A Framework for Analyzing Template Security and Privacy in Biometric Authentication Systems

Abstract

In this paper we analyze the vulnerabilities of biometric authentication protocols with respect to user and data privacy. The goal of an adversary in such context is not to bypass the authentication but to learn information either on biometric data or on users that are in the system. We elaborate our analysis on a general system model involving four logical entities (sensor, server, database and matcher), and we focus on internal adversaries to encompass the situation where one or a combination of these entities would be malicious. Our goal is to emphasize that when going beyond the usual honest-but-curious assumption much more complex attacks can affect the privacy of data and users. On the one hand, we introduce a new comprehensive framework that encompasses the various schemes we want to look at. It presents a system model in which each internal entity or combination of entities is a potential attacker. Different attack goals are considered and resulting requirements on data flows are discussed. On the other hand, we develop different generic attacks. We follow a blackbox approach in which we consider components that perform operations on biometric data but where only the input/output behavior is analyzed. These attack strategies are exhibited on recent schemes such as the distributed protocol of Bringer et al. (ACISP 2007), which is based on the Goldwasser-Micali cryptosystem, the related protocol of Barbosa et al. (ACISP 2008), which uses the Paillier cryptosystem, and the scheme of Stoianov (SPIE 2010), that features the Blum-Goldwasser cryptosystem. All these schemes have been developed in the honest-but-curious adversary model and show potential weaknesses when considered in our malicious insider attack model.

Privacy-Preserving Biometric Authentication: Challenges and Directions

“…For a detailed description of the adversarial model, we refer the reader to, for example, [15][16][17]. Below, we list the four main threats that afflict privacy-preserving biometric authentication systems [18].…”

Efficient Verifiable Computation of XOR for Biometric Authentication

“…As an example CS could compute gpEncpb i q, Encpvqq, where v is a chosen vector by CS, and subsequently send the result to SP, which outputs Out SP . By mounting a variant of the hill climbing attack [5], performing multiple repeated attempts, each time carefully choosing v, the stored template b i can be retrieved. Such attacks against several protocols proposed in [6][7][8] are presented in [9][10][11].…”

“…Bringer et al [8] proposed a distributed biometric authentication protocol using the Goldwasser-Micali cryptosystem [15] to protect the privacy of the biometric templates against honest-but-curious (or passive) adversaries. Nevertheless, some attacks on this protocol were reported in [5,11,18]. In [11], the authors have also improved upon the Bringer et al protocol to achieve security against malicious but non-colluding adversaries.…”

“…In [11], the authors have also improved upon the Bringer et al protocol to achieve security against malicious but non-colluding adversaries. Simoens et al [5] also presented a framework for analysing the security and privacy-preserving properties of biometric authentication protocols. In particular, they showed how biometric authentication protocols designed to be secure against honest-but-curious adversaries can be broken in the presence of malicious insider adversaries.…”

THRIVE: threshold homomorphic encryption based secure and privacy preserving biometric verification system

“…In addition to this, there are a number of studies pointing out the privacy leakage of biometric applications [37,38] as well as biometric template protection methods [14,15,39]. In the literature, Zhou et al propose a framework for security and privacy assessment of the biometric template protection methods [14].…”