Secure Biometric Systems

SECURE BIOMETRIC SYSTEMS By Umut Uludag Traditional personal authentication systems that are based on knowledge (e.g., password) or physical tokens (e.g., ID card) are not able to meet strict security performance requirements of a number of modern applications. These applications generally make use of computer networks (e.g., Internet), affect a large portion of population, and control financially valuable and privacy-related tasks (e.g., e-commerce). Biometrics-based authentication systems that use physiological and/or behavioral traits (e.g., fingerprint, face, and signature) are good alternatives to traditional methods. These systems are more reliable (biometric data can not be lost, forgotten, or guessed) and more user-friendly (there is nothing to remember or carry). In spite of these advantages of biometric systems over traditional systems, there are many unresolved issues associated with the former. For example, how secure are biometric systems against attacks? How can we guarantee the integrity of biometric templates? How can we use biometric components in traditional access control frameworks? How can we combine cryptography with biometrics to increase overall system security? In this dissertation, we address these issues and develop techniques to eliminate associated problems. Firstly, we analyze attack robustness of fingerprint matchers, and develop algorithms for circumventing them. The proposed approach is shown to be very successful in bypassing the security associated with fingerprint systems. Further, we develop methods to counter this attack. Secondly, we develop algorithms for increasing the security of image-based (e.g., fingerprint and face) biometric templates, via embedding additional information in them. We show that these algorithms do not reduce biometric matching performance. Thirdly, we develop a secure multimedia content distribution framework that includes fingerprint matching. This provides another line of defense against the piracy of copyrighted data. Finally, we develop a hybrid system that combines traditional cryptography with fingerprint biometrics. The security associated with cryptographic algorithms and the user-friendliness of biometrics coexist in such systems. c © Copyright 2006 by Umut Uludag All Rights Reserved