Brian Streit

Privacy-Enabled Biometric Search

View CodeNotebook

Biometrics have a long-held hope of replacing passwords by establishing a non-repudiated identity and providing authentication with convenience. Convenience drives consumers toward biometrics-based access management solutions. Unlike passwords, biometrics cannot be script-injected; however, biometric data is considered highly sensitive due to its personal nature and unique association with users. Biometrics differ from passwords in that compromised passwords may be reset. Compromised biometrics offer no such relief. A compromised biometric offers unlimited risk in privacy (anyone can view the biometric) and authentication (anyone may use the biometric). Standards such as the Biometric Open Protocol Standard (BOPS) (IEEE 2410-2016) provide a detailed mechanism to authenticate biometrics based on pre-enrolled devices and a previous identity by storing the biometric in encrypted form. This paper describes a biometric-agnostic approach that addresses the privacy concerns of biometrics through the implementation of BOPS. Specifically, two novel concepts are introduced. First, a biometric is applied to a neural network to create a feature vector. This neural network alone can be used for one-to-one matching (authentication), but would require a search in linear time for the one-to-many case (identity lookup). The classifying algorithm described in this paper addresses this concern by producing normalized floating-point values for each feature vector. This allows authentication lookup to occur in up to polynomial time, allowing for search in encrypted biometric databases with speed, accuracy and privacy.

Via