Fast and Accurate Likelihood Ratio-Based Biometric Verification Secure Against Malicious Adversaries

Abstract

Biometric verification has been widely deployed in current authentication solutions as it proves the physical presence of individuals. Several solutions have been developed to protect the sensitive biometric data in such systems that provide security against honest-but-curious (a.k.a. semi-honest) attackers. However, in practice, attackers typically do not act honestly and multiple studies have shown severe biometric information leakage in such honest-but-curious solutions when considering dishonest, malicious attackers.In this paper, we propose a provably secure biometric verification protocol to withstand malicious attackers and prevent biometric data from any leakage. The proposed protocol is based on a homomorphically encrypted log likelihood-ratio (HELR) classifier that supports any biometric modality (e.g., face, fingerprint, dynamic signature, etc.) encoded as a fixed-length real-valued feature vector. The HELR classifier performs an accurate and fast biometric recognition. Furthermore, our protocol, which is secure against malicious adversaries, is designed from a protocol secure against semi-honest adversaries enhanced by zero-knowledge proofs. We evaluate both protocols for various security levels and record a sub-second speed (between 0.37s and 0.88s) for the protocol secure against semi-honest adversaries and between 0.95s and 2.50s for the protocol secure against malicious adversaries.

Dynamic Signature Verification Using Pattern Recognition

“…By leveraging HELR, the security of signatures is heightened, resulting in elevated accuracy in verification and improved feasibility and effectiveness of biometric systems. It is worth noting that the proposed protocol demands increased computational effort during the deviation of biometric patterns [6].…”

Comments on “PassBio: Privacy-Preserving User-Centric Biometric Authentication”

“…In [1], it is proved that PassBio is secure in two attack models involving honest-but-curious and malicious servers, guaranteeing privacy protection from these servers. However, for mobile-device-based online biometric authentication, such as that considered in [1], many previous studies [2], [3], [4] have also considered malicious clients for real threat models. Under a practical scenario with phishing attacks, which have recently become rampant, a phishing message from an attacker may trick a victim user into clicking a URL and installing malware.…”

“…Because malware can control a compromised device, it is assumed that a malicious client can access the public parameters param and secret key sk stored in a user's device but cannot access the user's template stored in the SP , which is an assumption applied in many previous studies, e.g., [3]. To restrict access to sk, secure storage, such as a trusted platform module (TPM), may be used.…”

Multiplication-Free Biometric Recognition for Faster Processing under Encryption

“…Among existing BTPs, homomorphic encryption (HE) based BTPs [4][5][6][7][8] seem promising in tackling these issues since they carry both the biometric data and its processing to an encrypted domain. Generally, HE-based BTPs compare two encrypted biometric feature vectors against each other by measuring a (dis-)similarity score under encryption and then delivering, to the party of interest, either 1) a final score (followed by a clear-text comparison with the threshold [4][5][6][7] yielding the recognition decision) or 2) the final recognition decision (that was preceded by an encrypted comparison with the threshold [8]). Calculating such a (dis-)similarity score under encryption involves a number of homomorphic multiplications proportional to the feature vector's dimension.…”

“…We compare our approach with [4] in Section 6. The first multiplication-free biometric recognition (MFBR) scheme is the homomorphically encrypted log likelihood-ratio classifier (HELR) introduced in [8]. It pre-computes the log likelihoodratio (LLR) and organizes it into lookup tables, reducing the biometric recognition into three operations: selection of the individual scores from the tables, their addition to calculate a final score, and the comparison of the final score with the biometric threshold.…”