs four different processing stages in the network layers. In the first stage, multiple finger vein images are captured from the database. Then the input images are taken to perform the denoising in the second stage by applying a guided trilateral filter to smooth the input image for accurate matching with minimum time consumption. Followed by, Hermitian Hat wavelet transformation is applied to perform decomposition and feature extraction from the input image. Then, the extracted features are transferred to the next hidden layer where the feature matching process is carried by applying the Jaccard similarity index. Based on the similarity value, the finger vein verification is performed through the fuzzy triangular membership function at the output layer. Finally, the verified results are obtained at the output layer with minimum error. Experimental evaluation is carried out with training images and testing images on different factors such as peak signal-to-noise ratio, finger vein verification accuracy, false-positive rate, and computation time with the number of finger vein images. The proposed TFHFT-DPFNN model offers promising outcomes in terms of higher verification accuracy and lesser false-positive rate with minimum time consumption than the conventional methods.

Face-based Authentication Using Computational Secure Sketch

Biometric features are quite suitable for identity authentication due to its inherent properties – universality, uniqueness and persistence. In fact, biometric authentication has been widely used in our daily life, especially in mobile devices. However, biometric features are quite sensitive, and once a feature is leaked to an evil adversary, it cannot be used in authentication any more. This leads to a push on research of biometric privacy protection. In this paper, we propose a face-based authentication system with the help of a computational secure sketch. The computational secure sketch takes charge of error tolerance on the face samplings. Then the face features of the same user are used to extract an authentication key, which is in turn used to do the identity authentication for the user. The computational security of the computational secure sketch makes sure that the public information obtained by the adversary does not affect the pseudorandomness of the authentication key, hence the privacy of face features is guaranteed. Moreover, the privacy protection technique in our face-based authentication system can be extended to other biometric-based authentication.

Virtual Fitting Rooms: A Review of Underlying Artificial Intelligence Technologies, Current Developments, and the Biometric Privacy Laws in the US, EU and India

Virtual Fitting Rooms: A Review of Underlying Artificial Intelligence Technologies, Current Developments, and the Biometric Privacy Laws in the US, EU and India

Comments on biometric-based non-transferable credentials and their application in blockchain-based identity management

In IT-ecosystems, access to unauthorized parties is prevented with credential-based access control techniques (locks, RFID cards, biometrics, etc.). Some of these methods are ineffective against malicious users who lend their credentials to other users. To obtain non-transferability, Adams proposed a combination of biometrics encapsulated in Pedersen commitment with Brands digital credential. However, Adams’ work does not consider the Zero Knowledge Proof-of Knowledge (ZKPoK) system for Double Discrete Logarithm Representation of the credential. Besides, biometrics is used directly, without employing any biometric cryptosystem to guarantee biometric privacy, thus Adams’ work cannot be GDPR-compliant. In this paper, we construct the missing ZKPoK protocol for Adam’s work and show its inefficiency. To overcome this limitation, we present a new biometric-based non-transferable credential scheme that maintains the efficiency of the underlying Brands credential. Secondly, we show the insecurity of the first biometric-based anonymous credential scheme designed by Blanton et al.. In this context, we present a brute-force attack against Blanton’s biometric key generation algorithm implemented for fuzzy vault. Next, we integrate an Oblivious PRF (OPRF) protocol to solve the open problem in Blanton’s work and improve its efficiency by replacing the underlying signature scheme with PS-signatures. Finally, we evaluate application scenarios for non-transferable digital/anonymous credentials in the context of Blockchain-based Identity Management (BBIM). We show that our modified constructions preserve biometric privacy and efficiency, and can easily be integrated into current BBIM systems built upon efficient Brands and PS-credentials.

Physiognomic Artificial Intelligence

The reanimation of the pseudosciences of physiognomy and phrenology at scale through computer vision and machine learning is a matter of urgent concern. This Article, which contributes to critical data studies, consumer protection law, biometric privacy law, and anti-discrimination law, endeavors to conceptualize and problematize physiognomic artificial intelligence (AI) and offer policy recommendations for state and federal lawmakers to forestall its proliferation. Physiognomic AI, we contend, is the practice of using computer software and related systems to infer or create hierarchies of an individual’s body composition, protected class status, perceived character, capabilities, and future social outcomes based on their physical or behavioral characteristics. Physiognomic and phrenological logics are intrinsic to the technical mechanism of computer vision applied to humans. In this Article, we observe how computer vision is a central vector for physiognomic AI technologies, unpacking how computer vision reanimates physiognomy in conception, form, and practice and the dangers this trend presents for civil liberties. This Article thus argues for legislative action to forestall and roll back the proliferation of physiognomic AI. To that end, we consider a potential menu of safeguards and limitations to significantly limit the deployment of physiognomic AI systems, which we hope can be used to strengthen local, state, and federal legislation. We foreground our policy discussion by proposing the abolition of physiognomic AI. From there, we posit regimes of U.S. consumer protection law, biometric privacy law, and civil rights law as vehicles for rejecting physiognomy’s digital renaissance in artificial intelligence. Specifically, we argue that physiognomic AI should be categorically rejected as oppressive and unjust. Second, we argue that lawmakers should declare physiognomic AI to be unfair and deceptive per se. Third, we argue that lawmakers should enact or expand biometric privacy laws to prohibit physiognomic AI. Fourth, we argue that lawmakers should prohibit physiognomic AI in places of public accommodation. We also observe the paucity of procedural and managerial regimes of fairness, accountability, and transparency in addressing physiognomic AI and attend to potential counterarguments in support of physiognomic AI.

Deep Learning for Multi-instance Biometric Privacy

The fundamental goal of a revocable biometric system is to defend a user’s biometrics from being compromised. This research explores the application of deep learning or Convolutional Neural Networks to multi-instance biometrics. Modality features are transformed into revocable templates through the application of random projection. During the user authentication phase, we employ Support Vector Machines, chosen over three other alternative classifiers after carrying out a comparative study. Comparison of the proposed method over other standard deep learning models and performance evaluation before and after revocability have also been discussed. Results demonstrate ability to improve identification accuracy and provide sound template security. The system was validated on three multi-instance iris and fingervein databases.

COVID-19 and Digital Contact Tracing: Regulating the Future of Public Health Surveillance

Digital surveillance tools⎼⎼technological means of monitoring, tracking, and notifying⎼⎼are at the forefront of public health response strategies for the COVID-19 pandemic. Comprehensive and effective digital public health surveillance requires that public health authorities, regulatory powers, and developers consider interdisciplinary approaches. This entails accounting for the use of tracking technologies and location and proximity data; notification systems from tech companies; and laws and regulations associated with health information, biometric privacy, and mobile data. Of particular importance is incorporation of epidemiological considerations in development and implementation of digital tools, including usability across mobile devices, interoperability, regulation of literacy and disability compatibility, and incentivization for adoption. It is both feasible and prudent that the United States establish a federal network for public health surveillance aided by digital tools, especially considering that waves of COVID-19 are expected to continue well into 2021 and while the threat of other emerging infectious diseases persists.