On Privacy-Preserving Biometric Authentication

Abstract

Biometric authentication is becoming increasingly popular as a convenient authentication method. However, the privacy and security issues associated with biometric authentication are very serious. Privacy-preserving biometric authentication addresses privacy concerns associated with the use of biometrics and offers a secure solution for user authentication. Given the tremendous expansion of wireless communications a new distributed architecture in biometric authentication is evolving. In this distributed setting, a resource constrained client may outsource part of the computations during the biometric authentication process to a more powerful device (cloud server). In this work, we consider one such distributed setting consisting of clients, a cloud server, and a service provider and make a case for the need for verifiable computation to achieve security against malicious, as opposed to an honest-but-curious, cloud server. In particular, we propose to use verifiable computation on top of an homomorphic encryption scheme to verify that the cloud server correctly performs the computations outsourced to it. A proof of security of a generic protocol in the presence of a malicious cloud server is also provided. Finally, we discuss how an XOR-linear message authentication code can be used to verify the correctness of the computation.

Appendices

A Proof of Theorem 1

Before we proceed with the proof, let us first analyse the adversarial scenario in the case of the generic protocol $\textsf {PPBA}$. Note that by the attacker (or the adversary) $\mathcal {A}$, we refer to the malicious cloud server. We assume that the adversary $\mathcal {A}$ has oracle access to $\textsf {Authen}$, so $\mathcal {A}$ can query $\textsf {Authen}$ with biometric templates and identity of its choice $\textsf {poly}(\lambda )$ times, where $\lambda$ is a security parameter. In addition, by the security of a privacy-preserving biometric authentication protocol, we mean the security of the biometric templates.

Again, we define the security of the protocol $\textsf {PPBA}$ against a malicious adversary $\mathcal {A}$ via the following game played between $\mathcal {A}$ and $\textsf {PPBA}$.

The adversary’s advantage at the end of this game is defined as $\textsf {Adv}_{\textsf {PPBA},\mathcal {A}}^{\textsf {Priv}} = \big |2\Pr \{\textsf {Exp}_{\textsf {PPBA},\mathcal {A}}^\textsf {Priv}(\lambda ,f)=1\} - 1\big |.$ We say that the protocol is secure (and preserves the privacy of biometric templates) against the malicious cloud server $\mathcal {CS}$, if $\textsf {Adv}_{\textsf {PPBA},\mathcal {A}}^{\textsf {Priv}}\leqslant \textsf {negl}(\lambda ).$

Let us write out the details of $\textsf {Authen}\big (\textsf {ID}_i,i,\textsf {Enc}(b'_{i_\beta })\big )$ in the above experiment. Since the authentication process involves the client $\mathcal {C}_i$, the cloud server $\mathcal {CS}$, and the service provider $\mathcal {SP}$, in the description we write the entity name followed by a set of inputs it takes in a parenthesis to denote what that entity takes as input. For instance, $\mathcal {CS}(i,\textsf {Enc}(b'_{i_\beta }),\textsf {pk},\textsf {PK})$ denotes that $\mathcal {CS}$ takes i, $\textsf {Enc}(b'_{i_\beta })$, and $\textsf {PK}$ as input and performs the operations in the indented block underneath it.

In the authentication process $\textsf {Authen}$, $\textsf {Out}=1$ is returned in only one case (i.e., the case where the fresh and the reference biometric templates match each other), while $\textsf {Out}=0$ is returned in three cases. The three cases are (1) $\mathcal {CS}$ does not perform the correct computation and the verification algorithm $\textsf {Ver}$ outputs $\perp$, (2) $\mathcal {CS}$ performs the correct computation but uses a wrong input, so the integrity check fails, finally (3) there is no match between the fresh and the reference biometric templates.

Proof

(of Theorem 1 ). We prove this theorem using two games.

$\mathbf{game}~0$: This is the original game. Let $S_0$ be the event that $\beta '=\beta$.

$\mathbf{game}~1$: This is the same as $\mathbf{game}~0$, except that we now replace the output $(\textsf {Enc}(b_i),\,\sigma _{\textsf {ct}_i})\leftarrow \mathcal {CS}(i,\textsf {Enc}(b'_{i_\beta }),\textsf {pk},\textsf {PK})$ with the correct $\textsf {Enc}(b_i)$ corresponding to i and valid $\sigma _{\textsf {ct}_i}$. Let $S_1$ be the event that $\beta '=\beta$ in this game.

$\mathbf{Claim}~1$: $|\Pr \{S_0\}-\Pr \{S_1\}|$ is negligible.

Proof

(of Claim  1). The difference between game 0 and game 1 is that in game 0 it may happen that $\textsf {ct}_i=\perp$ and/or $\widetilde{\omega }_i\ne \omega _i$, while in game 1 these do not happen. While $\textsf {ct}_i=\perp$ means winning the game $\textsf {Exp}_{\textsf {VC},\mathcal {A}}(\lambda ,f)$, $\widetilde{\omega }_i\ne \omega _i$ means having a collision in H. So both of these happen with negligible probability because of the assumption that $\textsf {VC}$ is secure (cf. Definition 7) and that H is a random oracle. Therefore, the difference between the winning probabilities in game 0 and game 1 is negligible.

$\mathbf{Claim}~2$: $\big |2\Pr \{S_1\}-1\big |\leqslant \textsf {negl}(\lambda )$.

Proof

(of Claim  2). Suppose that the adversary’s advantage is non-negligible, i.e., $\big |2\Pr \{S_1\}-1\big |>\textsf {negl}(\lambda )$. Then we can construct an attacker $\mathcal {A}'$ that wins in the $\textsf {IND-CPA}$ game against the underlying homomorphic encryption $\textsf {HE}$ with non-negligible advantage as follows.

The attacker $\mathcal {A}'$ obtains the $\textsf {pk}$ for $\textsf {HE}$, chooses two distinct messages $m_0,\,m_1\in \mathbb {Z}_{q\geqslant 2}^N$, and receives a challenge $c=\textsf {Enc}(m_\alpha )$, where $\alpha \xleftarrow {R}\{0,1\}$. $\mathcal {A}'$ then simulates the protocol execution for $\textsf {PPBA}$. To simulate $\textsf {PPBA}$, $\mathcal {A}'$ uses $\textsf {pk}$ to re-randomise $c=\textsf {Enc}(m_\alpha )$ using the homomorphic property of the encryption, and registers the re-randomised c, let us call it $c'$, along with an $\textsf {ID}_i$ and a corresponding index i and a hash of $c'$ in $\mathcal {DB}$ of $\mathcal {CS}$. For $\mathcal {CS}$, c and its randomised version $c'$ are indistinguishable. This does faithfully simulate the protocol execution for the adversary $\mathcal {A}$, because $\mathcal {A}'$ knows the output of $\textsf {Authen}(\textsf {ID}_i,i,c)$. Now, if $\mathcal {A}$ outputs its guess $\beta '$ for $\beta$, then $\mathcal {A}'$ outputs its guess $\alpha '(=\beta ')$ for $\alpha$. Thus, $\mathcal {A}'$ wins if $\mathcal {A}$ wins.

Hence, combining Claim 1 and 2, we have that $\textsf {Adv}_{\textsf {PPBA},\mathcal {A}}^{\textsf {Priv}}$ is negligible.

B  Universal Hash Functions

Universal hash functions were first proposed by Carter and Wegman [31] as, among others, a means to construct unconditionally secure MACs. Stinson formalised the definitions of Universal hash functions in [32]. Following these early works, there has been a considerable amount of research done on Universal hash functions to improve both the description length and computational performance, see e.g., [33] for a quick overview.

Definition 9

( $\epsilon$ -ASU $_2$ hash functions [32]). Let $\mathcal {M}$ and $\mathcal {T}$ be finite sets. A family $\mathcal {F}$ of hash functions from $\mathcal {M}$ to $\mathcal {T}$ is $\epsilon$-ASU$_2$ if the following two conditions are satisfied: (a) the number of hash functions in $\mathcal {F}$ that takes an arbitrary $m_1 \in \mathcal {M}$ to an arbitrary $t_1 \in \mathcal {T}$ is exactly $|\mathcal {F}|/|\mathcal {T}|$; (b) the fraction of those functions that also takes an arbitrary $m_2 \ne m_1$ in $\mathcal {M}$ to an arbitrary $t_2 \in \mathcal {T}$ (possibly equal to $t_1$) is at most $\epsilon$. If $\epsilon =1/|\mathcal {T}|$, then $\mathcal {F}$ is called SU $_2$.

As can be seen from the definition, $\epsilon$-ASU$_2$ hash functions can be used to construct a MAC scheme in a natural way. More specifically, in this case a pair of users, say Alice and Bob, share a secret key $\textsf {k}$ which identifies a hash function $h_\textsf {k}$ in a family of $\epsilon$-ASU$_2$ hash functions. When Alice sends a message m to Bob, she also sends $t=h_\textsf {k}(m)$ along with m. Upon receiving (m, t), Bob checks the authenticity of m by comparing t with $h_\textsf {k}(m)$, which he himself computes using his share of the key $\textsf {k}$. If $h_\textsf {k}(m)=t$, then Bob accepts m as authentic; otherwise, he rejects it.

C Proof of Theorem 2

Proof

(of Theorem 2 ). Since the proof is similar to that of the Theorem 1, we just highlight the differences in the relevant hybrid security games and the claims. Let PPBA-HE-MAC denote the instantiation. The security against a malicious adversary $\mathcal {A}$ (e.g., $\mathcal {CS}$) is defined via the following game played between $\mathcal {A}$ and $\textsf {PPBA-HE-MAC}$.

where $\textsf {MAC}.K$ is the key space for the employed MAC scheme (e.g., the set of U$_2$ hash functions). The adversary’s advantage is defined as $\textsf {Adv}_{\textsf {PPBA-HE-MAC},\mathcal {A}}^{\textsf {Priv}} = \big |2\Pr \{\textsf {Exp}_{\textsf {PPBA-HE-MAC},\mathcal {A}}^\textsf {Priv}(\lambda )=1\} - 1\big |.$ If $\textsf {Adv}_{\textsf {PPBA-HE-MAC},\mathcal {A}}^{\textsf {Priv}}\leqslant \textsf {negl}(\lambda )$, we say that $\textsf {PPBA-HE-MAC}$ is secure (and preserves the privacy of biometric templates) against $\mathcal {A}$.

The details of $\textsf {Authen}\big (\textsf {ID}_i,i,\textsf {Enc}(b'_{i_\beta })\big )$ are given below.

The proof is based on the following two hybrid games.

$\mathbf{game}~0$: This is the original game $\textsf {Exp}_{\textsf {PPBA-HE-MAC},\mathcal {A}}^\textsf {Priv}(\lambda )$. Let $S_0$ be the event that $\beta '=\beta$ in $\mathbf{game}~0$.

$\mathbf{game}~1$: This is the same as $\mathbf{game}~0$, except that now $\mathcal {CS}$ always performs the correct computation. Let $S_1$ be the event that $\beta '=\beta$ in $\mathbf{game}~1$.

$\mathbf{Claim}~1$: $|\Pr \{S_0\}-\Pr \{S_1\}|$ is negligible. This follows from the $\epsilon$-security of the employed MAC scheme.

$\mathbf{Claim}~2$: The adversary has negligible advantage in $\mathbf{game}~1$, i.e., $\big |2\Pr \{S_1\}-1\big |\leqslant \textsf {negl}(\lambda )$. This follows from the $\textsf {IND-CPA}$-security of the HE scheme.

Hence, we have that $\textsf {Adv}_{\textsf {PPBA-HE-MAC},\mathcal {A}}^{\textsf {Priv}}$ is negligible.