1. Randomized Radon Transforms for Biometric Authentication via Fingerprint Hashing 2007 ACM Digital Rights Management Workshop Alexandria, VA (USA) October 29, 2007 Mariusz H. Jakubowski Ramarathnam Venkatesan Microsoft Research

2. 2007 ACM Digital Rights Management WorkshopOctober 29, 20072 Introduction Biometrics: “What you are” –Measurements over bodily features (e.g., fingerprints) –Applications for security and convenience Biometric hashing –One-way extraction of information from biometric data –Human identifiers for DRM authentication Goals of our work: –New method for fingerprint hashing –Applications to strengthen and streamline DRM security

3. 2007 ACM Digital Rights Management WorkshopOctober 29, 20073 Overview Introduction Fingerprint hashing Experimental results Conclusion Fingerprint hashing via Radon transform

4. 2007 ACM Digital Rights Management WorkshopOctober 29, 20074 Fingerprint Hashing Conversion of fingerprints to one-way hashes for authentication applications Fingerprint hash: An irreversible compressed representation of fingerprint data, extracted according to a secret key. Basic procedure: –Compute various metrics over a fingerprint image and combine these into a hash vector. –Apply error correction and other methods to increase hash robustness.

5. 2007 ACM Digital Rights Management WorkshopOctober 29, 20075 Radon Transform Standard: (x,y)  (θ, ρ), where θ and ρ denote angles and distances of lines. Line at angle θ and distance ρ from origin will result in high value of transform coefficient (θ, ρ). Hash transform: This line-based metric is replaced by a custom metric. R(θ, ρ)Original image

6. 2007 ACM Digital Rights Management WorkshopOctober 29, 20076 Randomizing the Transform Standard: –Exhaustively enumerate all lines. –Typical metric: Compute projections of lines onto image. Randomized: –Generate a pseudorandom sequence of lines, using a secret hashing key. –Simpler metric: Compute crossing counts of lines with image (i.e., number of times each line crosses or grazes fingerprint curves). Randomized transform leads to hashing scheme.

7. 2007 ACM Digital Rights Management WorkshopOctober 29, 20077 Fingerprint Hashing: Example Scanned fingerprint Metric: Crossing count with random lines and curves

8. 2007 ACM Digital Rights Management WorkshopOctober 29, 20078 Fingerprint Hashing: Example Scanned fingerprint Metric: Crossing count with random lines and curves Cleaned fingerprint o Generic clean-up: Filters, thresholds, etc. o Specialized methods: VeriFinger (Neurotechnologija, Inc.)

9. 2007 ACM Digital Rights Management WorkshopOctober 29, 20079 Fingerprint Hashing: Example Scanned fingerprint 5 random lines Metric: Crossing count with random lines and curves Cleaned fingerprint

10. 2007 ACM Digital Rights Management WorkshopOctober 29, 200710 Fingerprint Hashing: Example Scanned fingerprint 25 21 24 25 25 5 random lines Metric: Crossing count with random lines and curves Cleaned fingerprint

11. 2007 ACM Digital Rights Management WorkshopOctober 29, 200711 Fingerprint Hashing: Example Scanned fingerprint 25 21 24 25 25 22 17 21 23 23 22 22 27 24 25 14 23 25 27 25 5 random lines 15 random lines Metric: Crossing count with random lines and curves Cleaned fingerprint

12. 2007 ACM Digital Rights Management WorkshopOctober 29, 200712 Fingerprint Hashing: Example Scanned fingerprint 25 21 24 25 25 22 17 21 23 23 22 22 27 24 25 14 23 25 27 25 5 random lines 15 random lines Metric: Crossing count with random lines and curves 10 random curves Cleaned fingerprint 3 24 44 27 32 8 16 24 37 31 Hashes (crossing counts)

13. 2007 ACM Digital Rights Management WorkshopOctober 29, 200713 Some Metrics for Hashing Counts of crossings with lines and curves Curvatures of fingerprint lines within random regions Numbers and types of minutiae contained in random regions (e.g., rectangles) 7 6 0 1 2 2

14. 2007 ACM Digital Rights Management WorkshopOctober 29, 200714 Hash Properties Secret key or password used to determine metric types and parameters Controllable length and security (e.g., 64, 128, or 256 bits) Resistance against minor scanner distortions and noise

15. 2007 ACM Digital Rights Management WorkshopOctober 29, 200715 Fingerprint Authentication Standard authentication: Compare fingerprint scans against stored “correct” fingerprints. Hash-based authentication: Compare hashes of scanned fingerprints with stored “correct” hashes. Benefits of hashes: –Actual fingerprints need not be stored for comparison. –Stolen hashes do not reveal or compromise entire fingerprints. –Key-derived hashes bind passwords and fingerprints tightly. –Short hash length allows usage in network protocols, Web services, etc.

16. 2007 ACM Digital Rights Management WorkshopOctober 29, 200716 Experiments Original fingerprint Hash: 28 19 21 23 22

17. 2007 ACM Digital Rights Management WorkshopOctober 29, 200717 Experiments Original fingerprint Hash: 28 19 21 23 22 Distorted fingerprint Hash: 29 19 20 23 22 Difference: 1 0 -1 0 0 o StirMark distortions used o Approximation of real-life scanner distortions

18. 2007 ACM Digital Rights Management WorkshopOctober 29, 200718 Experiments Original fingerprint Hash: 28 19 21 23 22 Distorted fingerprint Hash: 29 19 20 23 22 Difference: 1 0 -1 0 0 Different hash key Hash :20 26 28 21 17 Difference: -8 7 7 -2 -5

19. 2007 ACM Digital Rights Management WorkshopOctober 29, 200719 Experiments Original fingerprint Hash: 28 19 21 23 22 Different fingerprint #1 Hash:38 17 24 34 28 Difference:10 -2 3 11 6 Distorted fingerprint Hash: 29 19 20 23 22 Difference: 1 0 -1 0 0 Different hash key Hash :20 26 28 21 17 Difference: -8 7 7 -2 -5

20. 2007 ACM Digital Rights Management WorkshopOctober 29, 200720 Experiments Original fingerprint Hash: 28 19 21 23 22 Different fingerprint #1 Hash:38 17 24 34 28 Difference:10 -2 3 11 6 Different fingerprint #2 Hash:19 26 18 24 23 Difference:-9 7 -3 1 1 Distorted fingerprint Hash: 29 19 20 23 22 Difference: 1 0 -1 0 0 Different hash key Hash :20 26 28 21 17 Difference: -8 7 7 -2 -5

21. 2007 ACM Digital Rights Management WorkshopOctober 29, 200721 Experimental Results Distances between each fingerprint and its distorted version Distances between each fingerprint and other distinct fingerprints 5 random lines

22. 2007 ACM Digital Rights Management WorkshopOctober 29, 200722 Experimental Results Distances between each fingerprint and its distorted version Distances between each fingerprint and other distinct fingerprints 5 random lines50 random lines

23. 2007 ACM Digital Rights Management WorkshopOctober 29, 200723 Experimental Results Distances between each fingerprint and its distorted version Distances between each fingerprint and other distinct fingerprints 50 random lines200 random lines (diminishing returns)

24. 2007 ACM Digital Rights Management WorkshopOctober 29, 200724 Conclusion Contributions –Methodology to extract fingerprint entropy –Applications in biometric authentication Address “too many passwords” problem Augment password-based schemes Future work –Handling scanner distortions Naturally robust metrics Better error correction Explicit fingerprint synchronization –Applications to other biometric data Retinal blood vessels Vein patterns on hands