Multibiometric Cryptosystem: Model Structure and ... - MSU CSE

IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY, VOL. 4, NO. 4, DECEMBER 2009

867

Multibiometric Cryptosystem: Model Structure and Performance Analysis Bo Fu, Simon X. Yang, Senior Member, IEEE, Jianping Li, and Dekun Hu

Abstract—Single biometric cryptosystems were developed to obtain win-win scenarios for security and privacy. They are seriously threatened by spoof attacks, in which a forged biometric copy or artificially recreated biometric data of a legitimate user may be used to spoof a system. Meanwhile, feature alignment and quantization greatly degrade the accuracy of single biometric cryptosystems. In this paper, by trying to bind multiple biometrics to cryptography, a cryptosystem named multibiometric cryptosystem (MBC), is demonstrated from the theoretical point of view. First, an MBC with two fusion levels: fusion at the biometric level, and fusion at the cryptographic level, is formally defined. Then four models, namely biometric fusion model, MN-split model, nonsplit model, and package model, adopted at those two levels for fusion are presented. Shannon entropy analysis shows that even if the biometric ciphertexts and some biometric traits are disclosed, the new constructions still can achieve consistently data security and biometric privacy. In addition, the achievable accuracy is analyzed in terms of false acceptance rate/false rejection rate at each model. Finally, a comparison on the relative advantages and disadvantages of the proposed models is discussed. Index Terms—Biometric encryption, biometrics, cryptosystem, multibiometrics, Shannon entropy.

I. INTRODUCTION RUSTABLE authentication plays an increasingly important role in secure communication systems. Traditionally, passwords (knowledge-based security) and smartcards (tokenbased security) are used as the first step towards identity proof in the system. However, security can be breached since dynamic passwords are easily divulged and guessed by means of social engineering or dictionary attacks. Token-based authentication may in part compensate the limitation of knowledge-based authentication; however, it is not reliable and easily stolen. If passwords and smartcards are shared or stolen, there is no way to know who the actual user is. Thus, nonrepudiation can not be provided by these two means.

T

Manuscript received June 23, 2009; revised August 31, 2009. First published September 29, 2009; current version published November 18, 2009. This work was supported in part by the China Scholarship Council, High Technology Research and Development (863) Project (Grant 2007AA01Z423), and by the Advanced Robotics and Intelligent System Laboratory, University of Guelph, Canada. The associate editor coordinating the review of this manuscript and approving it for publication was Prof. Davide Maltoni. B. Fu, J. Li, and D. Hu are with the School of Computer Science and Engineering, University of Electronic Science and Technology of China, Chengdu 610054, China (e-mail: [email protected]; [email protected]; [email protected]). S. X. Yang is with the Advanced Robotics and Intelligent Systems (ARIS) Laboratory, School of Engineering, University of Guelph, Guelph, ON, N1G 2W1, Canada (e-mail: [email protected]). Color versions of one or more of the figures in this paper are available online at http://ieeexplore.ieee.org. Digital Object Identifier 10.1109/TIFS.2009.2033227

The emergence of biometrics, as a strong form of an individual authentication based on the certain physiological or behavioral traits associatedwith the individual, overcomes the disadvantages of passwords and smartcards, but it is known that the sensed single biometric data is always noisy and distorted. Noisy biometric data results in insufficient accuracy, which largely limits biometric technology to provide useful value in many practical applications. On the other hand, biometrics may be vulnerable to common potential attacks, such as replay attacks, man-in-the-middle attacks and Trojan horse attacks, and in particular, susceptible to spoof attacks and template attacks [1], [2]. Spoof attacks are commonly encountered in biometric systems. Several techniques [3]–[5] are introduced, showing how an artificial biometric image can be reconstructed to spoof the acquisition sensor for enrollment. An even more serious problem is that compromised biometrics will be rendered unusable forever due to the difficulty of revoking the compromised biometrics or reissuing a new one. One possible technique is to encrypt the template using symmetric encryption. Cancelable biometrics [6], [7] is another technique that attempts to construct revocable biometric templates using various noninvertible transforms. With an increasing number of templates, the speed of “a matcher” will be largely decreased when those templates are used for identification. Thus, to overcome the disadvantages of biometrics, there are a couple novel directions: multibiometric recognition systems that integrate multiple biometrics for identification or verification and biometric cryptosystems that encrypt the secret with biometrics, as shown in Fig. 1 (SB is the single biometrics and CG is the cryptography.) A comparison of some single biometrics, including face, fingerprint, hand, iris, keystroke, and voice, is provided by Uludag et al. [14] based on seven factors. From the authors’ point of view, each biometric has its advantages and disadvantages. One biometric usually compensates for the inherent limitations of the other biometrics [15]. Therefore, the limitations imposed by a single biometric model can be overcome by multibiometric recognition system [8]–[11]. Multibiometrics offers the following main advantages: 1) significantly improving the accuracy of the biometric identification or verification; 2) providing a certain degree of flexibility for some unusable biometric traits; and 3) resisting spoof attacks due to the difficulty in spoofing multiple biometric sources. Hong et al. [8] categorized multibiometric recognition systems into three architectures based on biometric data fusion: 1) fusion at the feature level (e.g., [16], [17]); 2) fusion at the score level (e.g., [18]); and 3) fusion at the decision level, (e.g., [19], [20]). Fusion at the decision level commonly consists of three strategies, namely, out of fusion rule [31], OR rule and AND rule [8]. As a multibiometric recognition system is expected to improve the accuracy for identification or verification and defeat spoof attacks, the biometric cryptosystem that binds biometrics

1556-6013/$26.00 © 2009 IEEE Authorized licensed use limited to: ASTAR. Downloaded on January 29, 2010 at 03:34 from IEEE Xplore. Restrictions apply.

868


Fig. 1. Biometric system.

to cryptography aims to obtain a win-win scenario of security and privacy. In a biometric cryptosystem, there are no biometric images or templates stored in the central database, and the security is completely controlled by the user with his/her biometrics; however, the biometric cryptosystem still encounters several challenges. As mentioned earlier, unlike a password, the variability of the biometric data sampled in different environments makes it hard to generate identical biometric key with perfect accuracy. Over the past several years, there were a number of research efforts done in the biometric cryptosystem field. A biometric cryptosystem was firstly presented by Soutar et al. [12] and defined by Cavoukian et al. [13]. Juels et al. [21] proposed a fuzzy commitment scheme (FCS) algorithm, which utilizes error-correcting code theory and cryptography together to overcome the influence of the random noise to achieve provable security, but since the FCS has the property of order-invariance, strictly aligning the query biometric features with the template is required. Thus, Juels and Sundan [22] presented a fuzzy vault scheme (FVS). Uludag et al. discussed the fuzzy vault scheme for fingerprint minutiae [23], and raised some issues and challenges about a biometric cryptosystem. Nandakumar [24] presented another implementation of the fuzzy vault scheme based on fingerprint minutiae and helper data that is used to align the template and query fingerprints accurately. An efficient two-layer error-correction technique that combines Hadamard and Reed–Solomon error correcting codes to improve the iris encryption system performance is shown by Hao et al. [25]. To make a rigorous proof, Dodis et al. [26] and Boyen [27] introduced the concepts of fuzzy extractors and secure sketches. They provided constructions of fuzzy extractors and secure sketches for input data with three various measures: Hamming distance (implemented in FCS), edit distance, and set difference (implemented in FVS). Since a multibiometric recognition system can improve accuracy and a biometric cryptosystem can improve security and privacy, can we develop a new cryptosystem with optimal accuracy, security and privacy, compared to a traditional biometric cryptosystem? As shown in the center of Fig. 1, this problem inspires us to explore a new construction model. Intuitively, since multiple biometrics is more difficult to be spoofed than

single biometrics, it is harder for an attacker to derive the secret locked by biometrics from cryptographic templates. From the perspective of accuracy, multibiometrics involves the use of biometric fusion for automated recognition with a higher degree of accuracy than single biometrics. Thus, it should obtain higher accuracy than a single biometric cryptosystem. Some related methods have already been raised and studied. Sutcu et al. [32] proposed a technique of integrating face features and fingerprint minutiae at the feature level to obtain a secure template based on known secure sketch schemes. Nandakumar and Jain [33] derived a multibiometric vault by integrating the fingerprint minutiae template and the iriscode template at the feature level. After combining fingerprint and voice data at the template level, Camlikaya et al. [34] demonstrated a privacy protection technique by hiding the fingerprint minutiae points amongst the features extracted from the voice. Yanikoglu and Kholmatov [35] combined two fingerprint features extracted from different fingers to get a combined biometric ID. In the above references, while authors gave particular cases using face, fingerprint or iris to improve the security and privacy, they did not clearly point out or analyze a multiple biometrics system for encryption from a theoretical point of view. In this paper, by trying to bind multiple biometrics to cryptography, a cryptosystem, namely the multibiometric cryptosystem (MBC), is demonstrated. Abandoning the specific integration techniques of different biometrics, the impacts of fusion at biometric and cryptographic levels on the biometric security, privacy and accuracy are studied. Different constructions of MBC models are developed and analyzed by means of Shannon entropy analysis and probability analysis. The focus of this paper is as follows: 1) Formulate the formal definition of MBC based on the definition of the traditional biometric cryptosystem, and define two fusion levels: biometric level and cryptographic level. 2) Define security and privacy of MBC in terms of Shannon entropy; and define accuracy using two types of error measurement: false acceptance rate (FAR) and false rejection rate (FRR), which are related to the FAR and FRR in biometric recognition systems. 3) Propose a general construction model of MBC at the biometric level where different sets of biometric features are integrated to a vector or set for encryption, and discuss its security, privacy and accuracy. 4) Present three models of MBC at cryptographic level that consists of three submodels, namely, MN-split model, nonsplit model, and package model; then analyze their performance. 5) Discuss a comparison of the proposed models. In a multibiometric recognition system, there are four common distinct subcategories: multimodal (e.g., fingerprint and iris), multiinstance (e.g., left iris and right iris), multisensorial (e.g., optical fingerprint image and electrostatic fingerprint images), and multialgorithmic (e.g., fingerprint minutiae extraction algorithm and filter bank-based fingerprint feature extraction). In MBC, however, we only consider the biometric features and ignore the sources which those features are extracted from. Therefore, we are mainly concerned with the architectures at the biometric level regarding the fusion of biometric features, and at the cryptographic level regarding the fusion of the secret.

Authorized licensed use limited to: ASTAR. Downloaded on January 29, 2010 at 03:34 from IEEE Xplore. Restrictions apply.

FU et al.: MBC: MODEL STRUCTURE AND PERFORMANCE ANALYSIS

869

TABLE I NOTATIONS

Fig. 2. Unibiometric encryption.

The rest of this paper is organized as follows: some traditional biometric cryptosystems are presented in Section II. In Section III, the formal definitions of MBC with its performance index are proposed. The MBC model at the biometric level is discussed in Section IV and three MBC models at the cryptographic level are proposed in Section V. In Section VI, a comparison on the relative advantages and disadvantages of the proposed models is discussed. Conclusions are given in Section VII. Some related notations are presented in Table I. II. TRANDITIONAL BIOMETRIC CRYPTOSYSTEM Because the traditional biometric cryptosystem adopts single biometrics, as mentioned earlier (see for instance Fig. 2), we call it a Uni-Biometric Cryptosystem (UBC) in this paper. In this section, we will introduce three methods: Biometric Encryption Algorithm (BEA), Fuzzy Commitment Scheme (FCS) and Fuzzy Vault Scheme (FVS) for UBC first. BEA [12] used a Fourier transform to process the entire fingerprint image to bind a random key. FCS [21] and FVS [22], which have been broadly applied to iris, fingerprint, and face, rely on unique biometric traits that are used as inputs for various measures of closeness, such as Hamming distance and set distance. BEA defines a correlation function, , to be the basis for the algorithm. For two images, and , with their corresponding Fourier transform, and , respectively, the correlation function between them is formally defined as , where denotes the complex can be computed as the inverse conjugate. The output of Fourier transform (FT-1), . Then, a filter function , which provides a tradeoff between distortion tolerance and discrimination, can be defined and calculated using a set of training images . For a training image , the output pattern produced in response to is given by and its Fourier transform is

. A similarity term, , is defined given by as a measure of the similarity of the output correlation patterns and the random output function . A noise term, using , is defined as a measure of the effect of image-to-image variation. To minimize the error, Soutar et al. [12] proposed an opthat processes a timal filter design for the filter function perfect cryptographic secret. FCS utilizes technique of error-correcting. In order to authenticate and reveal the key, biometric features that are sufficiently close to the biometric template must be presented. Let be a hash function, such as SHA-1. Then, define a map: as , where is a codeword in a set . First, randomly select a codeword as a secret. When encrypting the secret using biometric vector , compute , and store as the ciphertext in a server. When decrypting the ciphertext, another biometric vector is inputted for authentication. Then, can be obtained, where is a decode function. If is close to , we can determine is the secret if . In FCS, the biometric features must be aligned before running the FCS algorithm. On the other hand, the property of order-invariance is to be desirable. To overcome the disadvantage of FCS, the FVS algorithm is developed without a fixed order because biometric features are considered as elements of a biometric set. FVS utilizes set difference to examine the similarity of biometric features. This technique consists of two algorithms: locking algorithm and unlocking algorithm. Locking algorithm . First, a locks a secret with an unordered set polynomial is selected to encode the secret . Then we can compute evaluations of the polynomial using all elements of . The results can be denoted as

In order to hide the secret, a number of random chaff points are chosen as random noise to mix with the genuine points. Those chaff points do not lie on the polynomial , denoted as

The entire collection of points constitutes a vault . The unlocking algorithm retrieves secret from vault by providing another similarly unordered set . If


870


Fig. 3. Multibiometric encryption.

is big enough, many genuine points in can be identified. Then the secret is revealed by using an error correction scheme and a polynomial reconstruction algorithm. The security of FVS relies on the number of chaff points, but FVS is vulnerable to some attacks, such as Attacks via Record Multiplicity or Correlation Attacks, Surreptitious Key-inversion Attack, and Blended Substitution Attacks [28], [29], even if a large number of chaff points are added in. On the other hand, chaff points cannot be selected too close to genuine points. Otherwise, they will cause a genuine point to be quantized to a chaff point. That will hardly improve the attack complexity required if biometric feature detection and extraction are limited. BEA, FCS, and FVS have their advantages and disadvantages for different applications. When they are applied in an MBC, we will only consider them as possible algorithms to encryption without caring about the algorithms themselves.

III. BASIC THEORIES OF MBC Basic architecture of the MBC is shown in Fig. 3. To effectively understand the MBC, we will analyze and define three performance characterizations, namely, security, privacy and accuracy. As considered in the multibiometric recognition system, it will be assumed that the cost and the speed of the system do not play any significant role in its performance assessment [8]. A. Formal Definitions Definition 3.1: Let be a randomized encryption function computable in probabilistic polynomial time. Let be a decryption function computable in probabilistic polynomial time. denotes the ciphertext of biometric encryption where and , and denotes the result of biometric decryption, where . In a biometric cryptosystem, when inputting a biometric vector or set and a secret , function binds and and maps to a new space. We denote the random output of the function by that presents the ciphertext of the secret encrypted by . If we wish to make the randomness explicit, the denotation is used, where is a random number. Also, the function reconstructs the secret after inputting another biometric vector or set B and the ciphertext.

If a genuine user offers legitimate inputs, and should run in probabilistic polynomial time. In order to define an MBC, first, we must define a unibiometric cryptosystem that is used to encrypt the secret using the single biometrics. Definition 3.2: A unibiometric cryptosystem is an encryption/decryption pair with the following property: , if for every pair of biometric features for a positive real , then with overwhelming probability. This definition of uni-biometric cryptosystem allows one to encrypt a secret with a biometric vector or set , and then successfully retrieve in the expected polynomial time with any that is close to . Here, the distance vector or set is the number of different digit positions for hamming metric and half of size of two sets’ symmetric difference for set difference metric[26]. This definition can be extended to define MBC, which contains multiple biometrics for encryption/decryption. is an encryption/decryption pair Definition 3.3: An MBC with the following property: for some pairs of bioextracted metric feature vectors or sets for a from m different biometric sources, if with positive real , then overwhelming probability, where . In other words, an MBC can decrypt a ciphertext , which is the result of a secret encrypted with biometric vectors or sets , if the input is close to . The similarity assessment of and is obtained based on a measure function . How to integrate different biometrics is not considered in this definition, so we will give the following two definitions regarding fusion at the biometric level and fusion at the cryptographic level. Definition 3.4: In system , fusion at the biometric level is a map , which satisfies the following multibiometric encryption/decryption process: for some pairs of biometric vectors or sets extracted from different bio, if metric sources, where for a positive real , where and , then with overwhelming probability. Definition 3.5: In system , fusion at the cryptographic level is a pair , where is a map and is another map , which satisfies the following multibiometric encryption/decryption process: for some pairs of biometric vectors or sets extracted from different biometric sources, where , if for a positive real , with then overwhelming probability. From Definition 3.4, we can see that the MBC model at the biometric level is the same as the fusion at the feature level in a multibiometric recognition system. The only difference is that the integrated vector or set is used for either biometric encryption or identity recognition. Similarly, according to Definition 3.5, fusion at the cryptographic level is the same as the decision level fusion. While there is a fusion level (score level fusion) in the multibiometric recognition system, it is not defined



in the MBC because a cryptographic algorithm needs an accurate and determined cryptographic key rather than a nonidentified score judgment. Also, in Section V, we will find that at the cryptographic level, the MN-split model, nonsplit model, and package model all have parallels with fusions in the multibiometric recognition system, corresponding to the out of fusion rule, OR rule, and AND rule, respectively. B. Security and Privacy The privacy of a biometrics and the security of a secret can be put into precise mathematical terms based on the definition of entropy. The entropy measure for biometric protection was firstly proposed in [26], which is called min entropy. But in [30], authors proposed the Shannon entropy instead of the min entropy due to the disadvantage of the min entropy in the multiple-key scenario. We also adopt the Shannon entropy to analyze the privacy and security in the multiple-biometrics scenario. The Shannon entropy of a random variable is defined in terms of its probability distribution. The conditional ungiven such certainty of the random variable that is given by for each . Furthermore, given the random variable , the conditional uncertainty of the random variable is given by , which is the expected value of over . can be regarded as the entropy of after disclosing . Then, the entropy loss of the random variable by disclosed is the . Based on these theories, entropy difference to analyze the privacy and security of an MBC, three attack hypotheses are given as follows. 1) For an individual, some biometric traits are vulnerable and were compromised by an impostor. For example, his/her fingerprints or voice are faked or recorded by means of social engineering. However, other biometric traits are still unknown. 2) The ciphertext of the secret encrypted with biometrics is disclosed. In some systems, it is easier to break the server than to attack biometrics. 3) Fusion algorithms and encryption/decryption algorithms in the MBC are known by the impostor. Now we can have the following descriptions: Set and let be a triple of random variables corresponding to a randomized construction of the MBC. is a random biometric vector or set over a universe corresponding to the biometrics, where . and are independent for all . is a random secret uniformly chosen from and independent of . is a ciphertext, which is the result of a function of and , namely when integration is done at biometric level and when integration is done at cryptographic level, respectively. In terms of the Shannon entropy, we have for

and for

Since . Let the uncompromised biometrics, where

, then be a set of , and

871

is a set of the compromised biometrics. Without a loss and . of generality, we assume is the entropy measure of the uncertainty about when the ciphertext and the biometrics in the set are disclosed. The security and privacy of the MBC depends on the entropy of the unbroken biometrics in the set . The main ob. jective then is to determine Lemma 3.1: In an MBC over a universe , for the secret and the set of biometrics , if is partitioned into two complementary subsets and , and , we have the following equations: , . can be equivProof: The mutual information and alently expressed as . Because and are in. Thus, we dependent, then the mutual information . In the same way, have . We have because and are also independent, . Theorem 3.1: In an MBC over a universe , given and , for the conditional entropy , we have . Proof: By Lemma 3.1, we know . If set , we get

Therefore, . As a result, we can examine the mutual information of each biometric and the ciphertext to determine the entropy of unbroken biometrics, which maintains its privacy from the disand , and protects the security of the closed information or secret. In order to determine the privacy or security of , we only need to determine the mutual information as description in Lemma 3.1 and Theorem 3.1. To compare the security of a unibiometric cryptosystem with an MBC, we assume that given a random biometric , a random secret , and the unibiometric algorithm , we can determine the entropy. In the MBC, we will not consider the security of the unibiometric algorithm and assume it is secure for secret protection. According to this assumption, we will analyze the privacy and security of the MBC. C. Accuracy In a biometric system, the problem of personal identification can be formulated as a hypothesis testing problem [8], [19]. Thus, two types of error measure, FAR and FRR, can be presented using conditional probability. In an MBC, the accuracy problem in unibiometric cryptosystems can be formulated as a hypothesis testing problem also. As presented in [19], FAR and


872


TABLE II EXAMPLES OF ACCURACY

FRR are used to measure that an impostor successfully generates the secret by providing the illegitimate biometrics and that a genuine user unsuccessfully generates the secret by providing the legitimate biometrics, respectively. Therefore, we can obtain the following description: two categories of people, and , seek to obtain the secret that is encrypted by biometis an impostor. After rics . Here, is a genuine user and providing another biometric , the cryptosystem outputs if successfully decrypting the ciphertext encrypted by , or if un-successfully decrypting the ciphertext, where is a special character. That is to say, if obtaining , then the user belongs to . On the other hand, if obtaining , the user belongs to . Based on the above description, we can determine the accuracy of the uni-biometric cryptosystem. The FAR is the conditional probability that an impostor successfully obtains by inputting to the cryptosystem , denoted as . The FRR is the conditional probability that a genuine user obtains by inputting to the cryptosystem , denoted as . Next, we will consider the accuracy of the MBC based on that found in the unibiometric cryptosystem. In a multibiometrics scenario, if multiple biometrics are inputted for encryption and are inputted for decryption, then the error rate can be defined as

To examine the accuracy, we set the values of as the FAR and FRR when using a uni-biometric algorithm to decrypt , which is the ciphertext of the secret encrypted by biometrics using algorithm . We use the following four examples of in Table II to test the accuracy, where , 2, 3, 4. In a biometric recognition system, there is a tradeoff between FAR and FRR. But for a cryptographic system, security is more important. Therefore, we set the FRR as much bigger than the FAR for single biometrics. For instance, the accuracy of pair algorithms ( ) is with values of (0.05, 0.2) when a biometric encryption algorithm is applied to biometrics . In the following models, accuracy is examined by using these examples. IV. MBC MODEL AT BIOMETRIC LEVEL Fusion at the biometric level integrates different biometric features that are extracted from multiple biometric sources to a vector or set for encryption. This fusion may be done in the same manner as fusion at the feature level in multibiometric recognition systems, as shown in Fig. 4. In this section, we will discuss performance problems without considering how to integrate the biometric features. Some fusion methods were widely used in

Fig. 4. Fusion at biometric level.

the multibiometric recognition system. We refer the reader to the corresponding literature [16], [17]. The MBC model at the biometric level is a formal construction, which presents basic relations among the fusion of biometric features and biometric encryption. In this model, the variincludes two components and , able set of biometrics where is the set of broken biometrics and is the biometrics still unknown by the impostor. Variables , and can be de, , , where and noted as . Without a loss of generality, we assume and . The fusion of the variable set of biometcan be used to encrypt the secret to satisfy the folrics lowing formulas: and Then the fusion, , can be consider as a special biofor single biometric encryption/demetric integrated from , each biometric cryption. Here, for the same algorithm also satisfies the following formulas: and We now show the lower bound of biometrics in the construction of a cryptosystem at the biometric level when is disclosed and biometric is compromised. We consider the entropy loss of biometrics that can be determined from the fusion algorithm and the uni-biometric cryptosystem. Theorem 4.1: In a general construction of MBC at biometric level over a universe , if the entropy loss of is for fusion, where , is the encryption template, then given and , for the random variable , we have . See Appendix A.1 for the proof of Theorem 4.1. By Theorem 4.1, If there are no spoofed biometrics, namely , then . On in , we have the other hand, for the biometric trait . Set and , then by Theorem 4.1. As a consequence, given and , we can determine the minimum entropy for each un-broken biometrics in the set is . We now state and prove Theorem 4.2 which gives the relationship of and when and are both disclosed at biometric level.



873

Theorem 4.2: In a general construction of MBC at the biometric level over a universe , for the random variable , we have .If is uniquely determined by , we have See Appendix A.2 for the proof of Theorem 4.2. Without considering the parameter , Theorem 4.1 and 4.2 give the relationship of the security/privacy between the MBC model at biometric level and the UBC model when some biometrics in are disclosed. However, based on Definition 3.4, meets the condition , only when the pair the fusion biometric vector or set can decrypt the template. Therefore, the parameter plays an important role in determining the accuracy of the cryptosystem. On the other hand, the security of cryptosystem depends on and the entropy of the disclosed biometric set also. The following theorem shows the relationship between the security of the secret and the accuracy using the parameter and the set . Theorem 4.3: In a general construction of MBC at the biometric level, for some pairs of biometric vectors or , where , if the sets and fusion biometric traits in probabilistic polynomial time , where , and to make , then we have , ; (1) If , (2) If where denotes the considerable computational complexity. See Appendix A.3 for the proof of Theorem 4.3. If there is no entropy loss when combining the biometric traits in , the entropy of can be considered as the considerable computational com. Thereplexity fore, can be determined by . It is known that integrating multiple biometrics using an effective fusion scheme can significantly improve the overall accuracy of the biometric system. An MBC that utilizes the highly efficient methods also can achieve better accuracy compared to a unibiometric cryptosystem. For example, the multibiometric vault [33] achieves a GAR of 98.2% at FAR of about 0.01%, while the corresponding GAR values of the iris and fingerprint vaults are 88% and 78.8%. In a general construction of MBC models at the biometric level, if a fusion algorithm can improve the accuracy for identification/verification, we can apply the same fusion algorithm to improve the accuracy of the MBC. In general, the alignment and quantization of biometric features are mainly affected by the features. We can find some proper fusion algorithm to achieve the lower FAR and FRR. Therefore, a good fusion algorithm at biometric level can improve the accuracy also. V. MBC MODELS AT CRYPTOGRAPHIC LEVEL MBC Models at the cryptographic level, as shown in Figs. 5–7, consists of three submodels: MN-split model, nonsplit model, and package model. Cryptographic level fusion stems from the decision level fusion. Thus, there are some similarities and relationships between them. Similarly, the MN-split model, nonsplit model, and package model correspond to the

Fig. 5. MN-split model.

out of fusion rule, OR rule, and AND rule, respectively. In pieces. Each the MN-split model, the secret is split into biometric protects one piece using a relative encryption/decryption algorithm. The secret can be reconstructed only if pieces are recovered from the corresponding bioany metric ciphertexts. This model can eliminate the effect of some low-quality biometric images or some unusable biometrics. In nonsplit models, the secret is not split into pieces. Each biometric encrypts the secret that can be recovered when any one of biometric ciphertexts is decrypted successfully. Since any broken biometrics can compromise the secret, the security of is vulnerable. In the third model, the secret is packed layer by layer. The secret is encrypted to the biometric ciphertext by the first layer biometrics, then the ciphertext is considered as the secret and encrypted by the second layer biometrics. At last, the final ciphertext is obtained after encrypted by the outside biometrics. Those models will be investigated in the following section. A. MN-Split Model In the MN-split model, the secret is split into pieces, denoted as . Any pieces can be used to restore . Assume protects , protects , , and protects , as shown in Fig. 5. There is a determined coefficient, denoted by combination , existing between the encryption using biometrics and the encryption using a subset , where is the set of biometrics that is randomly selected from the to encrypt/decrypt . Therefore, in this model we only consider the multiple biometric encryption using and analyze its security. If is the set of broken biometrics in the set and is the set of other biometrics in , then , and can be de, , where and noted as , . Just the same as the assumption at the biometric level, without a loss of generality, we assume and . For each biometric , can be encrypted as follows:

Because .

, then


is independent with

if

874


Fig. 6. Nonsplit model.

are both disclosed. In the following the biometrics when theorem, we can examine biometrics to determine the security of the secret. Theorem 5.2: In a general construction of the MN-split model over a universe , given and , for the random variable , we have . If biometric is uniquely determined by , we have . See Appendix B.2 for the proof of Theorem 5.2. Theorem 5.3: In a general construction of the MN-split model, for some pairs of biometric vectors or sets , where , if there is a biometric set , in probabilistic polynomial time to make , where , and is a positive real, then we have , ; (1) If (2) If , , is the entropy of the combination, which is generated by selecting elements from the set , denoted . Here, , as , , and denotes the considerable computational complexity. See Appendix B.3 for the proof of Theorem 5.3. The accuracy of restoring the secret can be computed by Theorem 5.4. Theorem 5.4: In a general construction of the MN-split model , if at least over a universe , for biometrics biometrics can be used to successfully decrypt corresponding ,

ciphertexts, then we have Fig. 7. Package model.

The previous description gives the basic ideas of the general MN-split model. The following theorem shows that the lower bound of the entropy of is mainly affected by the entropy in , which is used in the uni-biometric of each biometric cryptosystem, given corresponding to . Theorem 5.1: In a general construction of the MN-split model over a universe , given and , for the random variable , we have , . See Appendix B.1 for the proof of Theorem 5.1. , then . We can By this theorem, we can see if get and . For a biometrics in when given and , because , it is clear that . On the other hand, we have then . Thus, let entropy and , we can get by Theorem 5.1. Hamming metric construction over a field is a technique that the secret is a random codeword chosen uniformly at random and independently with each biometric . In this construction, is a function of and , namely , and is uniquely determined by , namely . Theorem 5.2 shows that if can be uniquely determined by , the entropy of the secret is equal to the entropy of

,

is the FAR of and is the FRR of , and where is a randomly selected biometric for encryption. See Appendix B.4 for the proof of Theorem 5.4. Proposition 5.1: In the MN-split model, given biometrics as input, if a biometric trait is involved in decrypting the corresponding subkey, then we have , , where ( ) is the FAR (FRR) of the biometric , and ( ) is the FAR (FRR) of the cryptosystem . Proof: By Theorem 5.4, when is chosen for decryption, then

where is the FAR and is the FRR of cryptosystem . Therefore, Since , and , then , . To more clearly understand the accuracy computation of MN-split model, we provide the following example. Example 1: As an example, consider the following choice of , , and . Because parameters. Let ,

, then based on Table II,


has the


875

TABLE III EXAMPLES OF ERROR RATE AT THE MN-SPLIT MODEL

following four possible values:

Since

,

has the following six possible values:

Therefore, by comparing Tables II and III, we have achieved that both FAR and FRR have decreased greatly. B. Nonsplit Model Distinct from the construction of the MN-split model, the seis not split into pieces, as shown in Fig. 6. Any cret biometric protects the same secret . is the set to encrypt/decrypt . is the set of broken biometrics in the set and is the set of un-broken biometrics in . , and can be denoted as , , , where and . Without a loss of generality, we assume and . Here, any biometric can be used to encrypt as follows:

In this model, because , then is independent with if . Also, for a determined , is independent with if . So we can get the following theorem. Theorem 5.5: In a general construction of the nonsplit model over a universe , given and , for the random variable , we have . See Appendix B.5 for the proof of Theorem 5.5. From above theorem, for any un-compromised biometrics in , . Obviously, if is nil, . For any biometric , when are disclosed, is also disclosed since . Thus, knowing and , an impostor can restore the secret by using the decryption algorithm . We then have the following theorem for the security of the secret. Theorem 5.6: In a general construction of the nonsplit model over a universe , given and , for the random variable , we have . See Appendix B.6 for the proof of Theorem 5.6.

Theorem 5.7: In a general construction of the nonsplit model, for some pairs of biometric vectors or sets , if , where , and is a positive real, then we have , ; (1) If (2) If , ; where , , and denotes the considerable computational complexity. See Appendix B.7 for the proof of Theorem 5.7. Theorem 5.8: In a general construction of the nonsplit model , then we have over a universe , for biometrics ,

, where

is the

and is the FRR of . FAR of See Appendix B.8 for the proof of Theorem 5.8. Proposition 5.2: In the nonsplit model, given biometrics as input, we have , , where ( ) is the FAR (FRR) of a biometric trait , and (

) is the FAR (FRR) of

. the cryptosystem Proof: By Theorem 5.8, we can obtain

Since , we can get

, then . And since , we can obtain

Therefore, we have , . Example 2: Again, we pick and . Then based on Table II, we can compute , and . Therefore, with a higher FAR, this model largely decreases FRR. C. Package Model Package model provides a layer-by-layer protection for the secret using biometrics. The bottom layer is the secret that is encrypted by the next layer’s biometrics to the ciphertext, which


876


becomes the following layer’s secret. The top layer is the last result of the whole encryption process. To obtain the secret, an impostor has to rake up the ciphertext layer by layer, as shown in Fig. 7. We can create the following model.

is the set of broken biometrics in the set the set . and is the set of un-broken biometrics in . , and can , , where be denoted as , and . Without a loss of generality, assume and . The process of encryption is denoted as follows.

From the above formulas, we can see and are independent. Following three theorems shows the privacy, security and accuracy of this model. Theorem 5.9: In a general construction of the package model over a universe , given and , for the random variable , we have . See Appendix B.9 for the proof of Theorem 5.9. If there are no spoofed biometrics, namely and , then . has only an un-comOn the other hand, if , because promised biometrics, such as , is determined by , then . Since both and are independent with , and , then we have . The following theorem gives the minimum entropy of the secret . Theorem 5.10: In a general construction of the package model over a universe , given and , for the random variable , we have . See Appendix B.10 for the proof of Theorem 5.10. Theorem 5.11: In a general construction of the package model, for some pairs of biometric vectors or sets , if and , where , and is a positive real, then we have (1) If , ; (2) If , ; where , , and denotes the considerable computational complexity. See Appendix B.11 for the proof of Theorem 5.11. Theorem 5.12: In a general construction of the package model over a universe , for biometrics , then we have

,

, where

is the FAR of and is the FRR of . See Appendix B.12 for the proof of Theorem 5.12. Proposition 5.3: In the package model, given biometrics as input by an impostor or a genuine user, we have , , where ( ) is the FAR (FRR)

(

) is the FAR (FRR) of the cryptosystem

.

Proof: By Theorem 5.12, we can obtain

be

Same as the nonsplit model, let

, and

of a biometric

Since

, we can obtain . And

Since , we can get we have , Example 3: Let

, then . and

. Therefore, . Then based on

Table II, we can compute and

, . Therefore, this model

largely decreases FAR (near zero), but FRR is increased. VI. COMPARISON OF VARIOUS MBC MODELS In this section, a brief comparison of MBC models will be provided based on the security, privacy and accuracy. We mainly consider following scenarios: 1) the entropy of the determined biometric set in which the biometric trait is uncompromised when the ciphertext and some biometrics in are disclosed , , , , respectively); 2) the (corresponding to when the ciphertext and some bioentropy of the secret metrics are disclosed; and 3) the accuracy of the models. The first and second scenarios are relative to the privacy of the biometrics and the security of the secret. In an MBC, without biometrics directly stored in the template database, the user need not reveal his biometrics to an impostor just as dealt in the unibiometric cryptosystem. But the privacy issues tied to MBCs are significantly affected by different model architectures and parameters. It is known that the compromised biometrics cannot be revoked. Thus, in the unibiometric cryptosystem, if a biometric is compromised, we have to discard it and switch to another biometric cryptosystem based on another biometric identifier. In an MBC, in order to consider the system’s performance to overcome this problem, we have assumed the set consisting of compromised biometrics. For the security of the secret, when the ciphertext and biometrics in are disclosed, the entropy of the secret is . Therefore, if and are compromised by the impostor, the security of the secret is only protected by the ; biometrics in . We consider following scenarios: 1) 2) , is the parameter of MN-split model; 3) ; 4) all biometrics are compromised, . When , . Then, by comparing the entropy using the parameters , and , where is the threshold in the biometric fusion model, is the distance of biometric trait and is the size of



877

TABLE IV SECURITY COMPARISON OF VARIOUS MBC MODELS (jZ j

TABLE V SECURITY COMPARISON OF VARIOUS MBC MODELS (

the set

, we can obtain the security level of each model . Based on Theorem 4.3, 5.3, 5.7, and 5.11, we can get the entropy as shown in Table IV. Similarly, we can get the Tables V and VI when and . When , it is clear that since all biometrics are broken. In Table IV, the security level of each model are given when and . These two scenarios are considered under the condition of . In Section V, with the same condition, Theorem 5.4, 5.8, and 5.12 demonstrate how to compute the accuracy (FAR and FRR). Since the accuracy of the biometric fusion model is related to , the FAR and FRR of the four models under the same two scenarios can be compared. These comparisons are presented . in Table VII In the biometric fusion model, for a determined biometric trait , when the ciphertext and biometrics are disclosed, by Theorem 4.1, we can get . If there is no entropy loss of the biometric when combining all the biometrics to form a encryption vector, . By Theorem 5.1, since , we can get in the MN-split model. By Theorem 5.5, we know . By Theorem 5.9, we can get . Thus, while there is a low level of privacy in the MN-split model, the biometric fusion model and package model have a higher level of privacy than that in the nonsplit model, as shown in the second column of Table VIII. Also, by Theorem 5.4, 5.8, 5.12, and Proposition 5.1, 5.2, 5.3, we can obtain the accuracy comparing single biometrics. Both the biometric fusion model

1

j

= 0)

Z < n) j

and the MN-split model can increase the encryption/decryption accuracy. But while the FRR is decreased, the FAR is largely increased in the nonsplit model. That is the same as in the package model, in which the FRR is increased with a decreased FAR. The accuracy comparison between the multi and unibiometric cryptosystem is shown in the third and forth column of Table VIII. We also provide a comparison of the models based on flexibility including three factors: scalability (the ability of an MBC to add or remove biometrics), feature consistency (the different biometric vectors or sets that should be converted into an identical feature space), and convenience (whether the model is convenient for application), as shown in Table VIII. On the whole, when the threshold is big enough, the biometric level fusion may provide higher security than the fusion models at the cryptographic level. However, different biometric sources such as fingerprint and iris may have incompatible features and different feature spaces. That makes it difficult to concatenate different features. Meanwhile, it is hard to extend the biometric system, such as adding or canceling a biometric source. Those disadvantages make it inconvenient for application deployment. Although the MN-split model has the lowest level of the privacy of the four models, it can achieve optimal performance with flexibility. Moreover, the MN-split model can easily combine different biometric algorithms that utilize various measures, such as hamming distance and edit distance, for biometric encryption. We can enhance or improve the security, privacy and accuracy using mere parameter selection without redesigning the whole system. In the nonsplit model, because any one of inputted biometrics may restore the secret, nonsplit model makes the security of system lower than other methods. But it has the best flexibility for practice. If a system does not


878


TABLE VI SECURITY COMPARISON OF VARIOUS MBC MODELS (n

jZ j < m )

TABLE VII ACCURACY COMPARISON OF VARIOUS MBC MODELS

TABLE VIII COMPARISON OF VARIOUS MBC MODELS

require high security, a lower FRR with high FAR may be more useful in some cases. For example, this model can be applied to sharing a secret in a group using each individual’s biometrics. The package model has the same characteristics as the biometric fusion model except for the FAR and the feature consistency. This model leads to a higher FRR than the single biometrics. VII. CONCLUSION Unibiometric cryptosystems combine cryptography and biometrics to benefit from high security levels provided by cryptography and nonrepudiation brought by biometrics. Without storing sensitive data by means of plaintexts, a biometric cryptosystem provides a secure method for secret protection and enhances the privacy of individual biometrics. However, feature

alignment, quantization and other factors degrade the accuracy of biometric cryptosystem. Spoof attacks that commonly existed in biometric systems also seriously threaten the security and privacy. This paper proposed a cryptosystem, namely the MBC, which is superior to the use of the unibiometric cryptosystem in different applications, due to integration of multiple biometrics for encryption. In this paper, the MBC is formally defined to integrate multiple biometric traits to protect a secret with two fusion levels, the biometric level and the cryptographic level. There are four model structures or methods presented to meet requirements of different applications at those two levels. By comparing with the entropy of single biometrics, the lower bound of biometrics and secret is given and proved using Shannon conditional entropy. The accuracy is rigorously analyzed using FAR/FRR and



demonstrated by examples. Finally, a comparison on the relative advantages and disadvantages of the proposed models are discussed. From the comparison, we can see that each MBC model, either modeled at the biometric level or at the cryptographic level, has its strengths and weaknesses. No single model is expected to be optimal to meet all the requirements of factors, such as privacy, security, accuracy, and flexibility. In practice, performance improvements can be achieved only if the right architecture is selected.

879

to break the cryptosystem. Therefore, when and are disclosed , if , the entropy of is determined by . B) Proofs for MBC at Cryptographic Level: B.1) Proof of Theorem 5.1: Proof: According to Theorem 3.1, given and some broken biometrics , we can obtain the equation . In the construction of the MN-split model over a universe , since , then

APPENDIX A) Proofs for MBC at Biometric Level: A.1) Proof of Theorem 4.1: Proof: By theorem 3.1, we know . Set and are independent, and

. Since , then we have with the equality iff and given . Set

Therefore, The equality holds iff and are conditionally independent given . Thus, . Therefore, we obtain . When is disclosed, we can consider the secret is encrypted by biometric that is the only random variable for an impostor, and is only determined by . Then the mutual and is relative to information between the mutual information between and . There is entropy loss of when is integrated with to . Thus, given the mutual information between and is less than or equal to . Then we have . A.2) Proof of Theorem 4.2: Proof: We know that given , the secret can be ob, tained using the decryption algorithm. Therefore, given . Then . On the other hand, since the mu. tual entropy . For a We then get biometric encryption/decryption algorithm, given , we can uniquely determine , then . On the other hand, if is uniquely determined by and , . It is quite obvious that then . Therefore, . As a consequence, if can determine , the entropy is equal disclosed. to under the condition of A.3) Proof of Theorem 4.3: Proof: Since , if , then an imusing to postor can decrypt , get . Therefore, If . If , the loss entropy from is . That is too say, to attack , an impostor guesses only bits

we

are conditionally independent , then

have .

On

the

because then a

consequence,

we

have

the

other

hand, , , thus . As

entropy and .

B.2) Proof of Theorem 5.2: Proof: Since

, then , and . For the biometric en, using cryption/decryption algorithm, given the decryption algorithm, we can determine , , then . Meanor while, if given , we can determine , then , . Therefore, or . B.3) Proof of Theorem 5.3: Proof: Since , if , then an impostor can decrypt using to get . Therefore, If , . If , to attack , an impostor guesses only biometric traits to break the cryptosystem. Therefore, when and are disclosed , he can select biometrics from , in which the sum of the biometric entropy is minimal. Without a loss of generality, let the combination be . To attack , the minimum entropy . is B.4) Proof of Theorem 5.4: Proof: If an impostor wishes to get the secret, he/she must successfully decrypt at least ciphertexts that are encrypted by corresponding biometrics. Then let random event occur such that the decryption algorithm outputs . We suppose


880


that an impostor successfully decrypts the key using arbitrary biometrics , which correspond to events . Therefore, we can obtain following equations:

Since a legitimate user is rejected when biometrics are inputted, there is at most biometrics that can be used successfully for decryption. That decryption algorithms output is to say, at least . Therefore, let random event be that the decryption algorithm outputs . We can suppose that a legitimate user arbitrary unsuccessfully decrypts the key using biometrics corresponding to events . Then we can get

As a consequence,

,

, where

is the FAR of and is the FRR of , and is a randomly selected biometric. B.5) Proof of Theorem 5.5: Proof: By theorem 3.1, we know the entropy . In the construction of the nonsplit model over a universe , since , then we get the equation shown at the bottom of the page. When

When

When

,

Therefore, we can obtain . B.6) Proof of Theorem 5.6: , then Proof: In this model, because . Therefore, when any biometric is compromised, the secret can be broken if is disclosed. Then . we have B.7) Proof of Theorem 5.7: , then an impostor can decrypt using Proof: If to get , where . Therefore, if , . If , to attack , an impostor guesses only one of the biometric traits to break the cryptosystem. When and are disclosed , he can select the biometric that the entropy is minimal to attack . Therefore, is determined by . B.8) Proof of Theorem 5.8: Proof: If a genuine user obtains an error output, all biometrics can not make the corresponding decryption algorithm output correct secret. But if an impostor wishes to get the secret, he/she only successfully need to decrypt one ciphertext that is encrypted by corresponding biometrics. Then let random event be that the decryption algorithm outputs



881

and random event is that the decryption algorithm outputs . Therefore, we can obtain following equations.

bits.

Therefore,

is

determined

by

. B.12) Proof of Theorem 5.12: Proof: A genuine user obtains an error output if any one outputs an incorrect secret, and if of biometrics an impostor wishes to get the secret, he/she must successfully decrypt all ciphertexts that are encrypted by corresponding biobe that the decryption algorithm metrics. Let random event outputs and random event is that the decryption algorithm outputs . Therefore, we can obtain following equations:

and

and Then,

,

, where

is

and is the FRR of . the FAR of B.9) Proof of Theorem 5.9: Proof: By theorem 3.1, we know . From the model, we have . Then can be uniquely determined by . Therefore As a consequence, we have , where With equality iff

uniquely determines

, then

the FRR of

, is the FAR of

and

is

. ACKNOWLEDGMENT

Therefore,

.

B.10) Proof of Theorem 5.10: Proof: We know . Since is uniquely determined by

REFERENCES ,

then

Since entropy

The authors would like to thank the anonymous reviewers for their valuable comments.

is uniquely determined from and , then . As a result, we have . B.11) Proof of Theorem 5.11: Proof: If , then an impostor gets to know all biometrics and can decrypt to get . Therefore, if , . If , to attack , an impostor must guess the rest biometric traits to break the cryptosystem. Then, when and are disclosed, he must guess at least

[1] D. Gafurov and E. Snekkenes, “Spoof attacks on gait authentication system,” IEEE Trans. Inf. Forensics Security, vol. 2, no. 3, pp. 491–502, Sep. 2007. [2] Q. Xiao, “Security issues in biometric authentication,” in Proc. IEEE Workshop Inf. Assurance Security, New York, Jun. 2005, pp. 8–13. [3] R. Cappelli, A. Lumini, D. Maio, and D. Maltoni, “Finger image reconstruction from standard templates,” IEEE Trans. Pattern Anal. Mach. Intell., vol. 29, no. 9, pp. 1489–1503, Sep. 2007. [4] A. Ross, J. Shah, and A. K. Jain, “From template to image: Reconstructing fingerprints from minutiae points,” IEEE Trans. Pattern Anal. Mach. Intell., vol. 29, no. 4, pp. 544–560, Apr. 2007. [5] A. Adler, “Can images be regenerated from biometric templates,” in Proc. Biometr. Consortium Conf., Washington, D.C., Sep. 2003. [6] R. M. Bolle, J. H. Connel, and N. K. Ratha, “Biometric perils and patches,” Pattern Recogn., vol. 35, no. 12, pp. 2727–2738, Dec. 2002. [7] N. K. Ratha, J. Connell, R. M. Bolle, and S. Chikkerur, “Cancelable biometrics: A case study in fingerprints,” in Proc. 18th Int. Conf. Pattern Recogn., Hong Kong, China, Aug. 2006, pp. 370–373. [8] L. Hong, A. K. Jain, and S. Pankanti, “Can multibiometrics improve performance,” in Proc. AutoID, NJ, Oct. 1999, pp. 59–64. [9] A. K. Jain, A. Ross, and S. Pankanti, “Biometrics: A tool for information security,” IEEE Trans. Inf. Forensics Security, vol. 1, no. 2, pp. 125–143, Jun. 2006. [10] A. Ross and A. K. Jain, “Information fusion in biometrics,” Pattern Recogn. Lett., vol. 24, no. 13, pp. 2115–2125, Sep. 2003. [11] A. Rattani, D. R. Kisku, M. Bicego, and M. Tistarelli, “Feature level fusion of face and fingerprint biometrics,” in IEEE Int. Conf. Biometrics: Theory, Appl., Syst. (BTAS), Washington, DC, Sep. 2007, pp. 27–29.


882


[12] C. Soutar, D. Roberge, A. Stoianov, R. Gilroy, and B. V. K. V. Kumar, “Biometric encryption,” in ICSA Guide to Cryptography, R. K. Nichols, Ed. New York: McGraw-Hill, 1999, ch. 22. [13] A. Cavoukian and A. Stoianov, “Biometric encryption: A positive-sum technology that achieves strong authentication, security and privacy”, Tech. Rep. Information and Privacy Commissioner, Ontario, Canada, 2007 [Online]. Available: www.ipc.on.ca [14] U. Uludag, S. Pankanti, S. Prabhakar, and A. K. Jain, “Biometric cryptosystems: Issues and challenges,” Proc. IEEE, vol. 92, no. 6, Jun. 2004. [15] K. Nandakumar, “Multibiometric systems: Fusion strategies and template security,” Ph.D. thesis, Dept. Computer Science and Engineering, Michigan State Univ., East Lansing, MI, 2008. [16] C. C. Chibelushi, J. S. D. Mason, and F. Deravi, “Feature-level data fusion for bimodal person recognition,” in Proc. 6th Int. Conf. Image Process. Appl., Dublin, Ireland, Jul. 1997, vol. 1, pp. 399–403. [17] B. Son and Y. Lee, “Biometric authentication system using reduced joint feature vector of iris and face,” in Proc. 5th Int. Conf. Audio and Video-Based Biometric Person Authent., Rye Brook, NY, Jul. 2005, pp. 513–522. [18] S. C. Dass, K. Nandakumar, and A. K. Jain, “A principled approach to score level fusion in multimodal biometric systems,” in Proc. 5th Int. Conf. Audio and Video-Based Biometric Person Authent., Rye Brook, NY, Jul. 2005, pp. 1049–1058. [19] K. Veeramachaneni, L. A. Osadciw, and P. K. Varshney, “An adaptive multimodal biometric management algorithm,” IEEE Trans. Syst., Man Cybern. C, Appl. Rev., vol. 35, no. 3, pp. 344–356, Aug. 2005. [20] K. A. Toh and W. Y. Yau, “Combination of hyperbolic functions for multimodal biometrics data fusion,” IEEE Trans. Syst., Man Cybern. B, Cybern., vol. 34, no. 2, pp. 1196–1209, Apr. 2004. [21] A. Juels and M. Wattenbeg, “A fuzzy commitment scheme,” in Proc. 6th ACM Conf. Comput. Commun. Security, Singapore, 1999, pp. 28–36. [22] A. Jules and M. Sudan, “A fuzzy vault scheme,” Designs, Codes Cryptogr., vol. 38, no. 2, pp. 237–257, Feb. 2006. [23] U. Uludag, S. Pankanti, and A. K. Jain, “Fuzzy vault for fingerprints,” in AVBPA2005: Audio- and Video-Based Biometric Person Authentication. New York: Springer, 2005, vol. 3546, pp. 310–319. [24] K. Nandakumar, A. K. Jain, and S. Pankanti, “Fingerprint-based fuzzy vault: Implementation and performance,” IEEE Trans. Inf. Forensics Security, vol. 2, no. 4, pp. 744–757, Dec. 2007. [25] F. Hao, R. Anderson, and J. Daugman, “Combining crypto with biometrics effectively,” IEEE Trans. Comput., vol. 55, no. 9, pp. 1081–1088, Sep. 2006. [26] Y. Dodis, R. Ostrovsky, L. Reyzin, and A. Smith, “Fuzzy extractors: How to generate strong keys from biometrics and other noisy data,” in Proc. Eurocrypt, 2004, pp. 523–540. [27] X. Boyen, “Resuable cryptographic fuzzy extractor,” in Proc. ACM Conf. Computer and Communications Security, Washington, DC, Oct. 2004, pp. 82–91. [28] W. J. Scheirer and T. E. Boult, “Cracking fuzzy vaults and biometric encryption,” in Proc. IEEE Biometr. Symp., Baltimore, MD, Sep. 2007, pp. 1–6. [29] A. Kholmatov and B. Yanikoglu, “Realization of correlation attack against the fuzzy vault scheme,” in Proc. SPIE, 2008, vol. 6819, pp. 68190O–68190O-7. [30] J. D. Golic and M. Baltatu, “Entropy analysis and new constructions of biometric key generation systems,” IEEE Trans. Inf. Theory, vol. 54, no. 5, pp. 2026–2040, May 2008. [31] U. Dieckmann, P. Plankensteiner, R. Schamburger, B. Froba, and S. Meller, “SESAM: A biometric person identification system using sensor fusion,” in Proc. 1st Int. Conf. Audio- and Video-Based Biometric Person Authentication, 1997, vol. 1206, LNCS, pp. 301–310. [32] Y. Sutcu, Q. Li, and N. Memon, “Secure biometric templates from fingerprint-face features,” in Proc. CVPR Workshop on Biometr., Minneapolis, MN, Jun. 2007, pp. 1–6. [33] K. Nandakumar and A. K. Jain, “Multibiometric template security using fuzzy vault,” in Proc. IEEE Int. Conf. Biometrics: Theory, Applications and Systems, Arlington, VA, Sep. 2008, pp. 1–6. [34] E. Camlikaya, A. Kholmatov, and B. Yanikoglu, “Multimodal biometric templates for verification using fingerprint and voice,” in SPIE Defense Security: Biometr. Technol. Human Identif. V, Orlando, FL, Mar. 2008. [35] B. Yanikoglu and Kholmatov, “Combining multiple biometrics to protect privacy,” in Proc. ICPR-BCTP Workshop, Cambridge, England, Aug. 2004.

Bo Fu received the M.S. degree in computer science and engineering in 2005 from the University Electronic Science and Technology of China. He is currently pursuing the Ph.D. degree in information security with the University Electronic Science and Technology of China. He joined the Advanced Robotics and Intelligent Systems (ARIS) Lab, University of Guelph, Canada, during 2007–2008 as a visiting scholar. His research interests include cryptography, biometric recognition, and wavelet analysis.

Simon X. Yang (S’97–M’99–SM’08) received the B.Sc. degree in engineering physics from Beijing University, China, in 1987, the first of two M.Sc. degrees in biophysics from Chinese Academy of Sciences, Beijing, in 1990, the second M.Sc. degree in electrical engineering from the University of Houston, TX, in 1996, and the Ph.D. degree in electrical and computer engineering from the University of Alberta, Edmonton, Canada, in 1999. He joined the School of Engineering, University of Guelph, Canada, in 1999. Currently, he is a Professor and the Head of the Advanced Robotics and Intelligent Systems (ARIS) Laboratory, University of Guelph. His research interests include intelligent systems, robotics, sensors and multisensor fusion, wireless sensor networks, control systems, soft computing, and computational neuroscience. Prof. Yang serves as an Associate Editor of the IEEE TRANSACTIONS OF NEURAL NETWORKS, IEEE TRANSACTIONS ON SYSTEMS, MAN, AND CYBERNETICS, PART B, International Journal of Robotics and Automation, and serves as an Associate Editor or Editorial Member of several other journals. He has involved in the organization of many conferences. He is the General Chair of the 2006 International Conference on Sensing, Computing, and Automation.

Jianping Li received the M.S. degree in computing mathematics and the M.E. degree in soft engineering from Xi’An Jiaotong University in 1989, and the Ph.D. degree in computer science from Chongqing University in 1998. As a visiting scholar, he visited some famous universities around the world during 1999–2006. He is the author and/or coauthor of 18 books on subjects ranging from wavelet analysis and its applications to computer science, and has published more than 200 technical papers. His current interests include wavelet theory and applications, fractal, image processing, pattern recognition , electronic commerce, and information security. Dr. Li is the General Chairman of the First Conference on Wavelets Analysis and Its Applications to Signal Processing of China (2000), the Associate Chairman of the Second International Conference on Wavelet Analysis and Its Applications in Hong Kong (Hong Kong Baptist University, 2001), the Chairman of the International Computer Congress 2004 (ICC04), Chairman of the Second International Conference on Active Media Technology (ICAMT04), Chairman of the International Conference 2007 on Information Computing and Automation (ICICA07), and the Chairman of ICACIA08.

Dekun Hu received the M.S. degree from the University Electronic Science and Technology of China, Sichuan, in 2005. He is currently pursuing the Ph.D. degree in signal processing with the School of Computer Science and Engineering. He spent one year (2007–2008) with the Advanced Robotics and Intelligent Systems (ARIS) Lab, University of Guelph, Canada, working on object recognition algorithms. His research interests include object recognition and Internet content audit.
