Private biometrics is a form of encrypted biometrics, also called privacy-preserving biometric authentication methods, in which the biometric measurement is cryptographically processed such that no data stored in a data base can be (mis-) used to recover information about the human subject. Biometrics, in contrast to user pass words, are noisy data that slightly differ from measurement to measurement. Small variations input data prevent the use of traditional encryption or hashing. The introduction of a fuzzy extractor was a pioneering contribution to nonetheless apply cryptographic techniques to inherently noisy biometric data.
Helper Data Schemes
Fuzzy Commitments were proposed as "Helper Data Schemes" for storing biometric templates. A helper data system (HDS) is a cryptographic primitive designed to extract a consistent, high-entropy secret string (like a cryptographic key) from inherently noisy data, such as a biometric measurement. The primary purpose of an HDS is to enable reliable biometric authentication or identification while preserving privacy. It achieves this by ensuring that the stored data does not reveal sensitive information about the original biometric template or the extracted secret key to an attacker, even if the database is compromised by an insider attack. The data base stores a cryptographic hash of the quantized biometric measurement and the "helper data", in which the helper data is used to bias the quantization process. According to an information theoretical proof, helper data reveal no information about the biometric. The cryptograph strength of the hash function ensures that it is not computationally feasible to reconstruct the original nor any biometric features from the hash.
Homomorphic Encryption According to one other possible approach, the biometric payload is a one-way, homomorphically encrypted feature vector that can be 0.05% the size of the original biometric template and can be searched with full accuracy, speed and privacy. The feature vector's homomorphic encryption allows search and match to be conducted in polynomial time on an encrypted dataset and the search result is returned as an encrypted match. One or more computing devices may use an encrypted feature vector to verify an individual person (1:1 verify) or identify an individual in a datastore (1:many identify) without storing, sending or receiving plaintext biometric data within or between computing devices or any other entity. The purpose of private biometrics is to allow a person to be identified or authenticated while guaranteeing individual privacy and fundamental human rights by only operating on biometric data in the encrypted space. Some private biometrics include fingerprint authentication methods, face authentication methods, and identity-matching algorithms according to bodily features. Private biometrics are constantly evolving based on the changing nature of privacy needs, identity theft, and biotechnology.
__TOC__
Background
Biometric security strengthens user authentication but, until recently, also implied important risks to personal privacy. Indeed, while compromised passwords can be easily replaced and are not personally identifiable information (PII), biometric data is considered highly sensitive due to its personal nature, unique association with users, and the fact that compromised biometrics (biometric templates) cannot be revoked or replaced. Private biometrics have been developed to address this challenge. Private Biometrics provide the necessary biometric authentication while simultaneously minimizing user's privacy exposure through the use of one-way, fully homomorphic encryption.
The Biometric Open Protocol Standard, IEEE 2410-2018, was updated in 2018 to include private biometrics and stated that the one-way fully homomorphic encrypted feature vectors, “...bring a new level of consumer privacy assurance by keeping biometric data encrypted both at rest and in transit.” The Biometric Open Protocol Standard (BOPS III) also noted a key benefit of private biometrics was the new standard allowed for simplification of the API since the biometric payload was always one-way encrypted and therefore had no need for key management.Biometrics Open Protocol (BOPS) III. IEEE 2410-2018, IEEE Standards Association. 2018. Accessed 7/22/2018.
Fully homomorphic cryptosystems for biometrics
Historically, biometric matching techniques have been unable to operate in the encrypted space and have required the biometric to be visible (unencrypted) at specific points during search and match operations. This decrypt requirement made large-scale search across encrypted biometrics (“1:many identify”) infeasible due to both significant overhead issues (e.g. complex key management and significant data storage and processing requirements) and the substantial risk that the biometrics were vulnerable to loss when processed in plaintext within the application or operating system (see FIDO Alliance, for example).
Biometric security vendors complying with data privacy laws and regulations (including Apple FaceID, Samsung, Google) therefore focused their efforts on the simpler 1:1 verify problem and were unable to overcome the large computational demands required for linear scan to solve the 1:many identify problem.Selleck, Evan. “Craig Federighi Says Apple is ‘Focusing Face ID on Single User Authentication.’” Phone Hacks. 12-01-2017. Accessed 7-15-2018.
Today, private biometric cryptosystems overcome these limitations and risks through the use of one-way, fully homomorphic encryption. This form of encryption allows computations to be carried out on ciphertext, allows the match to be conducted on an encrypted dataset without decrypting the reference biometric, and returns an encrypted match result. Matching in the encrypted space offers the highest levels of accuracy, speed and privacy and eliminates the risks associated with decrypting biometrics.
Accuracy: same as plaintext (99%)
The private biometric feature vector is much smaller (0.05% the size of the original biometric template) but yet maintains the same accuracy as the original plaintext reference biometric. In testing using Google's unified embedding for face recognition and clustering CNN (“Facenet”), Labeled Faces in the Wild (LFW) (source), and other open source faces, private biometric feature vectors returned the same accuracy as plaintext facial recognition. Using an 8MB facial biometric, one vendor reported an accuracy rate of 98.7%. The same vendor reported accuracy increased to 99.99% when using three 8MB facial biometrics and a vote algorithm (best two out of 3) to predict.Private.id
As the quality of the facial biometric image declined, accuracy degraded very slowly. For 256kB facial images (3% the quality of an 8MB picture), the same vendor reported 96.3% accuracy and that the neural network was able to maintain similar accuracy through boundary conditions including extreme cases of light or background.Unpublished 2018 white paper, Private Identity, LLC.
Speed: polynomial search (same as plaintext)
The private biometric feature vector is 4kB and contains 128 floating point numbers. In contrast, plaintext biometric security instances (including Apple Face IDEvans, Johnny. “iPhone X & Face ID: Everything you need to know.” ComputerWorld. 9/13/2017. Accessed 7/22/2018) currently use 7MB to 8MB reference facial biometrics (templates). By using the much smaller feature vector, the resulting search performance is less than one second per prediction using a datastore of 100 million open source faces (“polynomial search”). The private biometric test model used for these results was Google's unified embedding for face recognition and clustering CNN (“Facenet”), Labeled Faces in the Wild (LFW) (source), and other open source faces.
Privacy: full compliance with privacy regulations worldwide
As with all ideal one-way cryptographic hash functions, decrypt keys do not exist for private biometrics so it is infeasible to generate the original biometric message from the private biometric feature vector (its hash value) except by trying all possible messages. Unlike passwords, however, no two instances of a biometric are exactly the same or, stated in another way, there is no constant biometric value, so a brute force attack using all possible faces would only produce an approximate (fuzzy) match. Privacy and fundamental human rights are therefore guaranteed.
Specifically, the private biometric feature vector is produced by a one-way cryptographic hash algorithm that maps plaintext biometric data of arbitrary size to a small feature vector of a fixed size (4kB) that is mathematically impossible to invert. The one-way encryption algorithm is typically achieved using a pre-trained convolutional neural network (CNN), which takes a vector of arbitrary real-valued scores and squashes it to a 4kB vector of values between zero and one that sum to one.Karn, Ujjwal. “An Intuitive Explanation of Convolutional Neural Networks.” The Data Science Blog. 8/11/2016, Accessed 7/22/2018. It is mathematically impossible to reconstruct the original plaintext image from a private biometric feature vector of 128 floating point numbers.
One-way encryption, history and modern use
One-way encryptions offer unlimited privacy by containing no mechanism to reverse the encryption and disclose the original data. Once a value is processed through a one-way hash, it is not possible to discover to the original value (hence the name “one-way”).
History
The first one-way encryptions were likely developed by James H. Ellis, Clifford Cocks, and Malcolm Williamson at the UK intelligence agency GCHQ during the 1960s and 1970s and were published independently by Diffie and Hellman in 1976 (History of cryptography). Common modern one-way encryption algorithms, including MD5 (message digest) and SHA-512 (secure hash algorithm) are similar to the first such algorithms in that they also contain no mechanism to disclose the original data. The output of these modern one-way encryptions offer high privacy but are not homomorphic, meaning that the results of the one-way encryptions do not allow high order math operations (such as match). For example, we cannot use two SHA-512 sums to compare the closeness of two encrypted documents. This limitation makes it impossible for these one-way encryptions to be used to support classifying models in machine learning—or nearly anything else.
Modern use
The first one-way, homomorphically encrypted, Euclidean-measurable feature vector for biometric processing was proposed in a paper by Streit, Streit and Suffian in 2017.
In this paper, the authors theorized and also demonstrated using a small sample size (n=256 faces) that (1) it was possible to use neural networks to build a cryptosystem for biometrics that produced one-way, fully homomorphic feature vectors composed of normalized floating-point values; (2) the same neural network would also be useful for 1:1 verification (matching); and (3) the same neural network would not be useful in 1:many identification tasks since search would occur in linear time (i.e. non polynomial). The paper's first point was (in theory) later shown to be true, and the papers first, second and third points were later shown to be true only for small samples but not for larger samples.