1. A Framework of Remote Biometric Authentication on the Open Network
Yoshifumi Ueshige
ISIT 2nd Laboratory
Copyright © 2005,2006 Institute of System & Information Technologies/ KYUSHU
All rights reserved.

2. Institute of Systems & Information Technologies/ KYUSHU
Agenda
Background
Our Goal
Certificate based framework of biometric authentication
One-time Biometrics
Conclusion
1/11/2019
Institute of Systems & Information Technologies/ KYUSHU

3. Institute of Systems & Information Technologies/ KYUSHU
Background
Biometric authentication is remarkable!
Based on Physical and behavioral Characteristics
Fingerprint,
Iris,
Facial image,
Voice,
Pattern of vein
Etc
1/11/2019
Institute of Systems & Information Technologies/ KYUSHU

4. Institute of Systems & Information Technologies/ KYUSHU
Background
Biometric authentication is remarkable!
Biometric systems are applied to many services.
E-passports
Bank
Monitoring entrance
Etc.
1/11/2019
Institute of Systems & Information Technologies/ KYUSHU

5. Background SERIOUS PRIVACY ISSUES On the other hands,
We need secure and reliable authentication systems for many E-Services!
Biometrics is one of the candidates.
However, if we apply biometrics to E-services,
Biometrics has some weak points!
Easy to obtain Secondary information
Sex, History of illness, etc.
Irreplaceable
When enrolled data is compromised,
We are not able to re-enroll spare data.
SERIOUS PRIVACY ISSUES
1/11/2019
Institute of Systems & Information Technologies/ KYUSHU

6. Institute of Systems & Information Technologies/ KYUSHU
Our Goal
Reliable authentication on the open networks by using Biometrics
Viewpoints:
Certificate based framework
What do we require framework for reliable biometric authentication system?
One-time biometrics
How do we construct secure remote biometric authentication systems?
even though biometric authentication data is compromised.
1/11/2019
Institute of Systems & Information Technologies/ KYUSHU

7. Certificate-based framework
Public Key Infrastructure (PKI) with Biometrics
Currently, this area aims to International Standardization
Ikeda et al.’s (Toshiba Solution) proposal
ISO/IEC JTC1/SC27/WG2
Verification of Biometric Authentication Environment
Isobe et al.’s (Hitachi) proposal
ITU-T SG17/Q8
Bio-PKI with Template Format
The above proposals have privacy issues:
It is easy for anyone to get relationship
between the biometric data and its ownership……
1/11/2019
Institute of Systems & Information Technologies/ KYUSHU 7

8. Certificate-based framework
Assurance of anonymity in the Biometric Authentication by using Personal Repository
Legitimate user or legitimate server can verify these relationships
so that Adversaries obtain no information of above.
Owner (User)
Personal Repository
Enrolled Templates
RELATION
RELATION
Ownership Certificate
Certificate Authority for User’s Personal Repository
Template Certificate
Certificate Authority for Template Data
1/11/2019
Institute of Systems & Information Technologies/ KYUSHU 8

9. Certificate-based framework
A Framework of verification of ownership of PR by VA
Assumption: CA issuing ownership certificate of PR, Trusted VA
Certificate Authority for User’s Personal Repository
Verification Authority for User’s Personal Repository
Internet
Personal Repository
Client (User)
Application Server
Biometrics Device
Certificate Authority for Public Key
Certificate Authority for Template Data
Certificate Authority for Authentication Environment
1/11/2019
Institute of Systems & Information Technologies/ KYUSHU 9

10. Certificate-based framework
Argument of Security
Abovementioned framework
Biometric Authentication verifies personal repository is used by legitimate user.
In application server, user is anonymity.
Identity of User and holder ⇒ Only VA can verifies it.
Application Server receives only information of the identity as verification result from VA.
⇒ If user colludes with VA, this framework will not be secure.
Personal Repository requires following assumptions.
Anti-tampered resistance
Calculation power for generation and verification of digital signature
1/11/2019
Institute of Systems & Information Technologies/ KYUSHU 10

11. Institute of Systems & Information Technologies/ KYUSHU
One-time Biometrics
Now, I am investigating.
But, I presented this topic at Symposium of Cryptography & Information Security 2006 in Japan
Today, I will talk only basic idea.
On the internet, communication data can be obtained!
Whenever authentication data is compromised, the authentication system must react to the compromise.
In order to achieve the above concept, the authentication system can generate data which has one-time characteristics like one-time password.
1/11/2019
Institute of Systems & Information Technologies/ KYUSHU

12. Institute of Systems & Information Technologies/ KYUSHU
One-time Biometrics
We propose One-Time Transform (OTT)：
OTT: Different transform every authentication session
OTT is shared by a client and a storage of template
OTT is applied to extracted features and corresponding enrolled templates
Transformed data is used in matching process.
1/11/2019
Institute of Systems & Information Technologies/ KYUSHU 12

13. Institute of Systems & Information Technologies/ KYUSHU
One-time Biometrics
An illustration of One-Time Transform：
Candidate of OTT: Recursive non-linear transform
Chaos transforms, Iterated Function Systems
: transformed points by OTT on time t1, and session number a1
: transformed points by OTT on time t2, and session number a2
(t1≠t2)
Y axis
・私，かつてフラクタル画像処理の研究をやっていたもので，そこから着想を得たわけです．
the feature or the template in matching process
the feature or the template in matching process
Coordinate of one of the features or the templates
X axis
1/11/2019 O
Institute of Systems & Information Technologies/ KYUSHU

14. Institute of Systems & Information Technologies/ KYUSHU
One-time Biometrics
We propose One-Time Transform (OTT)：
OTT: Different transform every authentication session
OTT is shared by a client and a storage of template
OTT is applied to extracted features and corresponding enrolled templates
Transformed data is used in matching process.
Requirements of the OTTs
It is difficult for any adversaries to calculate the original features and templates from the transformed ones.
There are optimal distance functions for evaluating matching score from the transformed data.
No adversary extracts the original features & templates from OTTs used in past authentication.
・本当に出来たらいいなぁと思います．
・今回はこの点だけが言いたかったんですね．
1/11/2019
Institute of Systems & Information Technologies/ KYUSHU 14

15. Institute of Systems & Information Technologies/ KYUSHU
One-time Biometrics
Framework of biometrics with One-Time Transforms
Including “Function Generator” which constructs OTTs
Expectation: It is easy to implement One-Time Biometrics by UPDATING SOFTWARE from conventional systems.
Storage of Templates
Time Stamp Server
Function Generator
Construction of OTTs
・実現可能ならば，こういうフレームワークで運用可能だと思います．
・ファンクションジェネレータとテンプレートのDBを一つのエンティティとして実装する手もあるでしょう．
Time Stamping
Application of OTT
Client
Authentication Server
Acquisition
Matching
Feature Extraction
Decision
Application of OTT
1/11/2019
Institute of Systems & Information Technologies/ KYUSHU

16. Institute of Systems & Information Technologies/ KYUSHU
One-time Biometrics
Argument of Security
Assumption: assurance of security of OTT
Hill-climbing attack: DIFFICULT
According to OTT, distance function and threshold are varied.
Replay attack: DIFFICULT
Case 1: Adversaries listen communication between Client and Server
Transformed data is changeable in every authentication.
Case 2: Adversaries listen communication form Function Generator.
When the adversaries use past OTT, Client and Storage can easily detect it.
Collusion attack: FEASIBLE?
Case 1: Client colludes with Function Generator.
Case 2: Server colludes with Function Generator
1/11/2019
Institute of Systems & Information Technologies/ KYUSHU

17. Institute of Systems & Information Technologies/ KYUSHU
Conclusion
Certificate-based Framework:
We propose the Framework of Biometric authentication on Open networks
Establishment of Verification Authority
Assurance of user’s anonymity against Application Server
Reduce of possibility of compromising personal information
One-Time Biometrics:
We propose the One-Time Transform which is different every authentication session.
Resistance against Hill-Climbing Attack, Replay Attack.
Future Works
In fact, there are too many points…
1/11/2019
Institute of Systems & Information Technologies/ KYUSHU

18. Thank you for your attention
1/11/2019
Institute of Systems & Information Technologies/ KYUSHU