Generating secure cancelable fingerprint templates using local and ...

Generating Secure Cancelable Fingerprint Templates Using Local and Global Features Huijuan Yang, Xudong Jiang and Alex C. Kot School of Electrical & Electronic Engineering, Nanyang Technological University, Nanyang Avenue, Singapore 639798 Email: {ehjyang, exdjiang and eackot}@ntu.edu.sg

Abstract—Biometric template protection is an important issue to be resolved so that practical biometric authentication systems can be deployed. In this paper, we propose a noninvertible transform to perpendicularly project the distances between a pair of minutiae to a circle to generate the features. To achieve good performance, other local features such as relative angles between the minutiae pair, and global features such as orientation, ridge frequency and total number of minutiae of the randomly sampled blocks around each minutia are also utilized. The cancelable templates are eventually generated by the proposed “Bin-based Quantization (BQ)”. Both feature extraction and cancelable template generation are governed by a secret key to guarantee revocability and security. Experimental results conducted on FVC 2002 data set demonstrate the reasonable good performance of the proposed scheme. Keywords-cacelable fingerprint template, security, local and global features, perpendicular projection.

I.

INTRODUCTION

Authentication is to establish the identity of a person. Traditional authentication schemes primarily utilize tokens or some secret knowledge possessed such as passwords. However, neither token-based nor password-based approach can differentiate an authorized user and a person who have illegally possessed these secrets. Many biometrics-based authentication schemes are thus proposed to overcome these limitations. A typical biometric authentication system consists of the enrollment and authentication processes. The user presents the samples and some descriptive features are extracted to construct the templates in the enrollment stage. These templates are then stored in the database. During authentication, the features extracted from the query samples are matched with the stored template to give the authentication results. Designing such an authentication system raises serious concerns on the privacy protection of biometrics in the research community recently [1]. This can be accredited to the inherent uniqueness of the biometric data to each person which cannot be cancelled or re-issued. The lost biometric data maybe misused for cross-matching in other applications. The template protection schemes can be classified into two categories: feature transformation-based approach and biometric cryptosystem. Ratha et al. firstly proposed to generate cancelable biometric templates by employing noninvertible one-way functions [2]. A FRR increase of 5% for any given FAR is resulted for the cartesian transform using a

_____________________________

private database. The performance of the Cartesian and polar transforms is not that good due to the non-smoothness of the transformations. Methods that generate biometric keys from biometric templates are proposed in [3][4]. The “Fuzzy Vault” scheme [4] uses the unordered biometric features to construct a polynomial and encode the secret in the coefficients. Chaff points are then generated to conceal the genuine points. Sutcu et al. proposed a secure sketch based on quantization for face biometrics [5]. The helper data based method [6] consists of two parts: the first part identifies the reliable components and the second part maps the binary representation onto a codeword which is subsequently error-correction encoded to tolerate the noise. Two factor authentication based on the iterated inner products between tokenized random number and the user specific fingerprint features are proposed in [7]. However, how to achieve the low equal error rate when an imposter steals the pseudo-random key is an issue. In general, the security of the non-invertible transform is better than saltingbased approach if the transform can be designed really hard to invert. However, designing such a transform needs to discard certain discriminative information to achieve noninvertibility, hence, the performance is usually compromised. Our idea was motivated by Sutcu et al.’s approach [8][9]. In this method, the minutiae points are mapped to a circle via a one to many transformation. However, mapping a pair of minutiae to a circle by drawing a line may result in the arbitrary distance between the pair, as illustrated in Figure 1.

Figure 1. An illustration on the transformation proposed in Sutcu et al.’s approach.

Hence, in this paper, we propose a novel method to perpendicularly project the distance between a minutiae pair to a circle. In addition, their method is evaluated based on synthesized images which may not be accurate. Employing the distance between the minutiae pair alone is not sufficient

978-1-4244-4520-2/09/$25.00 ©2009 IEEE



to achieve good performance. Hence, other local and global features are employed in the cancelable template generation. The overall processes are shown in Figure 2, the details of the scheme will be elaborated in the subsequent sections.

coordinates, and the orientation of the ith minutia, respectively. Two lines (denoted as L1 and L2 ) are constructed that are perpendicular to the line connecting M i and M j (denoted by L ). L1 and L2 can thus be constructed by

y = ρ i .x + β i

(1)

y = ρ j .x + β j (2) where ρ i and ρ j are the slopes of the lines, β i and β j are the y-intercepts of the lines. x is an independent variable of the function y . Let us denote the slope of line L as ρ l , which is given by

⎧ y j − yi for x j ≠ xi ⎪ ρl = ⎨ x j − xi ⎪ notexist otherwise ⎩

Figure 2. Authentication system, (a) enrollment to generate cancelable templates and (b) authentication process.

II.

LOCAL AND GLOBAL FEATURES EXTRACTION

We now present the proposed local and global features extraction for the purpose of generating the cancelable fingerprint templates. A. Local Features Extraction And Perpendicular Projection As discussed in [10][11], local features such as the relative angles and distances between any two neighboring minutiae are robust to the geometric (e.g., translation, rotation and scaling) and nonlinear distortions that usually occurred in the fingerprint acquisition process. The objective here is to find those locally robust features and map these features to the circles irreversibly. For this purpose, we propose to project a pair of minutiae to a circle along the direction that is perpendicular to the line connecting the two minutiae, as shown in Figure 3.

Thereafter, we can obtain

ρi = ρ j = − ρ1l

(3)

when

ρ l exists

ρ l ≠ 0 . Otherwise, the lines L1 and L2 are either parallel to the x axis or y axis, the equations can be easily and

derived in this case. β i and β j can be obtained by solving Eqs. (1) and (2) based on the facts that the minutiae pair M i and M j lie in the lines L1 and L2 , respectively. The detection of a reliable reference point (e.g., singular point) plays an important role in minutiae-based fingerprint matching algorithm [12]. The centroid of the minutiae that is used as the reference point (i.e., as the center to draw the circle) is not robust to minutiae adding or deleting operations [8]. Hence, in this paper, the singular points (or the points having the maximum filter response for those fingerprint images with no singular points) identified using the complex filter [13] are used as the centers of the circles. To include all the minutiae in the circle, it is required that the radius r should satisfy

r ≥ max( ( xi − xo ) 2 + ( yi − yo ) 2 )

(4)

where ( xo , yo ) and ( xi , yi ) are the coordinates of the center of the circle, and the coordinates of the ith minutia, respectively. The radius rd for the projection and mapping is chosen by Figure 3. Perpendicular projection of the minutiae to a circle.

The irreversibility of the scheme is obvious since multiple minutiae pairs can be mapped to the same points in the circle. Hence, it is difficult to reverse the transform to find the original minutiae points. Assume the distance between a pair of minutiae is not less than a small threshold. Let us denote the pair of minutiae as Mi (xi , yi ,θi ) and

M j ( x j , y j ,θ j ) , where xi , yi and θ i denote the x and y



rd = r + μ .(1 + K 1 (i )) (5) where μ is a small constant, e.g., μ = 5 , K1 is the secret key of the user for the projection and K1 ∈ {−1, 1} . The circle can be represented by

( x − xo ) 2 + ( y − yo ) 2 = rd2

(6)

The two intersection points in the circle can thus be obtained by solving Eqs. (1) and (6), and Eqs. (2) and (6), respectively.

To achieve good matching performance, we further consider other robust local triangular features, such as the relative angles between the line connecting two minutiae with the two minutiae (i.e., | θ 3 − θ1 | and | θ 3 − θ 2 | ) and the relative angles between two minutiae (i.e., | θ1 − θ 2 | ). These triangular features are shown in Figure 4.

chosen in the implementation. Due to the different ways of capturing fingerprint images, elastic, nonlinear distortions always occur in the fingerprint images, extracting the features from the lines with various orientations helps to capture the features in different orientations of a minutia, thus provides robust measurement. The sampling points along each line are chosen randomly which are determined by a secret key, K1 . The criterion for choosing these sampling points is to make the sampled blocks lie in different distances and directions with reference to the chosen minutia. The x and y coordinates (denoted as

S x (i ) and S y (i ) ) of the ith sampling point are given by ~ S x (i ) = x k + sign ( x k ).ξ (i ).(1 + K 1 (i )) (7)

S y (i ) = tan(ψ k (i )).S x (i ) + y k − tan(ψ k (i )). x k

(8)

where tan() is the tangent function, sign(x) returns − 1 Figure 4. The triangular features used in generating the cancelable templates for fingerprints.

and + 1 depending on the sign of x and

ξ is the sampling ~

distance, which is a small constant. K1(i) =K1(i) +1 ,

~

B.

Global Features Extraction Using local features to generate the cancelable templates may lose the discriminating power among the inter users. Global features such as orientation, ridge frequency and the total number of minutiae of the blocks sampled along a line are stable, hence can be employed. The global features selection is illustrated in Figure 5.

obviously, K1 ∈{0,1} . Sy (i) is obtained by solving Eq. (8), considering the fact that the line passes through the minutiae point M k . A rectangular centered at the sampling points can thus be constructed. Thereafter, the average orientation, Ob , mean of the ridge frequency, Rm , and the total number of minutiae, N m , in each rectangular can be obtained. III.

CANCELABLE TEMPLATE GENERATION

The cancelable template is generated by Bin-based Quantization (BQ), which is described in the following section. A. Bin-based Quantization Once the minutiae points are projected to the circle, the radian distance of a minutiae pair is quantized to a bin. Let’s denote the total number of bins as N b , and the length of the arcs obtained by mapping minutiae M i and M j to a circle as Figure 5. The global features selection in generating the cancelable templates for fingerprints.

The robust global features are chosen within a bounding box centered at the centroid of the minutiae, which is based on the facts that the minutiae tend to scatter around the centroid location. By choosing the candidate minutiae in this way, spurious minutiae that lie near the boundary of the fingerprint images can be excluded. Inspired by [11], a group of lines are drawn from each chosen minutia with fixed interval of orientation. Let the kth minutia Mk = {xk , yk ,θk }, the orientation of the line is chosen to be

ψk ={θk + (n −1) ⋅α} , n = 1,2,...,N . α = 2π / 3 and N = 6 are

M i' M 'j . M i' M 'j is quantized into bin Bl (n) by

Bl ( n ) = Bl ( n ) + 1 when M i' M 'j ∈ [

( n − 1).2π Nb

n.2π ) (9) Nb

where n = 1,2,..., N b . Similar quantization can be applied to the local relative angle features. Fusion at the quantized feature level is done by calculating the weighted sum of the features to obtain the final quantized local features, Blf . In the same way, each set of global features is quantized into a pre-defined number of bins by taking the range of variation of the features into consideration. In the implementation, the ranges of Ob , Rm and N m are chosen



to be [0.3 1.8] , [5 29] and [ 0 20] , respectively. The fused global features, represented as Bgf (n) , n = 1,2,..., Nk , are given by

Bgf (n) = ω1.Ob (n) + ω2 .Rm (n) + ω3.Nm (n) where

(10)

ωk , k = 1,2,3 are the weights, the choice of which

depends on the discriminating power of the features. ω1 = ω2 = ω3 is chosen in the implementation. The final features are obtained by fusing Blf (n) with Bgf (n) and

IV.

EXPERIMENTAL RESULTS

The experiments are conducted on FVC2002 database, DB2a is chosen. The matching error (denoted as ε r ) computed between the ith cancelable template of a reference fingerprint Ctr and the jth cancelable template of an enquiry template Ctq is given by Nb

ε r (i, j ) = ∑ (| Ctri (k ) − Ctqj (k ) |)

(13)

k =1

ε r (i, j ) is less than

normalized by the total number of minutiae M n of the

where N b is the total number of bins. If

fingerprint image, which is given by

a threshold, we can determine that the pair is a matched pair, otherwise, it is an unmatched pair. The Receiver Operating Characteristic (ROC) curve and Equal Error Rate (EER) are employed to evaluate the performance of the proposed method. The first two impressions are employed in the experiments. Each instance of the cancelable templates of a fingerprint is matched against the remaining cancelable templates of the same finger, which results in a total of 100 genuine matchings. Whereas the first instance of the cancelable template of each finger is compared with the first instance of the cancelable template of all other fingers, resulting in a total of ⎛⎜ 100 ⎞⎟ = 4950 imposter matchings.

1 Ft ( n ) = (η1 .Blf ( n ) + η 2 .B gf ( n )) Mn

(11)

where η i , i = 1,2 are the weights. η1 and η 2 are chosen by considering the number of features used in quantization, which are

Mn×(Mn −1) and 2

M n for each type of local and

features, respectively. Hence, η 1 = 0 . 05 and η 2 = 0 . 95 are chosen in the implementation to compensate for the imbalance of the number of features. The cancelable templates (denoted as Ct ) can thus be generated by adding global

or deducting a small offset controlled by scaling factor λ and random key K 2 , which is given by

Ct (n) = Ft (n).(1 + λ.K 2 (n))

⎜ 2 ⎟ ⎠ ⎝

The ROC curves, the distributions of FAR versus FRR, and the EERs, for our proposed scheme and that of Sutcu et al.’s scheme are shown in Fig. 6 and Table 1, respectively.

(12)

where 0 < λ < 1 and K 2 ∈ {−1,+1} . B.

Security Discussions Security of the system is guaranteed by the keyed feature extraction and Bin-based Quantization, as shown in Figure 1 and Eqs. (5), (9) and (12). Without knowing the secret key, the extracted features would be difficult to match. The revocability and diversity of the system rely on the capability of generating different feature vectors for the same or different users by using different keys. Typically, our proposed scheme is a salting method, however, the Binbased Quantization is a non-invertible transform which can overcome the security limitations of the salting-based approach. In addition, we employ the watermarking technique to protect the quantized features ( Ft shown in Eq.

(a)

(12)). The scaling factor λ and key K 2 can be kept as secret, which improves the security of the system. In general, the larger the key space is, the higher the security of the system. To increase the security of the cancelable templates, a larger bin size can be employed, which therefore requires a long random key, e.g., K 2 in Eq. (12). (b)



19.8% lower in terms of EER than an existing approach. In our future work, we shall investigate more effective ways of the fusion of the features such that better performance can be achieved. ACKNOWLEDGMENT This work was supported by Singapore A*Star SERC Research Grant No: 0621300056. REFERENCES (c) Figure 6. Performance comparison. (a) the ROC curves of the proposed scheme and that of Sutcu et al.’s scheme, Nb = {10,20,30} . (b) and (c) the distribution of FAR and FRR of our proposed method and that of Sutcu et al.’s scheme evaluated based on 100 genuine pairs and 4,950 imposter pairs. TABLE I. COMPARISONS OF EERs.

EERs proposed Sutch et al.

Bin Size ( N b ) 4 29% 38%

10 17% 39%

20 14% 36%

30 13% 35%

40 17% 38%

50 17.5% 40%

It can be easily observed from the results that our proposed method can achieve better results compared with Sutcu et al.’s approach, e.g., an average decrease of 19.8% in EER can be achieved (see Table I). In addition, increasing the size of bin does not compromise the performance significantly, hence, a larger bin size can be employed. It therefore requires a long key for the cancelable template generation, which improves the security of the system. V.

CONCLUSIONS

In this paper, a novel method to generate cancelable templates by “Bin-based Quantization” of both global and local features of the fingerprint images is proposed. The local features such as distances, relative angles between minutiae pairs are employed. A novel perpendicular projection of the distance between a pair of minutiae is presented. Global features such as ridge frequency, orientation and total number of minutiae of the blocks randomly sampled along a line are also employed. Security of the system is guaranteed the keyed feature extraction and quantization mechanism. Experiments conducted on FVC2002 database demonstrate the reasonable good performance of our proposed scheme, which is more than

[1] Umut,Uludag, Sharath pankanti, Salil Prabhakar and A.K. Jain: Biometric Cryptosystems: Issues and Challenges. Proceedings of The IEEE, vol. 92, no. 6, pp. 948-960, June 2004. [2] Ratha, N. K., Chikkerur, S., Connell, J.H., Bolle, R.M.: Generating Cancelable Fingerprint Templates. IEEE Trans. on Pattern Analysis and Machine Intelligence, vol. 29, no. 4, pp. 561–572, Feb. 2007. [3] Juels, A., Wattenberg, M: A fuzzy commitment scheme. In Sixth ACM Conf. on Comp. and Comm. Security, pp. 28-36, 1999. [4] Juels, A. Sudan, M.: A fuzzy vault scheme. In Proc. IEEE Int. Symp. Informa. Theory. pp. 408-., 2002. [5] Y. sutcu, Q. Li, and N. Memon: Protecting Biometric Templates With Sketch: Theory and Practice. IEEE Trans. On Information Forensics and Security, vol. 2, no. 3, pp. 503-512, 2007. [6] Pim Tuyls: Practical Biometric Authentication with Template Protection, T. Kanda, A. K. Jain, N. K. Ratha (Eds.), LNCS 3546, pp. 436-446, 2005. [7] Andrew T. B. Jin, D. N. C. Ling, A. Goh: Biohashing: two factor authentication featuring fingerprint data and tokenized random number. Pattern Recognition 37, pp. 2245-2255, 2004. [8] Y. Sutcu, H. T. Sencar and N. Memon: A geometric transformation to protect minutiae-based fingerprint templates. Proc. of the SPIE, 6539, 65390E-1-8, 2007. [9] Sutcu, Y., Qiming Li, Memon, N.: Secure biometric templates from fingerprint-face Feature. IEEE Conf. on Comp. Vision and Pattern Recognition, 1-6, June 2007. [10] X.D. Jiang and W. Yau: Fingerprint Minutiae Matching Based on the Local And Global Structures. 15th Int. Conf. on Pattern Recognition, vol. 2, pp. 1038-1041, 2000. [11] Jin Qi, Yangsheng Wang: A robust fingerprint matching method. Pattern recognition, vol. 38, pp. 1665-1671, 2005. [12] S. Chikkerur and N. K. Ratha: Impact of singular point detection on fingerprint matching performance. Proc. Fourth IEEE workshop automatic identifiation advanced technologies, pp. 207-212, July 2005. [13] K. Nilsson, J. Bigun: Localization of corresponding points in fingerprints by complex filtering, Pattern Recognition Letters, vol. 24, 2135-2144, 2003.