A Survey of Security and Privacy Issues for Biometrics Based Remote Authentication in Cloud
---
paper_title: Biometrics: a tool for information security

paper_content:

Establishing identity is becoming critical in our vastly interconnected society. Questions such as "Is she really who she claims to be?," "Is this person authorized to use this facility?," or "Is he in the watchlist posted by the government?" are routinely being posed in a variety of scenarios ranging from issuing a driver's license to gaining entry into a country. The need for reliable user authentication techniques has increased in the wake of heightened concerns about security and rapid advancements in networking, communication, and mobility. Biometrics, described as the science of recognizing an individual based on his or her physical or behavioral traits, is beginning to gain acceptance as a legitimate method for determining an individual's identity. Biometric systems have now been deployed in various commercial, civilian, and forensic applications as a means of establishing identity. In this paper, we provide an overview of biometrics and discuss some of the salient research issues that need to be addressed for making biometric technology an effective tool for providing information security. The primary contribution of this overview includes: 1) examining applications where biometric scan solve issues pertaining to information security; 2) enumerating the fundamental challenges encountered by biometric systems in real-world applications; and 3) discussing solutions to address the problems of scalability and security in large-scale authentication systems.
---
paper_title: A Formal Study of the Privacy Concerns in Biometric-based Remote Authentication Schemes ⋆

paper_content:

With their increasing popularity in cryptosystems, biometrics have attracted more and more attention from the information security community. However, how to handle the relevant privacy concerns remains to be troublesome. In this paper, we propose a novel security model to formalize the privacy concerns in biometric-based remote authentication schemes. Our security model covers a number of practical privacy concerns such as identity privacy and transaction anonymity, which have not been formally considered in the literature. In addition, we propose a general biometric-based remote authentication scheme and prove its security in our security model.
---
paper_title: Biometric Systems: Privacy and Secrecy Aspects

paper_content:

This paper addresses privacy leakage in biometric secrecy systems. Four settings are investigated. The first one is the standard Ahlswede-Csiszar secret-generation setting in which two terminals observe two correlated sequences. They form a common secret by interchanging a public message. This message should only contain a negligible amount of information about the secret, but here, in addition, we require it to leak as little information as possible about the biometric data. For this first case, the fundamental tradeoff between secret-key and privacy-leakage rates is determined. Also for the second setting, in which the secret is not generated but independently chosen, the fundamental secret-key versus privacy-leakage rate balance is found. Settings three and four focus on zero-leakage systems. Here the public message should only contain a negligible amount of information on both the secret and the biometric sequence. To achieve this, a private key is needed, which can only be observed by the terminals. For both the generated-secret and the chosen-secret model, the regions of achievable secret-key versus private-key rate pairs are determined. For all four settings, the fundamental balance is determined for both unconditional and conditional privacy leakage.
---
paper_title: A Quantitative Survey of various Fingerprint Enhancement techniques

paper_content:

Preprocessing is an important step in the area of image processing and pattern recognition. This paper aims to present a review of recent as well as classic fingerprint image enhancement techniques. The umbrella of techniques used for evaluation varies from histogram based enhancement, frequency transformation based, Gabor filter based enhancement and its variants to composite enhancement technique. The effectiveness of enhancement techniques proposed by various researchers is evaluated on the basis of peak signal to noise ratio and equal error rate which refers to robustness and stability of identification process. Experimental results shows that incorporating the enhancement technique based on Gabor filter in wavelet domain and composite method improves equal error rate .Improved error rate and peak signal noise ratio improves the identification/verification accuracy marginally. The major goal of the paper is to provide a comprehensive reference source for the researchers involved in enhancement of fingerprint images which is essential preprocessing step in automatic fingerprint identification and verification.
---
paper_title: Check Your Biosignals Here: A new dataset for off-the-person ECG biometrics

paper_content:

The Check Your Biosignals Here initiative (CYBHi) was developed as a way of creating a dataset and consistently repeatable acquisition framework, to further extend research in electrocardiographic (ECG) biometrics. In particular, our work targets the novel trend towards off-the-person data acquisition, which opens a broad new set of challenges and opportunities both for research and industry. While datasets with ECG signals collected using medical grade equipment at the chest can be easily found, for off-the-person ECG data the solution is generally for each team to collect their own corpus at considerable expense of resources. In this paper we describe the context, experimental considerations, methods, and preliminary findings of two public datasets created by our team, one for short-term and another for long-term assessment, with ECG data collected at the hand palms and fingers.
---
paper_title: Efficient fingerprint search based on database clustering

paper_content:

Fingerprint identification has been a great challenge due to its complex search of database. This paper proposes an efficient fingerprint search algorithm based on database clustering, which narrows down the search space of fine matching. Fingerprint is non-uniformly partitioned by a circular tessellation to compute a multi-scale orientation field as the main search feature. The average ridge distance is employed as an auxiliary feature. A modified K-means clustering technique is proposed to partition the orientation feature space into clusters. Based on the database clustering, a hierarchical query processing is proposed to facilitate an efficient fingerprint search, which not only greatly speeds up the search process but also improves the retrieval accuracy. The experimental results show the effectiveness and superiority of the proposed fingerprint search algorithm.
---
paper_title: Fusion of electrocardiogram with unobtrusive biometrics: An efficient individual authentication system

paper_content:

This paper explores the effectiveness of a novel multibiometric system that is resulted from the fusion of the electrocardiogram (ECG) with an unobtrusive biometric face and another biometric fingerprint which is known to be a least obtrusive for efficient individual authentication. The unimodal systems of the face and the fingerprint biometrics are neither secure nor they can achieve the optimum performance. Using the ECG signal as one of the biometrics offer advantage to a multibiometric system that ECG is inherited to an individual which is confidential, secured and difficult to be forged. It has an inherent feature of vitality signs that ensures a strong protection against spoof attacks to the system. Transformation based score fusion technique is used to measure the performance of the fused system. In particular, the weighted sum of score rule is used where weights are computed using equal error rate (EER) and match score distributions of the unimodal systems. The performance of the proposed multibiometric system is measured using EER and receiver operating characteristic (ROC) curve. The results show the optimum performance of the multibiometric system fusing the ECG signal with the face and fingerprint biometrics which is achieved to an EER of 0.22%, as compared to the unimodal systems that have the EER of 10.80%, 4.52% and 2.12%, respectively for the ECG signal, face and fingerprint biometrics.
---
paper_title: Improvisation of Biometrics Authentication and Identification through Keystrokes Pattern Analysis

paper_content:

In this paper we presented one fresh approach where the authentic user's typing credentials are combined with the password to make authentication convincingly more secure than the usual password used in both offline and online transactions. With the help of empirical data and prototype implementation of the approach, we justified that our approach is ease of use, improved in security and performance. In normal approach different keystroke event timing is used for user profile creation. Keystroke latency and duration is inadequate for user authentication, which motivates exploring other matrices. In this paper we proposed combination of different matrices and calculation of degree of disorder on keystroke latency as well as duration to generate user profile. Statistical analysis on these matrices evaluates enhanced authentication process.
---
paper_title: Fingerprint Verification Using Spectral Minutiae Representations

paper_content:

Most fingerprint recognition systems are based on the use of a minutiae set, which is an unordered collection of minutiae locations and orientations suffering from various deformations such as translation, rotation, and scaling. The spectral minutiae representation introduced in this paper is a novel method to represent a minutiae set as a fixed-length feature vector, which is invariant to translation, and in which rotation and scaling become translations, so that they can be easily compensated for. These characteristics enable the combination of fingerprint recognition systems with template protection schemes that require a fixed-length feature vector. This paper introduces the concept of algorithms for two representation methods: the location-based spectral minutiae representation and the orientation-based spectral minutiae representation. Both algorithms are evaluated using two correlation-based spectral minutiae matching algorithms. We present the performance of our algorithms on three fingerprint databases. We also show how the performance can be improved by using a fusion scheme and singular points.
---
paper_title: Robust Algorithm for Fingerprint Identification with a Simple Image Descriptor

paper_content:

The paper describes a fingerprint recognition system consisting of image preprocessing, filtration, feature extraction and matching for recognition. The image preprocessing includes normalization based on mean value and variation. The orientation field is extracted and Gabor filter is used to prepare the fingerprint image for further processing. For singular point detection the Poincare index with partitioning method is used. The ridgeline thinning is presented and so is the minutia extraction by CN algorithm. Different Toeplitz matrix descriptions are in the work. Their behavior against abstract set of points is tested. The presented algorithm has proved its successful use in identification of shifted, rotated and partial acquired fingerprints without additional scaling.
---
paper_title: Human Authentication Based on ECG Waves Using Radon Transform

paper_content:

Automated security is one of the major concerns of modern times. Secure and reliable authentication systems are in great demand. A biometric trait like electrocardiogram (ECG) of a person is unique and secure. In this paper, we propose a human authentication system based on ECG waves considering a plotted ECG wave signal as an image. The Radon Transform is applied on the preprocessed ECG image to get a radon image consisting of projections for θ varying from 0 o to 180 o . The pairwise distance between the columns of Radon image is computed to get a feature vector. Correlation Coefficient between feature vector stored in the database and that of input image is computed to check the authenticity of a person. Then the confusion matrix is generated to find False Acceptance Ratio (FAR) and False Rejection Ratio (FRR). This methodology of authentication is tested on ECG wave data set of 105 individuals taken from Physionet QT Database. The proposed authentication system is found to have FAR of about 3.19% and FRR of about 0.128%. The overall accuracy of the system is found to be 99.85%.
---
paper_title: Design and Analysis of a Highly User-Friendly, Secure, Privacy-Preserving, and Revocable Authentication Method

paper_content:

A large portion of system breaches are caused by authentication failure, either during the login process or in the post-authentication session; these failures are themselves related to the limitations associated with existing authentication methods. Current authentication methods, whether proxy based or biometrics based, are not user-centric and/or endanger users' (biometric) security and privacy. In this paper, we propose a biometrics based user-centric authentication approach. This method involves introducing a reference subject (RS), securely fusing the user's biometrics with the RS, generating a BioCapsule (BC) from the fused biometrics, and employing BCs for authentication. Such an approach is user friendly, identity bearing yet privacy-preserving, resilient, and revocable once a BC is compromised. It also supports “one-click sign-on” across systems by fusing the user's biometrics with a distinct RS on each system. Moreover, active and non-intrusive authentication can be automatically performed during post-authentication sessions. We formally prove that the secure fusion based approach is secure against various attacks. Extensive experiments and detailed comparison with existing approaches show that its performance (i.e., authentication accuracy) is comparable to existing typical biometric approaches and the new BC based approach also possesses many desirable features such as diversity and revocability.
---
paper_title: Biohashing : two factor authentication featuring fingerprint data and tokenised random number

paper_content:

Abstract Human authentication is the security task whose job is to limit access to physical locations or computer network only to those with authorisation. This is done by equipped authorised users with passwords, tokens or using their biometrics. Unfortunately, the first two suffer a lack of security as they are easy being forgotten and stolen; even biometrics also suffers from some inherent limitation and specific security threats. A more practical approach is to combine two or more factor authenticator to reap benefits in security or convenient or both. This paper proposed a novel two factor authenticator based on iterated inner products between tokenised pseudo-random number and the user specific fingerprint feature, which generated from the integrated wavelet and Fourier–Mellin transform, and hence produce a set of user specific compact code that coined as BioHashing. BioHashing highly tolerant of data capture offsets, with same user fingerprint data resulting in highly correlated bitstrings. Moreover, there is no deterministic way to get the user specific code without having both token with random data and user fingerprint feature. This would protect us for instance against biometric fabrication by changing the user specific credential, is as simple as changing the token containing the random data. The BioHashing has significant functional advantages over solely biometrics i.e. zero equal error rate point and clean separation of the genuine and imposter populations, thereby allowing elimination of false accept rates without suffering from increased occurrence of false reject rates.
---
paper_title: Fingerprint-Based Fuzzy Vault: Implementation and Performance

paper_content:

Reliable information security mechanisms are required to combat the rising magnitude of identity theft in our society. While cryptography is a powerful tool to achieve information security, one of the main challenges in cryptosystems is to maintain the secrecy of the cryptographic keys. Though biometric authentication can be used to ensure that only the legitimate user has access to the secret keys, a biometric system itself is vulnerable to a number of threats. A critical issue in biometric systems is to protect the template of a user which is typically stored in a database or a smart card. The fuzzy vault construct is a biometric cryptosystem that secures both the secret key and the biometric template by binding them within a cryptographic framework. We present a fully automatic implementation of the fuzzy vault scheme based on fingerprint minutiae. Since the fuzzy vault stores only a transformed version of the template, aligning the query fingerprint with the template is a challenging task. We extract high curvature points derived from the fingerprint orientation field and use them as helper data to align the template and query minutiae. The helper data itself do not leak any information about the minutiae template, yet contain sufficient information to align the template and query fingerprints accurately. Further, we apply a minutiae matcher during decoding to account for nonlinear distortion and this leads to significant improvement in the genuine accept rate. We demonstrate the performance of the vault implementation on two different fingerprint databases. We also show that performance improvement can be achieved by using multiple fingerprint impressions during enrollment and verification.
---
paper_title: Provably Secure Remote Truly Three-Factor Authentication Scheme With Privacy Protection on Biometrics

paper_content:

A three-factor authentication scheme combines biometrics with passwords and smart cards to provide high-security remote authentication. Most existing schemes, however, rely on smart cards to verify biometric characteristics. The advantage of this approach is that the user's biometric data is not shared with remote server. But the disadvantage is that the remote server must trust the smart card to perform proper authentication which leads to various vulnerabilities. To achieve truly secure three-factor authentication, a method must keep the user's biometrics secret while still allowing the server to perform its own authentication. Our method achieves this. The proposed scheme fully preserves the privacy of the biometric data of every user, that is, the scheme does not reveal the biometric data to anyone else, including the remote servers. We demonstrate the completeness of the proposed scheme through the GNY (Gong, Needham, and Yahalom) logic. Furthermore, the security of our proposed scheme is proven through Bellare and Rogaway's model. As a further benefit, we point out that our method reduces the computation cost for the smart card.
---
paper_title: An efficient biometrics-based remote user authentication scheme using smart cards

paper_content:

In this paper, we propose an efficient biometric-based remote user authentication scheme using smart cards, in which the computation cost is relatively low compared with other related schemes. The security of the proposed scheme is based on the one-way hash function, biometrics verification and smart card. Moreover, the proposed scheme enables the user to change their passwords freely and provides mutual authentication between the users and the remote server. In addition, many remote authentication schemes use timestamps to resist replay attacks. Therefore, synchronized clock is required between the user and the remote server. In our scheme, it does not require synchronized clocks between two entities because we use random numbers in place of timestamps.
---
paper_title: Blind Authentication: A Secure Crypto-Biometric Verification Protocol

paper_content:

Concerns on widespread use of biometric authentication systems are primarily centered around template security, revocability, and privacy. The use of cryptographic primitives to bolster the authentication process can alleviate some of these concerns as shown by biometric cryptosystems. In this paper, we propose a provably secure and blind biometric authentication protocol, which addresses the concerns of user's privacy, template protection, and trust issues. The protocol is blind in the sense that it reveals only the identity, and no additional information about the user or the biometric to the authenticating server or vice-versa. As the protocol is based on asymmetric encryption of the biometric data, it captures the advantages of biometric authentication as well as the security of public key cryptography. The authentication protocol can run over public networks and provide nonrepudiable identity verification. The encryption also provides template protection, the ability to revoke enrolled templates, and alleviates the concerns on privacy in widespread use of biometrics. The proposed approach makes no restrictive assumptions on the biometric data and is hence applicable to multiple biometrics. Such a protocol has significant advantages over existing biometric cryptosystems, which use a biometric to secure a secret key, which in turn is used for authentication. We analyze the security of the protocol under various attack scenarios. Experimental results on four biometric datasets (face, iris, hand geometry, and fingerprint) show that carrying out the authentication in the encrypted domain does not affect the accuracy, while the encryption key acts as an additional layer of security.
---
paper_title: Security performance evaluation for biometric template protection techniques

paper_content:

Biometric template protection techniques are able to provide a solution for vulnerability which compromises biometric template. These are expected to be useful for remote biometric authentication. However, there were no supported standard evaluation method, thus making these technology not fully trusted. The draft Recommendation ITU-T X.gep: 'A guideline for evaluating telebiometric template protection techniques' which is currently under development at ITU-T SG 17 Question 9 (telebiometrics) aims to fill this need. ITU-T X.gep describes a general guideline for testing and reporting the performance of biometric template protection techniques based on biometric cryptosystem and cancellable biometrics. This guideline specifies two reference models for evaluation which use biometric template protection techniques in telebiometrics system. Then, it defines the metrics, procedures, and requirements for testing and evaluating the performance of the biometric template protection techniques. In addition, this Recommendation ITU-T X.gep has been approved at April 2012, and pre-published as ITU-T X.1091.
---
paper_title: Generating Cancelable Fingerprint Templates

paper_content:

Biometrics-based authentication systems offer obvious usability advantages over traditional password and token-based authentication schemes. However, biometrics raises several privacy concerns. A biometric is permanently associated with a user and cannot be changed. Hence, if a biometric identifier is compromised, it is lost forever and possibly for every application where the biometric is used. Moreover, if the same biometric is used in multiple applications, a user can potentially be tracked from one application to the next by cross-matching biometric databases. In this paper, we demonstrate several methods to generate multiple cancelable identifiers from fingerprint images to overcome these problems. In essence, a user can be given as many biometric identifiers as needed by issuing a new transformation "key". The identifiers can be cancelled and replaced when compromised. We empirically compare the performance of several algorithms such as Cartesian, polar, and surface folding transformations of the minutiae positions. It is demonstrated through multiple experiments that we can achieve revocability and prevent cross-matching of biometric databases. It is also shown that the transforms are noninvertible by demonstrating that it is computationally as hard to recover the original biometric identifier from a transformed version as by randomly guessing. Based on these empirical results and a theoretical analysis we conclude that feature-level cancelable biometric construction is practicable in large biometric deployments
---
paper_title: A Generic Framework for Three-Factor Authentication: Preserving Security and Privacy in Distributed Systems

paper_content:

As part of the security within distributed systems, various services and resources need protection from unauthorized use. Remote authentication is the most commonly used method to determine the identity of a remote client. This paper investigates a systematic approach for authenticating clients by three factors, namely password, smart card, and biometrics. A generic and secure framework is proposed to upgrade two-factor authentication to three-factor authentication. The conversion not only significantly improves the information assurance at low cost but also protects client privacy in distributed systems. In addition, our framework retains several practice-friendly properties of the underlying two-factor authentication, which we believe is of independent interest.
---
paper_title: Robust elliptic curve cryptography-based three factor user authentication providing privacy of biometric data

paper_content:

Recently, to achieve privacy protection using biometrics, Fan and Lin proposed a three-factor authentication scheme based on password, smart card and biometrics. However, the authors have found that Fan and Lin's proposed scheme (i) has flaws in the design of biometrics privacy, (ii) fails to maintain a verification table, making it vulnerable to stolen-verifier attack and modification attack, and (iii) is vulnerable to insider attacks. Thus, the authors propose an elliptic curve cryptography-based authentication scheme that is improved with regard to security requirements. The authors’ proposed scheme overcomes the flaws of Fan and Lin's scheme and is secured from attacks. Furthermore, the authors have presented a security analysis of their scheme to show that their scheme is suitable for the biometric systems.
---
paper_title: Generating Cancelable Fingerprint Templates

paper_content:

Biometrics-based authentication systems offer obvious usability advantages over traditional password and token-based authentication schemes. However, biometrics raises several privacy concerns. A biometric is permanently associated with a user and cannot be changed. Hence, if a biometric identifier is compromised, it is lost forever and possibly for every application where the biometric is used. Moreover, if the same biometric is used in multiple applications, a user can potentially be tracked from one application to the next by cross-matching biometric databases. In this paper, we demonstrate several methods to generate multiple cancelable identifiers from fingerprint images to overcome these problems. In essence, a user can be given as many biometric identifiers as needed by issuing a new transformation "key". The identifiers can be cancelled and replaced when compromised. We empirically compare the performance of several algorithms such as Cartesian, polar, and surface folding transformations of the minutiae positions. It is demonstrated through multiple experiments that we can achieve revocability and prevent cross-matching of biometric databases. It is also shown that the transforms are noninvertible by demonstrating that it is computationally as hard to recover the original biometric identifier from a transformed version as by randomly guessing. Based on these empirical results and a theoretical analysis we conclude that feature-level cancelable biometric construction is practicable in large biometric deployments
---

Title: A Survey of Security and Privacy Issues for Biometrics Based Remote Authentication in Cloud

Section 1: Introduction
Description 1: Provide a general overview of the increasing volume of digital content, the benefits and challenges of cloud environments, and highlight the importance of secure remote user authentication using biometrics.

Section 2: Security Challenges Faced by Biometrics Techniques
Description 2: Discuss the various security threats and challenges associated with biometrics features, including spoofing attacks, false detection, and limitations in data acquisition technologies.

Section 3: Literature Survey
Description 3: Offer a detailed review of existing works on cloud security and remote authentication, focusing on singular and multimodal biometrics features and additional security measures to protect biometrics templates.

Section 4: Authentication Based on Singular Biometrics Features
Description 4: Elaborate on various biometrics-based authentication techniques in the cloud such as fingerprint verification, keystroke analysis, and ECG-based authentication, along with their respective strengths and weaknesses.

Section 5: Authentication Systems with Encrypted Biometrics Features
Description 5: Describe different methods of protecting biometrics templates through encryption and transformation techniques, and discuss multi-factor authentication systems that enhance security and privacy.

Section 6: Analysis
Description 6: Present a comparative analysis of different biometrics traits based on performance metrics like true acceptance rate and true rejection rate, and discuss the trade-off between security and privacy in these systems.

Section 7: Open Issues
Description 7: Identify and describe several research gaps and future directions for creating effective frameworks that balance security and privacy, energy-efficient multimodal biometrics schemes, and cost-effective means for recording biometrics features.

Section 8: Conclusion
Description 8: Summarize the importance of secure remote authentication in cloud environments, highlight the findings of the survey, and emphasize the need for further research to improve biometrics-based authentication systems.