Unlinkable improved multi-biometric iris fuzzy vault

Abstract

Iris recognition technologies are deployed in numerous large-scale nation-wide projects in order to provide robust and reliable biometric recognition of individuals. Moreover, the iris has been found to be rather stable over time, i.e. iris biometric reference data provides a strong and permanent link between individuals and their biometric traits. Hence, unprotected storage of (iris) biometric data provokes serious privacy threats, e.g. identity theft, limited re-newability, or cross-matching. Biometric cryptosystems grant a significant improvement in data privacy and increase the likelihood that individuals will effectively consent in the biometric system usage. However, the vast majority of proposed biometric cryptosystems do not guarantee desired properties of irreversibility, unlinkability, and re-newability without significantly degrading the biometric performance.

In this work, we propose an unlinkable multi-instance iris biometric cryptosystem based on the improved fuzzy vault scheme. The proposed system locks biometric feature sets extracted from binary iris biometric reference data, i.e. iris-codes, of the left and right irises in a single fuzzy vault. In order to retain the size of the protected template and authentication speed, the proposed fusion step combines the most discriminative parts of two iris-codes at feature level. It is shown that the proposed key-binding process enables the generation of irreversible protected templates which prevents from previously proposed cross-matching attacks. Further, we investigate the optimal choice among potential decoding strategies with respect to biometric performance and time of key retrieval. The fully reproducible system is integrated to two different publicly available iris recognition systems and evaluated on the CASIAv3-Interval and the IITDv1 iris databases. Compared to the corresponding unprotected recognition schemes, genuine match rates of approximately 95 and 97 % at which no false accepts are observed and maintained in a single- and multi-instance scenario, respectively. Moreover, the multi-iris system is shown to significantly improve privacy protection achieving security levels of approximately 70 bits at practical biometric performance.

1 Introduction

Biometrics refers to the automated recognition of individuals based on their behavioral and biological characteristics, e.g. fingerprint or face [1, 2]. It is generally conceded that a substitute to biometrics for positive identification in integrated security applications is non-existent. In past decades, iris recognition [3, 4] emerged as a rapidly growing field of research. Due to its intricate structure, the iris constitutes one of the most powerful biometric characteristics. Existing approaches to iris recognition achieve auspicious biometric performance and deployments in diverse application scenarios, such as border control, underline its tremendous impact [5]. On national-sized biometric systems, the use of multiple biometric characteristics has been found to significantly improve the accuracy and reliability especially in challenging identification scenarios [6], while recognition systems based on a single biometric indicator often have to contend with unacceptable error rates [7]. However, improvement in biometric performance as a result of biometric fusion should be weighed against the associated overhead involved, such as additional sensing cost, i.e. it is preferred to combine biometric characteristics that can be acquired in a single presentation [8]. For instance, in the Unique IDentification Authority of India (UIDAI) [9], which aims at registering all 1.2 billion Indian citizens, both irises and all fingers of a subject are acquired at enrollment. Similar national projects are also under way in Indonesia and in several smaller countries [10].

Generic iris recognition systems, see Fig. 1 a, consist of four major modules: (1) image acquisition; (2) pre-processing; (3) feature extraction; and (4) comparison. At image acquisition, good-quality NIR images are required to provide a robust recognition, where most current deployments require subjects to fully cooperate with the system. At pre-processing, the pupil and the outer boundary of the iris are detected. Subsequently, general iris recognition algorithms transform the iris ring to a normalized rectangular texture on which image enhancement methods, e.g. histogram stretching, are applied. To complete the pre-processing, the parts of the iris texture which are occluded by eyelids, eyelashes, or reflections are detected and stored in an according noise mask. The vast majority of feature extraction algorithms follow the approach of Daugman [3], in which a binary feature vector, i.e. iris-code, is extracted by applying adequate filters to the iris texture in a row-wise manner. The data representation based on an iris-code offers compact storage and rapid Hamming distance-based (H D) comparison.

Fig. 1

Processing chains of a a conventional unprotected (multi-) iris recognition system and of b the proposed (multi-) iris fuzzy vault system

Recently, different researchers have shown that, in case an attacker has full knowledge of the employed feature extraction, iris-codes can be utilized in order to reconstruct images of subjects’ iris textures [11, 12]. Such images can be presented to an iris recognition system in order to successfully launch presentation attacks [13]. In order to safeguard individuals’ privacy, protection of biometric templates is of utmost importance, since unprotected storage of biometric templates poses serious privacy threats. Technologies of biometric template protection [14, 15], which are commonly categorized as biometric cryptosystems [16] and cancelable biometrics [17], offer solutions to privacy preserving biometric authentication. Biometric cryptosystems are designed to securely bind a digital key to a biometric or generate a digital key from a biometric signal [16] in order to meet the two major requirements of biometric template protection defined in the ISO/IEC IS 24745 [18]: (1) irreversibility, i.e. knowledge of a protected template can not be exploited to reconstruct a biometric sample which is equal or close (within a small margin of error) to an original captured sample of the same source; (2) unlinkability, i.e. different versions of protected biometric templates can be generated based on the same biometric data (re-newability), while protected templates should not allow cross-matching.

Apart from fulfilling the above properties, an ideal biometric cryptosystem shall not cause a decrease in biometric performance with respect to the corresponding unprotected system [19]. The vast majority of existing techniques do not satisfy desired template protection requirements in practice, mostly resulting in a trade-off between privacy protection and biometric performance [20]. The incorporation of multiple biometric characteristics to biometric cryptosystems has been found to improve biometric performance [7], while the protection of multi-biometric templates is especially crucial as they contain information regarding multiple characteristics of the same subject [21]. In contrast to conventional biometric systems, where fusion may take place at score or decision level [7], with respect to template protection schemes, feature-level fusion has been identified as most suitable. A separate storage of two or more protected biometric templates would enable parallelized attacks. In contrast, a single protected template, which has been obtained by means of feature-level fusion, is expected to improve privacy protection, since the fused template comprises more biometric information [21]. This is analogous to an access control system which requires multiple low strength (few bits) keys, where each key can be attacked individually. Such a system is less secure than one which uses a single key with a larger number of bits. Obviously, the development of multi-biometric cryptosystems is accompanied by further issues such as common data representation, storage requirement, or feature alignment [22].

1.1 Contribution of work

In this work, we present an unlinkable multi-biometric iris-cryptosystem based on the fuzzy vault scheme [23]. As shown in Fig. 1 b, one property of the proposed scheme is that it can be seamlessly integrated to an existing iris recognition system. Since it is designed to protect iris-codes, a re-enrolment of already registered subjects is not required, in contrast to proposed iris-based fuzzy vault schemes (see Section 2), which build upon specific feature extractors. The presented scheme is extended to a multi-iris template protection scheme where biometric fusion takes place at feature level, in order to maximize privacy protection. In order to minimize processing time as well as storage requirement, the fusion process is designed to retain the size of a single protected template. To maximize the entropy, and hence discriminativity, of the fused template, the most reliable feature parts of two iris-codes are combined, and based on a detailed investigation of decoding strategies, we choose an ideal trade-off between computational and biometric performance. Thereby, authentication times, which are of equal magnitude for single- and multi-iris fuzzy vaults, are kept low while accuracy is significantly improved.

The proposed system, which is evaluated on two publicly available iris databases for different iris biometric feature extractors, maintains biometric performance of corresponding unprotected baseline systems. In addition, security analysis show that the system is resistant to existing cross-matching attacks and provides cryptographically acceptable security levels confirming the soundness of the presented approach.

1.2 Organisation of article

The remainder of this article is organized as follows: Section 2 briefly summarizes related works regarding iris biometric cryptosystems and the fuzzy vault scheme. Section 3 provides a detailed description of key components of the proposed unlinkable improved (multi-)biometric iris fuzzy vault. Experiments are presented in Section 4. Finally, conclusions are drawn in Section 5.

2 Related work

2.1 Iris biometric cryptosystems

Among conceptual proposals [24, 25], the first implementation of an iris biometric cryptosystem, in which the fuzzy commitment scheme is employed [26], was presented in [27]. The fuzzy commitment scheme by Juels and Wattenberg [26] represents a cryptographic primitive, which combines techniques from the area of error correcting codes and cryptography. At key-binding, a pre-chosen key is prepared with error correcting codes and bound to a binary biometric feature vector of the same length by XORing both resulting in a difference vector. In addition, a hash of the key is stored together with the difference vector forming the commitment. During key retrieval, another binary feature vector is XORed with the stored difference vector and error correction decoding is applied. In case the presented feature vector is sufficiently “close” to the stored one, the correct key is returned, which can be tested using the stored hash. In [27], 2048-bit iris-codes are applied to bind and retrieve 140-bit keys prepared with Hadamard and Reed-Solomon error correction codes. On an in-house dataset comprising 700 iris images of 70 subjects, a FNMR of 0.47 % at a zero FMR is reported. To provide a more efficient error correction decoding in an iris-based fuzzy commitment scheme, two-dimensional iterative min-sum decoding was introduced in [28] achieving a FNMR of 5.62 % at a zero FMR on the ICE 2005 iris database [29], where bound keys consist of 40 bits. A context-based reliable component selection used to extract keys from iris-codes which are then bound to Hadamard codewords is presented in [30]. Further, diverse techniques to improve the performance and security of (iris) fuzzy commitment schemes have been proposed, e.g. [31–34]. In [35, 36], different attacks have been suggested, which utilize the fact that error correction codes underlie distinct structures. Statistical attacks based on so-called error correction code histograms have been successfully conducted against iris-based fuzzy commitment schemes in [37]. In [38], it was found that fuzzy commitment schemes leak information in bound keys and non-uniform templates. Suggestions to prevent from information leakage in fuzzy commitment schemes have been proposed in [39]. In addition, attacks via record multiplicity could be applied to decode stored commitments [40, 41]. In [33], a bit-permutation process was introduced to prevent from cross-matching attacks. It is, however, important to note that even if one uses record-specific bit-permutation processes, cross-matching may still be possible for records protecting very similar feature vectors and then even enables reversibility attacks from record multiplicity [42]. Considering proposed attacks, the security provided by iris-based fuzzy commitment is rather doubtable.

Focusing on iris, the first implementation of a fuzzy vault scheme (see Section 2.2) was presented in [43, 44] in which salient feature points are extracted from iris textures. Based on several enrolment samples, independent component analysis and k-means clustering is employed to extract 16 coefficients from most stable parts of the iris textures. On the BERC [45] and the CASIAv3-Interval iris database [46], a GMR of approximately 99 and 80 %, respectively, was achieved at a zero FMR employing 128 bit keys. In order to prevent from attacks via record multiplicity, an iris fuzzy vault which is hardened with an additional password is presented in [47, 48]. Image enhancement techniques are applied to extract iris fibres from which minutiae-like coordinates are extracted. Experiments are reported for the CASIAv1 [49] and the MMU iris database [50] achieving a GMR of at most 90 % at a zero FMR. In [51], a multi-biometric fuzzy vault based on fingerprint and iris is proposed. Secret keys, which are used to generate an iris-based fuzzy commitment, are directly encoded, fused with fingerprint data at feature level, and locked in the fuzzy vault scheme, achieving a GMR of approximately 98 % at a FMR of 0.01 % on the in-house MSU-DBI fingerprint [52] and the CASIAv1 iris database [49] for a key size of 208 bit. However, the scheme requires an additional storage of corresponding difference vectors which allows for previously mentioned attacks. Further proposal of iris fuzzy vaults, e.g. [53–55], omit a detailed description of employed iris feature encoding or experimental protocols.

The majority of proposed approaches to iris biometric cryptosystems lack a thorough security analysis. It is important to note that the length of employed keys in biometric cryptosystems represents only an upper bound for the provided security. For instance, the scheme in [27], which is designed to bind and retrieve 140 bit keys, provides a security of approximately 40 bits [51]. This reduction is mainly caused by dependencies among neighbouring iris-code bits resulting in a large entropy loss.

Apart from iris biometric cryptosystems, different approaches to cancelable iris biometrics have been proposed, e.g. [56–60]. For further details on cancelable iris biometrics, the reader is referred to [15, 61].

2.2 Fuzzy vault scheme

By design, the fuzzy vault scheme [23, 62] enables protection and error-tolerant verification with feature sets. It is due to this property that led researchers to consider the fuzzy vault scheme as a promising tool for protecting fingerprint minutiae sets [63]. This preliminary analysis was followed by a series of working implementations for fingerprints most of which are minutiae-based [64, 65]. However, the fuzzy vault scheme as proposed by Juels and Sudan is vulnerable to a certain kind of linkage attacks, the correlation attack [66, 67], that very clearly conflicts with the unlinkability requirement and (even worst) with the irreversibility requirement of effective biometric template protection. Moreover, the use of public unprotected auxiliary alignment data can ease an attacker in performing linkage attacks. As a countermeasure, an implementation for absolutely pre-aligned minutiae that avoids any correlation between related records of the fuzzy vault scheme has been proposed [68]. Another advantage from the construction in [68] is that the improved fuzzy vault scheme by Dodis et al. [69] can be used for template protection which results in significantly more compact record sizes. Compared to earlier works [63, 64], security levels have been revealed to be approximately 40 bits for single-finger fuzzy vaults. It is important to note that other linkage attacks can be applied to the improved fuzzy vault scheme but they can, however, be effectively avoided [70].

It is a widely accepted hypothesis that the fingerprint modality does not contain a sufficient amount of effective entropy to resist attacks exploiting the distribution of fingerprint features, specifically false-accept attacks. From this perspective, we should increase the amount of entropy by considering implementations for fused templates extracted from more than one finger of a person [71] or, as a promising alternative, consider other biometric modalities such as a person’s iris(es).

When designing a fuzzy vault-based cryptosystem, a practical decoding strategy is needed. Though, in the original fuzzy vault [23, 62], a Reed-Solomon decoder [72] has been proposed, its resulting error-correcting capabilities are not sufficient to achieve a practical implementation for single finger. As a consequence, the use of a Lagrange-based decoder has been proposed [64] and adopted for other single-finger implementations [65, 68]. A multi-finger implementation has been proposed in [71]. If a Lagrange-based decoder was chosen for the implementation, then the decoding complexity would become infeasible. A reasonable trade-off between decoding time and verification performance can be achieved using a Guruswami-Sudan-based decoder [71, 73] of which a Reed-Solomon decoder can be viewed as a special case. In this paper, these strategies are considered for key retrieval in Section 3.4.

3 Proposed system

3.1 From iris-codes to feature sets

As aforementioned, conventional iris recognition schemes extract two-dimensional binary feature vectors, i.e. iris-codes, from iris images [3, 4], cf. Fig. 5. Since the fuzzy vault scheme operates on feature sets, the first processing step of the proposed system represents a feature type transformation [74], in particular a binary-to-integer ordered-to-unordered transformation. In our scheme, an extracted iris-code is vertically divided into B blocks of size w×h bits, where each block, and hence each column, is associated with a block index b=0,…,B−1. Subsequently, transform f is applied to each column c _i ∈{0,1}^h,i=0,…,w−1, of a block with index b,f(c _i ,b)= int(c _i )· log2B+b, where int denotes the conversion of a binary vector to its integer representation. Each block yields a vector V _b of feature values, V _b =(v ₀,…,v _w−1), with v _i =f(c _i ,b). For each vector, V _b ,P _b denotes the sets of unique vector elements, P _b ={v ₀,…,v _l }_≠,l≤w. The set-based representation conceals the ordering of columns within each block; in addition, multiple entries are discarded. Since iris-code bits are not mutually independent [3], correlation between (neighbouring) columns is expected. Hence, a certain amount of columns within each processed block will be identical, as will be shown in experiments; see Section 4. Let |P _b |=l be the number of unique feature values of a transformed iris-code block. For a potential attacker, the reconstruction of the original iris-code block involves an arranging of l codewords to w positions. The degree of irreversibility provided by transform f could be quantified by the number of possible blocks resulting in the same set of features which is estimated as,

$$ \ell = \sum_{j=1}^{l}(-1)^{l-j}\binom{l}{j}j^{w}\text{,} $$

(1)

which follows from a simple application of the inclusion-exclusion principle. Large values of ℓ prevent an attacker from reconstructing (guessing) corresponding original iris-code blocks, which further improves privacy protection. It is important to note that, in contrast to fingerprints, where approximations of original fingerprints can be reconstructed from minutiae coordinates [75], this estimation only applies to the use of iris-codes. The final set of feature values P is estimated as the union of all sets of unique vector elements of all blocks, $\mathbf {P}= \bigcup _{b=0}^{B-1} \mathbf {P}_{b}$, where $|\mathbf {P}| = \sum _{b=0}^{B-1} |\mathbf {P}_{b}|$, since each block index b is unique. The entire procedure of generating P from an iris-code is illustrated in Fig. 2.

Fig. 2

Proposed iris-code to feature set transform: based on binary columns of a block and its corresponding block index, the transform f extracts feature elements from which a set of unique feature elements are generated. For example, for B=8, column 01100110₂=102, and index 001₂=1, we get f(102,1)=817

In the comparison stage, generic iris recognition systems apply circular bit shifts and estimate H D scores at different shifting positions, i.e. relative tilt angles, in order to compensate for head tilts. The minimal obtained H D, which corresponds to an optimal alignment, represents the final score. It is important to note that the number of shifting positions employed to determine an appropriate alignment between pair of iris-codes may vary depending on the application scenario. The proposed set-based representation is alignment-free to a certain extent, since equal columns within certain blocks are mapped to identical feature values. Hence, self-propagating errors caused by an inappropriate alignment of iris-codes are eliminated (radial neighbourhoods persist). The rotation-compensating property of the proposed system comes at the cost of location information of iris-code columns. In case iris-codes are strongly misaligned, columns will end up in different blocks yielding different feature sets. However, as will be shown in experiments, in case of iris images captured under favourable conditions, the proposed representation maintains distinctiveness if w and h are chosen appropriately.

3.2 Multi-instance single-algorithm fusion

An overview of the multi-instance single-algorithm fusion, which is designed to fuse biometric information extracted from the left and right iris of a subject, is depicted in Fig. 3. The proposed fusion technique is motivated by two facts:

Fig. 3

Proposed multi-instance fusion: iris-code bits originating from upper and lower iris parts are discarded and remaining iris-code chunks are concatenated prior to extracting to extracting feature sets

• 1. Average decoding times generally increase with the size of a fuzzy vault. Hence, a fusion of the most discriminative parts of two iris-codes to one of the size of a single iris-code is preferable, in order to maintain reasonable decoding times.

• 2. Upper and lower iris parts are frequently occluded by eyelids or eyelashes, cf. Fig. 4 (even under active participation of captured subjects). It has been found that the use of a general noise mask reveals performance gains comparable to that obtained by subject-specific masks [76].

Fig. 4

Sample pairs of left and right 320×240 pixel NIR iris images of the IITDv1 Iris Database (numbers in captions refer to identifiers). It can be observed that upper and lower iris parts are frequently occluded by eyelids and eyelashes

In order to extract discriminative and stable feature sets of reasonable size, iris-code parts which originate from upper and lower iris parts (marked grey in Fig. 3) are discarded. Discarding iris-code blocks originating from those parts represents a static way of extracting half of the bits expected to be rather stable, which does not require the storage of any auxiliary data. Note that additional subject-specific data pointing at most reliable iris-code parts might enable linkage attacks. The resulting iris-code parts of the left and right iris of width w×K/2 are concatenated, resulting in a single iris-code of dimension equal to that of an iris-code extracted from a single image (without deleting upper and lower iris-code parts). The stability of selected iris-code parts will be empirically analysed in experiments; see Section 4. Finally, the previously described method is employed to extract a single feature set. The presented feature-level fusion does not affect the size of the vault compared to single-instance scenario and, at the same time, retains biometric information expected to be most discriminative [4].

The proposed multi-instance fusion technique requires irises to be aligned properly. However, nowadays, iris sensors are capable of acquiring the left and right irises of a subject simultaneously (using two sensors), which results in an implicit alignment of both irises. Moreover, it is generally conceded that favorable acquisition conditions are considered a fundamental premise for biometric template protection [14]. Hence, the suggested trivial concatenation of iris-code parts is expected to preserve the alignment-free representation of subsequently processed iris-code blocks. Other fusion techniques, e.g. a random shuffling or interleaving of iris-code columns, would obscure neighbourhoods of columns within iris-code blocks and, thus, are expected to decrease the biometric performance of the system.

3.3 Key binding

In the first step of the binding process, a secret polynomial κ∈F[X] of degree smaller than k is chosen, and the hash SHA(κ) is stored. Given a feature set P, extracted from both or a single iris image(s) of a subject, SHA(κ) is used as seed for a record-specific but public bijection σ:F→F, which is applied to re-map the elements of $\mathbf {P}, \hat {\mathbf {P}}=\sigma (\mathbf {P})=\{\sigma (v)|v\in \mathbf {P}\}$. This step is performed in order to prevent from the attack proposed in [70], which is based on the extended Euclidean algorithm. Let V(X) and W(X) be two related vault records protecting the feature sets P and P ^′, respectively; unlinkability can be attacked efficiently and effectively, provided that

$$ |\mathbf{P}\cap\mathbf{P}'|\geq(\max(|\mathbf{P}|,|\mathbf{P}'|)+k)/2 \text{.} $$

(2)

In [70], it is also shown that the probability of Eq. 2 can be destroyed by applying the abovementioned re-mapping of feature elements. Note that the employment of these public maps does not affect the operational performance of the system. Moreover, as σ is generated based on SHA(κ), no additional data storage is required. Due to the assumed randomness of two maps σ and σ ^′, the corresponding sets σ(P) and σ ^′(P ^′) are random and, based on the definition of the hyper-geometric distribution, the probability that with these sets Eq. 2 is fulfilled is equal to

$$ 1-{\rho\choose|\mathbf{P}|}^{-1}\sum_{j=0}^{\omega_{0}-1}{|\mathbf{P}'|\choose j}{\rho-|\mathbf{P}'|\choose |\mathbf{P}|-j} \text{,} $$

(3)

where $\omega _{0}=\lceil (|\mathbf {P}|+k)/2\rceil, \rho =2^{h+\log _{2} B}$, and w.l.o.g. |P|≥|P ^′|. In experiments, it will be shown that the probability of Eq. 3 is sufficiently low in a cryptographic sense; see Section 4.

The next step is performed based on the improved fuzzy vault scheme [69], which improves the original construction by means that it generates significantly more compact records. In the improved fuzzy vault, scheme genuine and chaff feature elements are encoded by a monic polynomial of degree $t=|\hat {\mathbf {P}}|$. The features in $\hat {\mathbf {P}}$, interpreted as elements of a finite field F where |F|=ρ, are bound to the secret polynomial κ by computing $V(X)=\kappa (X)+\prod _{v\in \hat {\mathbf {P}}}(X-v)$, such that the pair (V(X),SHA(κ)) builds our final record.

All elements of $\hat {\mathbf {P}}$ represent columns consisting of exactly h+ log2B bits. The size of the vault increases with t and is upper bounded by the width of processed iris-codes, i.e. |V(X)|≤512(h+ log2B) bits. In order to obscure the size of the vault, which might leak information about the protected iris-code, an additional zero-bit is appended to each element in $\hat {\mathbf {P}}$. Subsequently, random values, for which this additional bit is set to 1, are added to $\hat {\mathbf {P}}$ until a desired maximum vault size is reached. The maximum vault size might be defined as 512(h+1+ log2B) bits or by a maximum observed vault size maxn∈N t _n (h+1+ log2B), where N is the number of registered subjects.

It is important to note that the correlation attack [66, 67], which is a special linkage attack, cannot be applied due to the fact that the improved fuzzy vault scheme encodes a maximal number of chaff points. In such a way, no correlation can be exploited between feature sets protected by two (or more) related instances of the applied fuzzy vault records.

3.4 Polynomial reconstruction strategy and key retrieval

On authentication, an unlocking set U⊂F×F of size u is built containing ω pairs being interpolated by the polynomial κ; we call these pairs genuine. If ω≥k, then it is possible to reconstruct the polynomial κ from U if we assume that we can verify the correctness of κ, e.g. by using the hash value SHA(κ). It may, however, not be feasible to reconstruct κ from U in case ω≥k. For example, we found from our training (see Section 4.2) that we can expect the unlocking set to be of size u≈300; furthermore, if we want to achieve a practical genuine acceptance rate, we need to be able to successfully recover κ from U when it contains ω=100 genuine pairs. In the following, we discuss different recovery strategies for this representative example to find a reasonable decoder.

3.4.1 Iterated Lagrange strategy

One way to reconstruct κ from U is to select k pairs from U and compute the unique polynomial κ ^∗ of degree smaller than k that interpolates them. If all k selected pairs are genuine, then κ∗=κ which can be verified with overwhelming reliability by observing SHA(κ ^∗)=SHA(κ). If not all k selected pairs are genuine, then most likely SHA(κ ^∗)≠SHA(κ) and we may repeat the procedure until SHA(κ ^∗)=SHA(κ). This procedure is guaranteed to, eventually, reveal the secret polynomial κ if ω≥k while for a single step the probability of success is equal to

$$ p_{L}(u,\omega,k)=\binom{\omega}{k}\cdot\binom{u}{k}^{-1}. $$

(4)

However, the procedure can become very impractical to be performed. For instance, if u=300,ω=100, and k=20, then we have to expect to run 2³⁴ iterations before κ is recovered. This is too costly for a practical polynomial reconstruction strategy.

3.4.2 Iterated Reed-Solomon strategy

Alternatively, we may apply a Reed-Solomon decoder (e.g. see [72]). This class of algorithms is capable of recovering κ from U efficiently (by means of deterministic polynomial time) if ω≥(u+k)/2. On the other hand, these class of algorithms will fail to recover κ from U for ω<(u+k)/2. In order to establish a decoding mechanism reasonably dealing with these cases, it is conceivable to choose a c-sized subset U ₀⊂U randomly where |U|≥c≥k, apply the Reed-Solomon decoder to U ₀, and if successfully revealing κ ^∗ with SHA(κ ^∗)=SHA(κ), output the recovered polynomial; otherwise, the procedure is repeated up to a predefined number of steps. This mechanism will succeed eventually if ω≥(c+k)/2 which improves upon the bound ω≥(u+k)/2 since c≥u. The success probability for a single step of the procedure is equal to

$$ p_{\text{RS}}(u,\omega,k,c):=\binom{u}{c}^{-1}\sum_{j=\lfloor(c+k)/2\rfloor}^{\min(u,\omega,c)}\binom{\omega}{j}\cdot\binom{u-\omega}{c-j}. $$

(5)

If in addition, the time z _RS (c,k) for a single iteration is known, then the expected time for the iterated Reed-Solomon strategy to successfully recover κ can be calculated as

$$ \frac{\log(0.5)}{\log(1-p_{RS}(c,\omega,k,c))}\cdot z_{\text{RS}}(c,k). $$

(6)

In order to assess feasibility of the iterated Reed-Solomon decoding strategy, we consider our case example where (u,ω,k)=(300,100,20). For each c=k,...,2ω−k computed with Eq. (5), we applied an experimentally supported analysis on the estimated effort for the iterated Reed-Solomon decoding strategy to successfully decode the vault. For each c, we measured the time z _RS (c,k) a Reed-Solomon decoder applied to an unlocking set of size c would consume and estimated the expected time for a successful recovery using Eq. (6). We found that for c=36, the effort becomes minimal with z _RS(c,k) being very close to zero and p _RS(u,ω,k,c)≈2⁻²⁷. Yet, even though significantly improving upon the iterated Lagrange decoding strategy, an effort of 27 bits is still too costly for a practical implementation.

3.4.3 Iterated Guruswami-Sudan strategy

The bound ω≥(u+k)/2 can be significantly improved by applying a Guruswami-Sudan algorithm [73]. This class of algorithms can potentially recover κ from U provided that $\omega >\sqrt {u\cdot (k-1)}$. However, in practice, implementations of the Guruswami-Sudan decoder may be too time-consuming if one aims at recovering exactly up to $u-\sqrt {u\cdot (k-1)}$ errors. The number of errors that one can tolerate depends on an additional parameter controlling input to a Guruswami-Sudan algorithm called multiplicity. The higher the multiplicity, the more errors the algorithm can tolerate while also being more inefficient. The lower the multiplicity, the more efficient is the algorithm but being able to tolerate fewer errors, e.g. $\approx u-\sqrt {2\cdot u\cdot (k-1)}$ for a single multiplicity. Yet, this can still be a significant improvement as compared to a Reed-Solomon decoder.

In the same way as for the iterated Reed-Solomon strategy, we could apply an iterated Guruswami-Sudan strategy which, given u,ω,k, and c, will recover κ from U in a single step with probability

$$ \begin{aligned} p_{\text{GS}}(u,\omega,k,c):=\binom{u}{c}^{-1}\sum_{j=\lfloor\sqrt{c\cdot(k-1)}+1\rfloor}^{\min(u,\omega,c)}\binom{\omega}{j}\cdot\binom{u-\omega}{c-j}. \end{aligned} $$

(7)

For (u,ω,k)=(300,100,20) we found that c=297 yields the best iterated Guruswami-Sudan strategy (for a single multiplicity) where each step consumes z _GS (c,k) time (a fraction of a second on a standard workstation, see Section 4.3) with success probability p _GS (u,ω,k,c)≈0.96 %. It has furthermore been measured that a single step is approximately 2⁹ times harder to perform than a single Lagrange interpolation. This results in an overall difficulty to recover κ from U with more than 95 % probability of only 9 bits and clearly shows that this strategy outperforms the iterated Lagrange and Reed-Solomon strategy.

3.4.4 Proposed strategy

The different decoding strategies that we discussed above have been tested for (u,ω,k)=(300,100,20) which is a typical property of an unlocking set being built on a genuine verification. Since a Guruswami-Sudan strategy clearly is the best choice from the above experiments, we choose a Guruswami-Sudan strategy. Furthermore, since c≈u has been found as the optimal choice, we will only apply a single step of the Guruswami-Sudan algorithm to the entire unlocking set U and no subsets thereof. Moreover, we use a multiplicity of three which yields a decoder with a reasonable trade-off of error tolerance and decoding time, i.e. less than a second [71].

Our discussion emphasizes that it is hard to choose an optimal polynomial recovery strategy, mainly due to the fact that one can either optimize the decoding time or the success probability but not both (unless a predefined trade-off between the two criteria can be selected). From our discussion, we have chosen the final decoding strategy from experimental observations and a final educated guess. However, it must be stressed that a Guruswami-Sudan strategy is not necessarily the best strategy. For example, whenever one wants to successfully decode even if ω=k, then the iterated Lagrange strategy is optimal, and if ω≥(u+k)/2, then the Reed-Solomon decoding strategy yields to the best decoder. It seems therefore reasonable to develop a dynamic decoder switching between different strategies depending on the expected values for ω given u and k. This is an interesting topic; the analysis of which we leave open for future research. The reader should be aware of the fact that from an attacker’s point of view, other strategies can be much more efficient—e.g. strategies that employ the statistics of the protected features as, for example, a false-accept attack.

4 Experimental evaluation

4.1 Database and experimental method

Experiments are carried out on the CASIAv3-Interval [46] and the IITDv1 iris database [77], where all left eye images of the CASIAv3 database are used for training purposes (see Section 4.2) and all five images of left and right eyes of the IITDv1 dataset are used for performance evaluations. Both datasets comprise good-quality NIR iris images of size 320×240 pixel. Number of subjects, images, and resulting amounts of genuine and impostor authentication attempts are summarized in Table 1. Sample pairs of left and right iris images of the IITDv1 database are depicted in Fig. 4.

Table 1 Overview of employed databases, corresponding number of subjects, iris images, and the resulting number of genuine and impostor comparisons

At pre-processing, the iris of a given sample image is detected, un-wrapped to an enhanced rectangular texture of 512×64 pixel, shown in Fig. 5 a–c applying the weighted adaptive Hough algorithm proposed in [78]. In the feature extraction stage, two different iris recognition algorithms are employed where normalized enhanced iris textures are divided into stripes to obtain 10 one-dimensional signals, each one averaged from the pixels of 5 adjacent rows (the upper 512 × 50 rows are analysed). The first feature extraction method follows the Daugman-like 1D-LogGabor feature extraction algorithm of Masek [79] (LG) and the second follows the algorithm proposed by Ma et al. [80] (QSW) based on a quadratic spline wavelet. Both feature extraction techniques generate iris-codes of 512 × 20 = 10,240 bit. Sample iris-codes generated by both feature extraction methods are shown in Fig. 5 d, e. Custom implementations of employed segmentation and feature extractors are freely available in the University of Salzburg Iris Toolkit (USIT) [81]. For further details on the employed feature extraction algorithms, the reader is referred to [10].

Fig. 5

Iris recognition processing chain. a Iris image. b Iris detection. c Normalized iris texture. d Pre-processed iris texture. e, f Iris-codes of applied feature extractor for sample image 001-02 of the IITDv1 database

In accordance with IS ISO/IEC 19795-1:2006 [82], biometric performance is evaluated in terms of genuine match rate (GMR), false non-match rate (FNMR), false match rate (FMR), and equal error rate (EER). In addition, for the proposed fuzzy vault schemes, we estimate average genuine decoding time (GDT) and average impostor decoding time (IDT) and provided brute-force security (BFS) in bits. All experiments were performed on a single core of an Intel Core i7-3610QM CPU with 3.2 GHz on a standard workstation with sufficient RAM.

Its resistance to recovery attacks, i.e. the effort for an imposter given a vault record to recover the original feature sets or the secret polynomial, represents a fundamental aspect of a fuzzy vault implementation. Generally, the fuzzy vault can be attacked by a brute-force attack, where the attacker repeatedly samples k points from the vault and tries to interpolate the secret polynomial from these. The expected number of attempts of this attack can be estimated by combinatorial means [83]. In contrast, the false-accept attack exploits the specific distribution of the biometric features, by repeatedly simulating verifications employing features of randomly chosen (real) iris-codes. The success probability of the false-accept attack is equal to the FMR provided by the employed parameter setting. In order to optimize the success rate, the attacker can deviate from the parameters used in actual operation; however, in the proposed scheme, the number of decoding iterations is the only parameter that is not already fixed at the time of enrolment. It has been proven in [68] that the expected number of decoding attempts of the false-accept attack is minimized for using one iteration. Moreover, it has been shown that an attacker’s success probability is maximized by using simple polynomial interpolation as opposed to using a Reed-Solomon decoder. Hence, we report the security in terms of false-accept security (FA security) using this optimal strategy.

Estimating high security levels assumes sharp estimations of FMRs when they are close to zero. In biometric systems with deterministic verification algorithm, the FMR can only be estimated down to the magnitude of 1/I, where I is the number of impostor verifications performed in the evaluation. However, the verification of our implementation is probabilistic as soon as the unlocking set contains more than k points. This property allows us to give heuristic estimates of FMRs that are much smaller than 1/I: For each single impostor verification, we compute the success probability based on the size of the unlocking set and the number of correct points contained, and finally, we estimate the FMR as the mean over all verifications. For details, we refer to [68].

4.2 Training stage

In the training stage ω, the number of genuine elements in the unlocking set is employed as comparison score between genuine and impostor pairs of feature sets. Since biometric cryptosystems should be operated at reasonable low FMRs, configurations which achieve the highest GMRs at a zero FMR are preferred. Biometric performance in terms of GMR at a zero FMR for different values of h and w is shown in Table 2. Feature blocks are obtained from the uppermost h adjacent rows of iris-codes bits originating from inner bands of the iris, i.e. the number of blocks is estimated as K=512/w for all configurations. Two configurations are identified as optimal, h=10 and w=16 as well as h=10 and w=32. Note that the training step is performed on a disjoint dataset where a single instance, i.e. iris image, is used per subject to calculate ω between pairs feature sets.

Table 2 Biometric performance in terms of GMR (%) at zero FMR for both feature extractors for different parameter settings obtained in the training for left eyes of the CASIAv3 database (settings considered as optimal are marked bold)

4.3 Performance estimation

Sample pairs of left and right iris images of the evaluation dataset are shown in Fig. 4. In the baseline systems, H D-based dissimilarity score are estimated, where ±8 circular bit shifts are performed to obtain a minimum H D. For both feature extraction methods, Fig. 7 visualizes the probability of mis-matching bits between genuine iris-code comparisons. Similar typical two-dome pattern of unstable bits are clearly visible for both feature extractors. Obtained biometric performance is summarized in Table 3 and Fig. 6. As expected, a sum-rule-based score-level fusion of comparison scores between iris-code obtained from both iris images significantly improves biometric performance, yielding EERs below 0.5 %. Note that, in the context of score-level fusion, using the sum-rule with proper normalization, which is implicitly provided due to the use of a single feature extraction per fusion, has been observed to result in competitive performance [8]. Table 4 shows obtained biometric performance after applying the proposed transform for different parameter settings. Again, a sum-rule-based fusion of ω scores across all iris-code blocks is performed for using both iris images. On the one hand, we observe that the set-based representation does not affect (or might even improve) the biometric performance in case a single iris is used. On the other hand, if both irises are employed, a sum-rule-based fusion of H D-based scores reveals better biometric performance, compared to the proposed representation.

Fig. 6

ROC curves of the original unprotected systems estimating H D scores of the left eyes and score-level fusion of both eyes on IITDv1 database

Fig. 7

Heatmaps illustrating the probability of mis-matching bits between genuine iris-code comparisons for both feature extraction methods on the IITDv1 database

Table 3 Baseline performance in terms of GMR at zero FMR and EER of the original unprotected systems estimating H D-scores of left eyes (top) and score-level fusion of both eyes (bottom) on IITDv1 database

Table 4 Biometric performance in terms of GMR (%) at zero FMR and EER (%) and privacy protection in terms of l and ℓ provided by the employed transform for both feature extractors for different parameter settings obtained for left eyes and a score-level fusion of both eyes on the IITDv1 database (h=10)

For the single-instance scenario (using iris images of the left eye), the obtained GMRs and corresponding FMRs, provided security, GDTs, and IDTs for different polynomial degrees k are summarized in Tables 5 and 6 for the LG and QSW feature extraction, respectively. According relations between FNMR and FMR are plotted in Fig. 8. Note that scales for FNMR and FMR have been adjusted to improve visibility. As can be observed, the biometric performance of both unprotected baseline systems is either maintained or slightly improved. Moreover, for best performing configurations, with respect to the polynomial degree k, GDTs and IDTs are significantly smaller than 1 s.

Table 5 Performance of the iris fuzzy vault in terms of GMR, FMR, FA-security, GDT, and IDT in relation to the polynomial degree k, applying the LG feature extraction with w=16 (top) and w=32 (bottom) for left eyes of the IITDv1 database

Table 6 Performance of the iris fuzzy vault in terms of GMR, FMR, FA-security, GDT, and IDT in relation to the polynomial degree k, applying the QSW feature extraction with w=16 (top) and w=32 (bottom) for left eyes of the IITDv1 database

Fig. 8

Biometric performance in terms of FNMR and FMR in relation to reasonable values of the polynomial degree k for optimal parameter settings for both feature extractors using left eyes of the IITDv1 database

Focusing on the proposed multi-biometric fuzzy vault, the probabilities of mismatching bits shown in Fig. 7 confirm the soundness of the proposed selection of iris-code parts. Obtained performance for both feature extractors using different configurations is summarized in Tables 7 and 8, respectively. Compared to obtained performance rates for a sum-rule-based fusion of ω scores across all iris-code blocks shown in Table 4, the presented fusion strategy clearly improves recognition accuracy. According FNMRs and FMRs are plotted in Fig. 9. As can be observed, biometric performance is significantly improved for multi-biometric fuzzy vaults achieving better rates than according baseline systems, which confirms that the proposed fusion retains highly discriminative feature sets. In addition, decoding times increase only sightly due to the compact representation of fused feature sets. By comparing relations between FNMRs and FMRs of single-iris and multi-iris fuzzy vaults, cf. Figures 8 and 9, it can be observed that, for reasonable values of k, both rates significantly decrease across all configurations.

Table 7 Performance of the multi-iris fuzzy vault in terms of GMR, FMR, FA-security, GDT, and IDT in relation to the polynomial degree k, applying the LG feature extraction with w=16 (top) and w=32 (bottom) using left and right eyes of the IITDv1 database

Table 8 Performance of the multi-iris fuzzy vault in terms of GMR, FMR, FA-security, GDT, and IDT in relation to the polynomial degree k, applying the QSW feature extraction with w=16 (top) and w=32 (bottom) using left and right eyes of the IITDv1 database

Fig. 9

Biometric performance in terms of FNMR and FMR in relation to reasonable values of the polynomial degree k for optimal parameter settings for both feature extractors using left and right eyes of the IITDv1 database

For chosen parameters h=10 and w=16,32, the vault size is estimated as 512(h+1+ log2(512/w)). For single- and multi-iris vaults, this results in 512×16=8192 and 512×15=7680 bits for w=16 and w=32, respectively. Hence, compared to the original 512 × 20 bit iris-codes, resulting vault sizes are even smaller, since only the upper (more discriminative) half of the original iris-code is employed. As aforementioned, vault sizes may be further reduced based on an maximum observed number of feature elements in extracted point sets.

4.4 Security analysis

For chosen parameter settings, the average number of unique feature elements per iris-code block, l, and the corresponding amount of different sequences of iris-code columns which result in a single set of feature values, ℓ, according to Eq. 1, is summarized in Table 4. The large values of ℓ indicate a certain degree of irreversibility, which will hamper a systematic reconstruction of iris-code blocks from the proposed set-based representation, even if an attacker succeeds in unlocking the vault. A more thorough analysis of potential reconstruction attacks is beyond the scope of this work.

For all employed parameter settings h=10,w=16,32,k=4,...,32, and 256≤|P ^′|≤|P|≤512, one can verify experimentally that the probability of Eq. 2 never becomes larger than 2⁻¹⁵⁵. This clearly shows that the cross-matching attack from [70] can be effectively prevented.

We estimate the security against recovery attacks by the expected number of decoding attempts that an attacker has to perform with a Lagrange-based decoder after having built the unlocking set using a query template [68]. In this way, our notion of security is a measure of resistance against a certain false-accept attack by also accounting for a decoding complexity. However, it is important to note that there may be more efficient strategies for an attacker to perform. For example, the attacker may rely on a Guruswami-Sudan-based decoder as in the verification protocol or on a completely different (currently unknown) strategy. However, we stress that the security achieved with a Guruswami-Sudan-based decoder cannot be estimated beyond the bound of 2¹⁵ times the decoding complexity—even if the true security is significantly higher. The method from [68] allows to estimate a higher false-accept security; but, the reader should be aware that the resulting security estimates are heuristic false-accept security estimates. Yet, these estimates are still much more realistic and plausible than security estimates against brute-force attacks. Figure 10 compares obtained GMRs versus the security levels, for different parameter settings of the proposed (multi-)biometric fuzzy vault schemes for both employed feature extraction algorithms. Firstly, we observe that security levels provided by iris biometric fuzzy vaults using a single iris appear satisfactory. For GMRs above 90 %, security levels of approximately 50 bits are obtained. Secondly, the use of both irises is shown to be beneficial. On the one hand, it improves biometric performance: at a fixed security level, higher GMRs are obtained when using both eyes; on the other hand, privacy protection is increased: for a fixed GMR, higher security levels are achieved; Hence, depending on the chosen size of k, recognition accuracy and/or privacy protection is improved. At operation points which achieve reasonable GMRs of approximately 90 and 95 %, the security level is increased from 50 to almost 70 bits and 40 to 50 bits, respectively.

Fig. 10

GMRs versus FA-security of proposed (multi) iris biometric fuzzy vaults for both feature extraction algorithms and different parameter settings on the IITDv1 database

Another very important security aspect concerns the risk of correlation attacks on two or more vault records of the same user. Since we use the improved fuzzy vault scheme, which effectively uses all finite field elements as vault points [69], the correlation attack from [66] cannot be applied. On the other hand, there are specific correlation attacks against the improved fuzzy vault scheme based on solving systems of polynomial equations [84] or deploying the extended Euclidean algorithm [70]. However, these attacks only work if in both vault records the features are represented by the same finite field elements, and, hence, are prevented by our use of a record-specific permutation σ of the field elements [68].

5 Conclusions

The link between individuals and their biometric (physiological) characteristics is considered strong and permanent, particularly for iris [3]. Therefore, iris-codes must be protected in order to safeguard individuals’ privacy and biometric systems’ security. Albeit this is rarely the case in operational systems, favourable capture conditions (resulting in low intra-class variance) are considered a fundamental premise for biometric cryptosystems. Consequentially, compared to conventional recognition systems, biometric cryptosystems suffer from a significant decrease in biometric performance. Multi-biometric cryptosystems, which should be designed to combine multiple biometric characteristics at feature level [21], might bridge the gap between biometric performance and privacy protection [19].

The key advantages of the proposed (multi-)iris fuzzy vault scheme can be summarized in three terms: (1) in contrast to the vast majority of biometric cryptosystems, the proposed system maintains biometric performance obtained by the corresponding unprotected iris recognition system in a single- or multi-instance scenario; (2) the suggested fusion technique combines most discriminative information of two iris-codes to a single fuzzy vault and key retrieval is performed based on an analysis of suitable decoding strategies providing fast decoding times; (3) in contrast to existing proposals the presented (multi-)iris fuzzy vault scheme is designed to protect iris-codes, i.e. the protection of an iris biometric database does not require re-enrolment registered subjects.

Furthermore, it is shown that the proposed (multi-)iris fuzzy vault schemes obtain unrivalled security levels in comparison to fuzzy vaults based on other biometric characteristics. Even minutiae-based multi-finger fuzzy vaults using four fingers do not achieve higher security levels [71]. Like in the vast majority of biometric cryptosystems, obtained decoding times may limit the system to be operated in verification mode while protected biometric templates still enable a compact storage. A security analysis for the scenario where an adversary might be in possession of one iris-code prior to attacking a multi-iris fuzzy vault might be subject to future research. Finally, we note that the presented work is based on open-source software and evaluated on public biometric databases, i.e. represents fully reproducible research [85].