A Survey on Multimodal Biometrics and the Protection of Their Templates <s> Biometric Template Protection Technologies <s> Random projection provides a good diversification effect for biometric template protection but is drawing increasing security concerns under the token-stolen (or public parameter) case. We propose a dynamic random projection method to alleviate these security concerns due to the stolen token by increasing the computational complexity to search for the unprotected biometric features. This is achieved by a projection process which dynamically assembles a random projection matrix from a set of candidate projection vectors. The selection of projection vectors is decided by the biometric feature vector itself and thus forms a nonlinear projection process. The proposed method permits the public and secure storage of all the candidate random vectors without the need for external secret keys. Experiments on the 800 samples in the database FVC2002DB2_A demonstrate the well-kept biometrie performance of the proposed method. <s> BIB001 </s> A Survey on Multimodal Biometrics and the Protection of Their Templates <s> Biometric Template Protection Technologies <s> Fuzzy commitment schemes have been established as a reliable means of binding cryptographic keys to binary feature vectors extracted from diverse biometric modalities. In addition, attempts have been made to extend fuzzy commitment schemes to incorporate multiple biometric feature vectors. Within these schemes potential improvements through feature level fusion are commonly neglected. In this paper a feature level fusion technique for fuzzy commitment schemes is presented. The proposed reliability-balanced feature level fusion is designed to re-arrange and combine two binary biometric templates in a way that error correction capacities are exploited more effectively within a fuzzy commitment scheme yielding improvement with respect to key-retrieval rates. In experiments, which are carried out on iris-biometric data, reliability-balanced feature level fusion significantly outperforms conventional approaches to multi-biometric fuzzy commitment schemes confirming the soundness of the proposed technique. <s> BIB002 </s> A Survey on Multimodal Biometrics and the Protection of Their Templates <s> Biometric Template Protection Technologies <s> Form a privacy perspective most concerns against the common use of biometrics arise from the storage and misuse of biometric data. Biometric cryptosystems and cancelable biometrics represent emerging technologies of biometric template protection addressing these concerns and improving public confidence and acceptance of biometrics. In addition, biometric cryptosystems provide mechanisms for biometric-dependent key-release. In the last years a significant amount of approaches to both technologies have been published. A comprehensive survey of biometric cryptosystems and cancelable biometrics is presented. State-of-the-art approaches are reviewed based on which an in-depth discussion and an outlook to future prospects are given. <s> BIB003 </s> A Survey on Multimodal Biometrics and the Protection of Their Templates <s> Biometric Template Protection Technologies <s> The term biometrics refers to “automated recognition of individuals based on their behavioral and biological characteristics” (ISO/IEC JTC1 SC37). Several physiological (static) as well as behavioral (non-static) biometric characteristics have been exploited (Jain, Flynn & Ross, 2008) such as fingerprints, iris, face, hand, voice, gait, keystroke dynamics, etc., depending on distinct types of applications (see Figure 1). Biometric traits are acquired applying adequate sensors and distinctive feature extractors are utilized in order to generate a biometric template (reference data) in the enrollment process. During verification (authentication process) or identification (identification can be handled as a sequence of biometric comparisons against the enrollment records in a reference databse) the system processes another biometric measurement from which an according template is extracted and compared against the stored template(s) yielding acceptance/ rejection or hit/ no-hit, respectively. The presented work is motivated by very recent advances in the fields of multi-biometric recognition (Ross et al., 2006) and biometric template protection (Rathgeb & Uhl, 2011). Automatic recognition systems based on a single biometric indicator often have to contend with unacceptable error rates (Ross & Jain, 2003). Multi-biometric systems have improved the accuracy and reliability of biometric systems (Ross et al., 2006). Biometric vendors are already deploying multi-biometric systems (e.g. fingerprint and finger vein by SAFRAN Morpho1) and multi-biometric recognition is performed on large-scale datasets (e.g. within the Aadhaar project (Unique Identification Authority of India, 2012) by the Unique Identification Authority of India (UIDAI)). However, security of multi-biometric templates is especially crucial as they contain information regarding multiple traits of the same subject (Nagar et al., 2012). The leakage of any kind of template information to unauthorized individuals constitutes serious security and privacy risks, e.g. permanent tracking of subjects without consent (Ratha et al., 2001) or reconstruction of original biometric traits (e.g. fingerprints (Cappelli et al., 2007) or iris textures (Venugopalan & Savvides, 2011)) might become a realistic threat. Therefore, biometric template protection technologies have been developed in order to protect privacy and integrity of stored biometric data. However, so far, template protection schemes which provide provable security/ privacy, and achieve practical recognition rates have remained elusive, even on small datasets. This bookchapter provides a comprehensive overview of <s> BIB004 </s> A Survey on Multimodal Biometrics and the Protection of Their Templates <s> Biometric Template Protection Technologies <s> In this correspondence, we analyze the vulnerabilities of biometric authentication protocols with respect to user and data privacy. The goal of an adversary in such context is not to bypass the authentication but to learn information either on biometric data or on users that are in the system. We elaborate our analysis on a general system model involving four logical entities (sensor, server, database, and matcher), and we focus on internal adversaries to encompass the situation where one or a combination of these entities would be malicious. Our goal is to emphasize that when going beyond the usual honest-but-curious assumption much more complex attacks can affect the privacy of data and users. On the one hand, we introduce a new comprehensive framework that encompasses the various schemes we want to look at. It presents a system model in which each internal entity or combination of entities is a potential attacker. Different attack goals are considered and resulting requirements on data flows are discussed. On the other hand, we develop different generic attacks. We follow a blackbox approach in which we consider components that perform operations on biometric data but where only the input/output behavior is analyzed. These attack strategies are exhibited on recent schemes such as the distributed protocol of Bringer (ACISP 2007), which is based on the Goldwasser-Micali cryptosystem, the related protocol of Barbosa (ACISP 2008), which uses the Paillier cryptosystem, and the scheme of Stoianov (SPIE 2010), that features the Blum-Goldwasser cryptosystem. All these schemes have been developed in the honest-but-curious adversary model and show potential weaknesses when considered in our malicious insider attack model. <s> BIB005 </s> A Survey on Multimodal Biometrics and the Protection of Their Templates <s> Biometric Template Protection Technologies <s> As biometric technologies are becoming pervasive, it is imperative to protect the users of these technologies from misuse of their biometric data. However, unlike user credentials in traditional security systems, such as passwords or tokens, biometric features cannot be consistently sampled, and the matching process can be complex. Furthermore, the consequences of losing biometric data can be far more severe than passwords or tokens. Secure sketches, a recently developed cryptographic primitive, allow noisy data to be restored using some helper-data, while providing bounds on how much sensitive information such helper-data would reveal when obtained by malicious parties. In this chapter, we discuss security threats on the use of biometric templates in security systems, and how secure sketches can be used to address these threats under various circumstances. <s> BIB006
Biometric template protection technologies present several advantages over generic biometric systems. In particular, attention is paid to immutability, because it is the basic characteristic of biometrics. The schemes, as these are previously categorised using this point, enhance privacy providing reliable authentication at a significant level. Specifically, the original template is concealed, the reconstruction becomes extremely efficient BIB004 BIB002 and the methods ensure, in some sort, the revocability and renewability of the template. Published studies provide tests using traditional attacks against the systems and introduce not only the strong fundamental spots, but also, the obscured ones BIB005 BIB002 BIB001 . For biometric cryptosystems, the key entropy, the tolerance levels, during the processes, and the metrics are the quantities that lack further investigation BIB004 BIB003 . Then, the amount of the applicable parameters should be examined closely, considering their important role in the definition of a restricted key space, something that puts at risk the security of the methods which use cancelable biometrics. In conclusion, in order to avoid fraud, privacy leakage should be decreased and the major requirement of unlinkability must be met. Furthermore, the alignment affects the recognition performance, the absence of a unified architecture brings confusion across the applications BIB006 and the desired properties for errorcorrection codes remain unattained.