Rima Belguechi
email: r_belguechi@esi.dz

Estelle Cherrier
email: estelle.cherrier@ensicaen.fr

Christophe Rosenberger
email: christophe.rosenberger@ensicaen.fr

Samy Ait-Aoudia
email: s_ait_aoudia@esi.dz

Operational Bio-Hash to Preserve Privacy of Fingerprint Minutiae Templates

The storage of fingerprints is an important issue as this biometric modality is more and more deployed for real applications. Considering minutiae templates as sensitive information, a key question concerns the secure and privacy management of this digital identity. Indeed, if an attacker obtains the minutiae template of an user, he/she will be able to generate a fingerprint having the same characteristics. Instead of directly storing the minutiae templates, we propose in this paper a new adaptation of BioHashing to generate a cancelable template in the context of un-ordered set of noisy minutiae features. To the authors knowledge, little interest has been paid in the literature to this question until now, since this is an acute problem. Using the

FVC2002 benchmark database, we show the effectiveness of the proposed approach in term of privacy preservation. We show how the proposed method copes with irreversibility and diversity properties and therefore can be efficient in a realistic context.

Index Terms

Privacy, secure biometric systems, template protection ---------- ----------

I. MOTIVATIONS AND SCOPE

In reference to information security, biometrics is applied to determine or verify the identity of an user. However, an industrial deployment of biometrics remains challenging as far as the security of the stored data is concerned. In a strong, world-wide consensus [START_REF] Jain | Biometric template security[END_REF], it is admitted that the biometric identifier is personal information which raises serious privacy issues in case of abuse or identity theft. Furthermore, unlike passwords or tokens, if compromised, the biometric template cannot be cancelled or revoked. Therefore biometric data is particularly sensitive. However, this claim has to be mitigated, since not all biometric deployments bear the same privacy risks. Fingerprint is considered highly risked since it is a tracing modality. It means that fingerprint data may be captured without knowledge nor consent, and hence used for undisclosed purposes.

Since the pioneering work of Ratha [START_REF] Ratha | Enhancing security and privacy in biometrics-based authentication systems[END_REF], one possible solution relies on a chosen transform enabling fingerprint template protection and thus, privacy protection.

Two approaches have been developed in the literature: biometric cryptosystems (see [START_REF] Dodis | Fuzzy extractors: How to generate strong keys from biometrics and other noisy data[END_REF] for example and the references therein) and feature transformation based approaches [START_REF] Jain | Biometric template security[END_REF]. In this paper, only the latter approach is considered.

In this article, a particular focus is made on the tokenised pseudo-random multispace transform called BioHashing [START_REF] Teoh | BioHashing: two factor authentication featuring fingerprint data and tokenised random number[END_REF]. It consists of a transformation of the biometric template into a compact vector code named biocode. The transform is based on an iterative inner product applied between a multispace matrix and the feature template. This matrix is generated from a random key K considered as a seed for a tokenized random number. This method is attractive for its different properties.

For example, we can mention that, in zero knowledge scenario, BioHashing has been proven to be irreversible [START_REF] Teoh | Cancellable biometrics and annotations on BioHash[END_REF]. The irreversibility has a direct impact on preserving privacy. According to ISO/IEC 24745 '-Information technology Security techniques-Biometric information protection ', irreversibility prevents the use of biometric data from any other purpose than the originally intended one. It also guarantees a low or a null leakage of biometric information in the protected template. If the reference template is compromised, a direct replacement by a new one is possible by just issuing a new pseudo-random token. This renewability property aims to prevent tracking individual activities over different applications. This is fundamental for privacy preservation. Hence, BioHashing reveals itself as a promising solution to respect many privacy requirements. However, at the same time, it brings some research challenges to overcome. Certain properties only hold in the ideal case where no intruders is attacking the system. That is why some questions arise in a more realistic context. When an impostor steals the key K, the accuracy is worse than when using the biometric alone. For example, in [START_REF] Lumini | Empirical Tests on BioHashing[END_REF], Lumini and Nanni demonstrate that the performance in term of false acceptance rate (FAR) moves from 7.3% when no hashing is performed to 10.9% when BioHashing is operated under the hypothesis of stolen token. Talking of which, a relevant question is how to prevent the deterioration of the recognition accuracy when the genuine token is stolen and used by an impostor. A straightforward solution is to use a better feature extractor in hamming space (BioHashing requires a template as a fixed length feature vector) which will directly impact on the recognition performance. In [START_REF] Nanni | Local binary patterns for a hybrid fingerprint matcher[END_REF], authors use the invariant LBP (Local Binary Pattern) texture operator. In their scheme, the fingerprint image is equally divided into sub-regions from which the LBP features are extracted. However, in their approach, authors make alignment using minutiae matcher which is not tolerable for protection purpose approaches. In [START_REF] Kanak | Classification Based Revocable Biometric Identity Code Generation[END_REF], the author use a spectral fingerprint feature representation based on fourier transform. In stolen token scenario, the false acceptance rate is 7.31% on turkish government database. As we remark, the problem is that these descriptors are not sufficient. Considering fingerprint, it is well established that minutiae map is the moste accurate fingerprint representation. A better solution would be to adapt BioHashing to minutiae representation even if this is not obvious. Since the revelation of BioHashing in 2003, only few articles got interest on applying BioHashing to minutiae representation [START_REF] Yang | Dynamic random projection for biometric tempalte protection[END_REF][34] [START_REF] Radha | An Evaluation Of Fingerprint Security Using NonInvertible Biohash[END_REF] [START_REF] Nanni | Biohashing applied to an orientation-based minutia descriptor for a secure fingerprint authentication system[END_REF]. It is just in 2010 that works using minutiae in the BioHashing appear.

We show in this article how to adapt BioHashing to minutiae by using local matching. It consists of comparing two fingerprints according to the local descriptor of each minutia. Each local descriptor will be protected by BioHashing process. In the recent work of Nanni [START_REF] Nanni | Biohashing applied to an orientation-based minutia descriptor for a secure fingerprint authentication system[END_REF], the orientation descriptor of Tico [START_REF] Tico | Fingerprint Matching Using an Orientation-Based Minutia Descriptor[END_REF] and a greedy matching algoritm were chosen. In parallel, Yang et al. [START_REF] Yang | Dynamic random projection for biometric tempalte protection[END_REF] represents a minutia by a nearest neighbor based structures rather than local descriptor and protect this descriptor by BioHashing. In our work, we propose to use a texture descriptor based on the fingercode [START_REF] Jain | Filterbank based fingerprint matching[END_REF] where the matching is based on a neighborhood first search strategy, an enhanced version of the greedy matching. Compared to Yang et al. [START_REF] Yang | Dynamic random projection for biometric tempalte protection[END_REF], by using a local descriptor, we bring a greater code size which directly impacts on the security of the system. In the next, we show how our proposal fulfills diversity and randomness criteria. Compared to other works, we study these properties with a special care of the value of the decision threshold. This threshold is never considered by other works when it must be fixed in practice. The outline of the paper is as follows: Section 2 expounds fingerprint template transformation approaches. In Section 3 we present the proposed BioHashing model for minutiae. Sections 4 and 5 are devoted to evaluate the proposed system.

II. RELATED WORKS ON FINGERPRINT TEMPLATE TRANSFORMATION APPROACHES

Over the last decade, many attempts have been made to address the problem of protecting fingerprint templates. Jain et al. [START_REF] Jain | Biometric template security[END_REF] classified the existing algorithms into biometric cryptosystems and transformation-based approaches.

In the first category, instead of directly encrypt the template; error correcting codes were designed as an alternative to deal with the variability of the biometric data. The main critical propositions of this category are : fuzzy commitment [START_REF] Juels | A Fuzzy Commitment Scheme[END_REF], fuzzy vault [START_REF] Juels | A Fuzzy Vault Scheme[END_REF][8], secure sketch [START_REF] Dodis | Fuzzy extractors: How to generate strong keys from biometrics and other noisy data[END_REF], biometric hardening password [START_REF] Nandakumar | Hardening fingeprint fuzzy vault using password[END_REF], shielding function [START_REF] Linnartz | New shielding functions to enhance privacy and prevent misuse of biometric templates[END_REF], syndrome-based approach [START_REF] Sutcu | Feature extraction for a slepian-wolf biometric system using ldpc codes[END_REF]. Multiple works have questioned the privacy-enhancing properties of these schemes. This is not our subject, but interested reader can refer to analyzes made in [START_REF] Scheirer | Cracking fuzzy vaults and biometric encryption[END_REF] [START_REF] Kholmatov | Realization of correlation attack against the fuzzy vault scheme[END_REF].

Approaches belonging to the second category make comparison directly in the transformation domain. Suppose the biometric X is transformed using a function F into the encoded data T during enrolment. For verification, the query biometric Y is encoded into the secret T' and the authentication will succeed if T is close to T' using a certain similarity distance.

A number of fingerprint transforms are belonging to this category. Cancelable biometrics proposed by Ratha et al. [START_REF] Ratha | Generating cancelable fingerprint templates[END_REF] applies different geometric transforms to minutiae points. However, in the recent work of Nagar et al. [START_REF] Nagar | Biometric template transformation: A security analysis[END_REF], linkalibility and irreversibility of these transforms have been really disputed. Kumar et al. [START_REF] Kumar | Combination of Symmetric Hash Functions for Secure Fingerprint Matching[END_REF] propose a symmetric hash functions applied on triplets of neighboring minutia while cancelabillity is not considered. Farooq et al. [START_REF] Farooq | Anonymous and Revocable Fingerprint Recognition[END_REF] protect minutiae in the form of a histogram representation. Each minutiae triplet is represented by a 7 values invariant representation and binned in the form of an Histogram. Performance reported by authors is good but the system is complex to implement.Boult et al. [START_REF] Boult | Revocable fingerprint biotokens: accuracy and security analysis[END_REF] propose a transformation called biotope that induces a robust distance measurement. The biometric feature data X is first transformed (applied per feature) via scaling and rotation into while t and s are randomly generated parameters.

The revocability is assured by the use of different values for t and s. With the biotope, authors can achieve a better accuracy than the baseline system. However, the robust revocable transform was calculated per user. The fair evaluation would be to transform all probes with the same transform and report the accuracies (stolen key scenario).

In parallel, techniques inspired from password salting are typically dual factor authentication where a user-specific key is introduced during the transformation. BioHashing [START_REF] Teoh | BioHashing: two factor authentication featuring fingerprint data and tokenised random number[END_REF] is the most representative method of this family. It is based on a linear random projection. Note that, featuring biometric data with user specific randomness like a key or a password seems to be the easiest way to achieve revocability via direct replacement with a new set of randomness.

The transformation function in BioHashing combines a user specific key K with the biometric feature expressed as a fixed-length vector =( 1 ,..., n )/ . For more protection, the key K is considered as a seed for a tokenized random number (TRN). The BioHashing process is decoupled into two steps:

1) Random projection: It has been shown in [START_REF] Kaski | Dimensionality reduction by random mapping[END_REF] that random mapping can preserve the distances in the sense that the inner product between the mapped vectors closely follows the inner product of the initial vectors. The reference [START_REF] Kaski | Dimensionality reduction by random mapping[END_REF] proves that the closer to an orthonormal matrix the involved random matrix R is, the better the statistical characteristic of the feature topology are preserved. As a consequence, the tokenized random number is used as a seed to generate random vectors and ( ). After orthonormalization by the Gram-Schmidt method, these vectors are gathered as the column of a matrix . The resulting vector is denoted .

2) Quantization: This step is devoted to the transformation in a binary-valued vector of the previous real-valued vector using a simple thresholding. The goal is to guarantee the irreversibility of the process. It requires the specification of a threshold to compute the final biocode b=(b 1 ,...,b m ) while / . Thus, by combining the high confidence of the key to the biometric data, the inter-class variation increases while the intra-class distance is preserved.

Hence, zero EER can be achieved even if the feature extractor is low. However, if the key is revealed to an impostor, performances become worse than when using the biometric alone [START_REF] Kong | An analysis of BioHashing and its variants[END_REF].

The sustained works on BioHashing attempt to improve performance in when the user-specific TRN is stolen. This case is denoted 'stolen token scenario'.

In [START_REF] Teoh | Remarks on BioHash and its mathematical foundation[END_REF], authors use error correcting codes to resolve the stolen-token problem for PCA face features. The performance deterioration can be due to the information lost in binarization. In [START_REF] Teoh | Cancellable biometrics and user-dependent multi-state discretization in BioHash[END_REF], the concept of multi-stage quantization is introduced. The idea is to represent each of the biocode by N i bits. The choice of N i depends on the user-standard deviation of where r i are the column vectors of the random matrix. In [START_REF] Lumini | An improved BioHashing for human authentication[END_REF], the improvement is based on fusion strategies. The authors exploit the observation that the biocode length impacts the performance in the basic approach. However, this length is bounded by the feature vector dimension and cannot be increased at will. So, they propose solutions to assign g biocodes per user (g>1) rather than one.

The use of BioHashing to points set like minutiae features is surprisingly limited even if we are certain that these features will give better results. As it is known, ridge features or other representation suffers from a lower performance compared to minutiae. However, the problem is that it is not obvious how to apply it to the minutiae set. In another hand, Using minutiae as template, we have to cope with some difficulties which are: i) Miss-alignment between two minutiae set, ii) Set of minutiae points is not ordered and has variable size, iii) Missing or spurious minutiae.

Yang et al. [START_REF] Yang | Dynamic random projection for biometric tempalte protection[END_REF] have presented a new method for self-alignment and protection of fingerprint templates. Each template is decomposed in a set of N minutiae vicinities. To each of these vicinities the BioHashing is applied. At the same time, Nanni et al. [START_REF] Nanni | Biohashing applied to an orientation-based minutia descriptor for a secure fingerprint authentication system[END_REF] protect by BioHashing the orientation descriptor of each minutia. In the next, we present our proposal in which a minutia is represented by its texture descriptor. The neighboring information is used to consolidate the local matching process. We point the relevance of our approach in term of irreversibility and diversity compared to existent methods.

III. APPLYING BIOHASHING TO MINUTIAE TEMPLATE

We propose in this work, two descriptors: texture-based descriptor, which captures the ridge flow patterns around each minutia, and minutiae-based descriptor, which reflects the relationships between each minutia and its neighborhood. We propose to protect the texture based descriptor by BioHashing while keeping the minutiae descriptor in clear.

Based on the proposed descriptors, a graph matching algorithm similar to [START_REF] Chikkerur | K-plet and Coupled BFS: A Graph Based Fingerprint Representation and Matching Algorithm[END_REF] is used to establish the correspondences between minutiae.

We use the libcubs library provided by the Unified Biometrics and Sensors center (www.cubs.buffalo.edu) for minutiae extraction.

Our approach is as following:

Biometric descriptor creation: We propose to create minutia-centered local structures by using the texture descriptor presented in [START_REF] Jain | Filterbank based fingerprint matching[END_REF] around each minutia point m. We call this descriptor, a

MinuCode. The MinuCode extraction requires enhancing the input image [START_REF] Chikkerur | K-plet and Coupled BFS: A Graph Based Fingerprint Representation and Matching Algorithm[END_REF], and using a region of interest (ROI) determined by a circular tessellation surrounding this central point. This tessellation consists of B concentric bands of b pixels width. Each band is divided into 16 sectors of the same angle. The feature vector is calculated after application of a bank of Gabor filters using 8

orientations. The result is a vector of elements. Fig. 1.a shows the ROI.

Further, we use small sets of K-neighboring minutiae (K-Plet) as minutiae descriptor to represent the local structure between minutiae. We consider the K-Plet (Fig. 1.b) as a reinforcement step in order to verify if the matching of texture descriptor is consistent at the global level. Hence, a K-Plet is formed by a central minutia m and its K spatially closest minutiae.

The drawback in such neighbor-based structure is the possibility of exchanging nearest neighbors due to missing or spurious minutiae. To avoid this problem, two K-Plets are matched using a string alignement technique. We use the dynamic programming algorithm as proposed in [START_REF] Chikkerur | K-plet and Coupled BFS: A Graph Based Fingerprint Representation and Matching Algorithm[END_REF] Minutiae selection: given the fingerprint image , we obtain the template minutiae set M such as with the number of minutiae in the image . From the set M, a minutia is selected only if its surrounding ROI is validated according to this principle: it is in the boundary of the image and each sector S represents an alternation of ridges and valleys. We express this alternation by the energy E of Fourier spectrum so, if E> T r , then the sector is accepted else it is rejected, where T r is a global Otsu threshold. It is clear that the final selected minutiae set S will be smaller than the initial one. In fact, usually there are 30~60 minutiae in one fingerprint. In our algorithm, we only select the minutia with valid ROI (implicitly the central ones), given a template of 10~20 minutiae, which is considered as sufficient when dealing with local structures [START_REF] Zhang | Core-Based Structure Matching Algorithm of Fingerprint Verification[END_REF].Therefore, we can adjust the ROI surface according to the minutiae count which in turn depends on the sensor attributes. Rotation and translation support: while the translation factor is implicitly solved by using a reference point, the rotation problem is more critical. We adopt a solution based on the reference orientation correction. For each fingerprint image, we compute the reference orientation using the method of Liu et al. [START_REF] Liu | Fingerprint reference-point detection[END_REF] with some modifications. The orientation estimation is operated on the binarized image rather than the raw image. To avoid artifacts, we also consider in the range of fundamental orientations as following:

(1)

expresses the relevant accuracy for orientation angle. One can choose values of 16 or 32 to manage shifts of or resp. At matching step, the correction is done as following:

protection: each minutia with the number of selected minutiae in the set M is represented by its MinuCode. After, a K-plets are created containing K MinuCodes for each one. To enhance privacy, we decide to protect each MinuCode by the BioHashing process explained in Fig. 3.

diff=min(Abs(ref1-ref2), 360-(Abs(ref1-ref2))) if(ref1 < ref2) diff=-diff; imrotate(input_image, diff) (counterclockwise rotation)with ref1, ref2 the reference orientations of the enrolled and input images resp. For each minutia is a binarization threshold. Its choice will be discussed just below. 9. Delete the MinuCode and store the biocode.

The similarity measure between biocodes is based on the Hamming distance Now we discuss the point of the binarization threshold choice. The value of the threshold is generally fixed at zero, owing to the theoretical and expected equal probability for each element (after random projection) to be positive or negative. This process is aimed at increasing the ambiguity for an attacker who wants to estimate a probable accepted biocode. But, instead of using the value 0, we propose to estimate the median over a training dataset A (in practice, the probability of a positive or negative element is not equal) and to set the threshold to the obtained value.

We suggest estimating this median from a fixed set of independent fingerprint images as in Fig. 4:

For each attributed seed S Do -For each image in the set A Do Compute the biometric feature vector Generate the orthonormal matrix from the seed S.

Compute

) with -Let g be the number of computed W.

-For i=1:m Do Compute M i the median of the elements -The vector is considered as the threshold vector for the binarisation step. Therefore, we obtain a protected MinuCode noted PMinuCode (PMinuCode , m the biocode length). A protected template will be represented by the following notation:

while denotes a minutia label.

Template matching: we have to develop a fingerprint matching algorithm in the transformation space. The algorithm receives as input two protected templates and delivers a matching score that expresses the degree of similarity between them. Let PT A be the enrolled template containing N minutiae and PT B the input template containing M minutiae obtained after registration of the image B relatively to the orientation of the image A as explained in Fig. 2.

We need to identify a set of corresponding minutiae pairs:

with the following minutiae pairing algorithm. Intuitively, two minutiae are paired if they satisfy local and global constraints. i). A local constraint is satisfied by the pair if the Hamming distance between their PMinuCodes is sufficiently small relative to a certain training measure. ii). A global constraint is satisfied if the minutia is geometrically close to the minutia (the K-plet structure is used to manage this constraint). Now, the matching algorithm is divided into three phases:

Phase1: it consists of the selection of the best matched pair {root1, root2}, root1 PT A and root2 PT B as following: Two minutiae are likely to be paired if the distance between their PMinuCodes is small. However, because of the possible overlap between ROIs of neighboring minutiae, can also reveal a low distance with another minutia different from . Thus, to find the most distinguishable minutia pair, we try to minimize the following probability as in [START_REF] Ratha | Generating cancelable fingerprint templates[END_REF]:

(2)

12

The pair (root1,root2) is validated only if . If (root1,root2) is validated, go to phase 2. Otherwise, go to phase3.

Phase2: consider root1, root2 the first nodes to be explored in PT A , PT B resp. Now, we have to match the K-plet of root1 with that of root2. Each matched pair will be pushed in a queue and marked as visited. This selection scheme will now be recursively repeated until the queue becomes empty (each time, we pop the new pair (root1,root2) from the queue head). To avoid the local minima problem, go to phase1 considering just non visited minutiae;

Phase3 (Matching score computation): In automatic system, the number of pairing minutiae PM is converted into a similarity score for normalization. We find that the following score: is more appropriate according to experiences we done.

IV. EXPERIMENTS

To comply with the majority of works done on template protection, we use the FVC2002-DB2 [START_REF] Maio | FVC2002: Second Fingerprint Verification Competition[END_REF] database. It consists of 100 fingers with 8 impressions per finger obtained using an optical sensor of 569 dpi. The size of the images is 560296. We put B=3 (number of bands in the tesselation) implying n=384 (MinuCode size) while the length of each biocode is maintained at m=180 bits.

Biometric Performance evaluation: this first set of experiments is meant to evaluate the registration process against the orientation deformation. The evaluation will be performed for different image types. We set .

As we remark in Fig. 5, the correction works quite well. However, the main drawback of this method is that the estimation depends on the reference point. As a conclusion, we decide to rely on registration phase, knowing that it works even if it is not the best method.

Next, we evaluate the biometric performance verification of the approach concerning these three scenarios: the use of the sole biometric (SOLE), the protected template in both the Best (BEST)

case when an impostor never steals the key, and in the worst (WORST) scenario when an impostor always steals the key.

In our experiments, the first impression of each finger is used as the enrolled fingerprint. The remaining 7 impressions are used as genuine queries. To compute the false acceptance rate, the first sample of each finger is matched against the first sample of the remaining fingers. We use the Half Total Error Rate ( ) as a performance measure of the EER.

The performance of the sole biometric is reported in the form of receiver operating characteristic (ROC) curve as shown in Fig. 6. The EER re ported is 4.56%. From Fig. 7, we observe that the BioHashing performance in term of EER is 0% in the best case and is equal to 6.68% for the worst case. However, if we pay a little attention to the scores distribution, we find that this assert is unrealistic in practice. In fact, in Fig. 7, we can see that these error rates are feasible, but using different decision thresholds: 40 for the best case and 60 for the worst one. However, It is inconceivable in a practical system to speak of different threshold values at the same time. A compromise on a single value should be done. If we tune the system at the same decision threshold, the real performance of BioHashing process will really fluctuate. If we adjust the system to get EER=0% under the assumption that the key is never stolen (as it is always suggested), the FAR in the worst case will be 22% which is exagerated for a real authentication system. It is then more appropriate to put the operating threshold to 60. Here, we find that the real performances of the system are: FAR=0 % in the never-stolen key case, FAR=7.16% when the key is always stolen and FRR=6.21% in both the scenarios which is normal because the knowledge or not of the key does not affect the genuine distribution.

V. SECURITY ANALYSIS

We make analysis in term of security and privacy vulnerabilities.

Threat evaluation in term of security: here, we evaluate the possibility of an intrusion success in the biometric system. Globally, we think that an impostor can conduct the following attacks:

Zero-effort attack: in this scenario, the impostor tries to impersonate the genuine user with unknown key by presenting its biometric. This attack will always fail because the FAR equals to zero.

Stolen-key attack: in this scenario, the impostor tries to impersonate the genuine user with available key but by presenting its proper biometric. This attack depends on the FAR which is 7.16%.

Brute-force attack: in this scenario, the impostor decides to overcome the feature protection component by sending a ready template to the matcher. He will try to estimate an accepted template by an exhaustive search. Let k the number of minutiae neighbours. It is sufficient for the impostor to 16 estimate (k+1) MinuCodes (equivalent to one k-plet). The complexity of such estimation is 2 mx(k+1) .

It is 8820 bits.

Attack by template correlation: the Brute-force attack being impossible, the attacker will try to predict an accepted template after eavesdropping N templates of the genuine user. We will now explore if a prediction of the N+1 th template is possible. Because the template is a set of binary strings, we can study the correlation by Hamming distance distribution as done by Daugman in [START_REF] Daugman | The importance of being random: statistical principles of iris recognition[END_REF]. For this, we compare the Hamming distance distributions of minutia biocodes of each user generated with the same key (genuine distribution) and the same minutiae set but diversified from N keys (Pseudo-imposter distribution). We observe in Fig. 8 that both distributions are not overlapped. The mean of the blue zone is 33%. Let X be the random variable that represents the number of no matched bits in the biocode. The pseudo-imposter distribution can then be approximated by a binomial distribution where the binary event is the fact that two bits are equal or not and the number of trials is m, the biocode length. Then the mean of this distribution is with P the probability of the binary event. If we consider , the random variable of the normalized hamming distance then P will be equal to the mean 33%. This informs that the probability of predicting a correct value by bit is 1-P=67%, ideally we would get 50% for satisfying a total ambiguity. However, since the distributions of the genuine user and that of the pseudo-impostor are sufficiently separated, obtaining 67% is not negative.

Threat evaluation in term of privacy: we evaluate privacy in term of possibility of linkage and irreversibility of the protected template.

Irreversibility: we first assume that an attacker has access to both the random matrix R(n,m) and (k+1) PMinuCodes corresponding to one k-plet and wants to estimate the original MinuCodes . From a mathematical view point, the invertibility question can be considered as finding a solution to the following linear equations system: with unknowns and equations, . In this system, we have always more unknowns than independent linear equations. Based on the premise that possible solutions are infinite, the random projection is considered as irreversible. However, if an attacker knows the linkage among I diversified templates from I different matrices and if Rank , the problem will be invertible (for n=384, m=180, I needs to be equal to 3).

Fortunately, this attack remains difficult because finding 3 related diversified templates in our system is difficult.

Unlinkability/Diversity: a common way to evaluate diversity is to match different transformed templates obtained from the same biometrics after assigning each user t different keys. We call the percentage of success match the cross matching rate. For the proposed model, the matching score between diversified templates is always 0% for any value of t (we vary t from 2 to 10). It is completely independent from any operating threshold. This is a very interesting property if the same algorithm is used for different systems tuned at different operating thresholds.

VI. A COMPARATIVE STUDY

We intend now to compare in Table I the proposed method with ones dealing with minutiae features in order to situate our contribution. The EER is at each time in the worst case.

From Table I, we remark that the proposed method is well situated. Comparing to the method of Yang et al., it presents better diversity but slightly worst performance. This is due to the nature of the descriptor. Indeed, as detailed before, we use minutia texture descriptor where the relation between minutiae is just expressed by neighborhood. The method proposed by Yang expresses the same relation resorting to geometric information (minutiae vicinity). As a perspective, we intend to extend the neighborhood with more information and to fuse the texture descriptor with the Tico descriptor [START_REF] Ratha | Generating cancelable fingerprint templates[END_REF] ed on the FVC2002-DB2 an EER=2.3% for the sole biometric when our descriptor gives 4.56%.

The strength of our proposal is then in the diversity property where the cross match rate is always 0%, independently from any decision threshold.

VII. CONCLUSION

We discuss in this paper the security and privacy concerns over the use of biometrics. A focus has then been made on the dual factor BioHashing transformation for its diversity property comparing to other methods. We highlight the importance of using minutiae and propose an adaptation of BioHashing to minutiae templates. However, we experimentally demonstrate that the foremost claim of having near zero equal error rate when nobody steals the key factor is not exact in practice and if this is kept, the system will have a great intrusion risk. The accuracy achieved in the worst scenario where all the system parameters are known is 6.68% and 3.10% when no key is revealed, it is 4.56% for the sole biometric. So the trade-off between security and privacy is confirmed but it is not so drastic. In term of privacy preservation, we show that diversity is achieved in 100% of cases independently of any operating threshold while just a little correlation between diversified templates was quantified. We also show the strength of the approach against different scenario attacks. We plan to extend this work in several directions especially with the local structure between minutiae which we intend to enrich with additional geometric information.

  a. ROI around a minutia point b. 6-plet of the central minutia labeled "1" Fig.1. Biometric descriptor

Fig. 2 .

 2 Fig. 2. Rotation correction

Fig. 3 .Fig. 4 .

 34 Fig. 3. BioHashing process pseudocode

Fig. 5 .

 5 Fig. 5. Qualitative appreciation of the registration process (rotation handling) by image type. For each type, we have the enrolled, the input and the corrected images

Fig. 6 .Fig. 7 .

 67 Fig.6. ROC curve of the sole biometric

Fig. 8 .

 8 Fig. 8. Genuine vs. pseudo-impostor distributions by minutiae for N=10

  1. Let MinuCode the local descriptor of length n. 2. Normalize the MinuCode vector in the range [-1, 1] (the same range as the Gram-Schmidt result). 2. Let biocode a vector of length m. 3. Let K be the seed attributed to the user U.

	4. Generate from K a uniform random matrix Rnxm.
	5. Control that vectors in are linearly independents else go to 4.
	6. Apply the process of Gram-Schmidt to transform to an orthonormal set. In this case, we must have: n m  .
	7. Make the projection of MinuCode on this matrix:
	8. Binarization of W by thresholding to obtain the biocode vector	such as:

  used byNanni et al. [42] which seems more discriminative. Effectively Tico report-

	TABLE I PERFORMANCE COMPARISON BETWEEN EXISTENT MINUTIAE PROTECTION SCHEMES WHEN ALL ALGORITHM PARAME-
						TERS ARE KNOWN
	Methods		Database	EER	Diversity
	Proposed meth-	FVC2002-DB2	6.68%	Good and threshold independent
	od					(good diversity means no match is found between diversified templates)
	Ang et al. [27]	NIST (80 images)	16.8%	70% chance of correctly linking diversified templates
	Kumar et al.	FVC2002-DB2	4.98%	Not measured
	[19]
	Farooq et al.	1 enrolled sample,	1.59%	Good but threshold dependent
	[18]			1 enrolled test for
				1000 users.
	Lee	et	al.	FVC2004-DB2	10.3%	Good but threshold dependent
	[15,16]
	Yang et al. [14]	FVC2002-DB2	5%	Good but threshold dependent
	Boult et al. [30]	FVC2002-DB2	Not	Not reported
					reported
	Ratha et al. [24]	1 enrolled sample,	10%	91.5% chance for correctly linking diversified templates.
				1 enrolled test for
				188 users.
	Nanni et al. [36]	FVC2002-DB2	3.45%	Not studied


Rima Belguechi
email: rbelguechi@esi.dz

Patrick Lacharme
email: patrick.lacharme@ensicaen.fr

Christophe Rosenberger
email: christophe.rosenberger@ensicaen.fr

Enhancing the privacy of electronic passports

Keywords: Electronic passport, cancelable biometrics, privacy, cryptographic protocol. Reference

  L'archive ouverte pluridisciplinaire

Introduction

Secure and privacy preserving management of our digital identities in the constantly evolving numerical world is of paramount importance for citizens, industries, social groups, and governments. Numerous applications are emerging related to physical access control (buildings, restricted areas, customs, . . . ), logical access points (bank accounts, e-commerce, tax payments. . . ) or identity documents (passport, national identity card. . . ).

In order to achieve more secure systems, biometrics technology is employed in an increasing manner in order to verify the identity of an individual (i.e. to perform an authentication) or to determine his identity (i.e.dentification tasks). The major reason for this widespread usage of biometrics is that this technology provides the strongest proof of the physical identity of a person. Indeed, the relationship between the individual and its identity credentials cannot be more important. Biometric modalities available in the literature can be classified in three broad categories:

• Biological characteristics such as, DNA, cardiac signals as proposed by [START_REF] Phua | Heart sound as a biometric[END_REF] . . .

• Behavioral characteristics such as, online handwritten signature, voice, keystroke dynamics (1) . . .

• Morphological characteristics (the most widely employed) such as fingerprints, face, iris, hand veins (2) . . . However, with more and more applications using biometrics, new privacy and security risks arise. For example, personal biometric information could be tracked from one application to another by cross-matching between biometric databases, thus compromising privacy. A crucial issue is the potential misuse of collected biometric data. Questions like "What can I do if my biometric data has been stolen or misused?" require urgent attention not only to reassure users with regards to privacy intrusion but also to prevent misuse and improve accuracy. Moreover, since standard biometric templates are permanently associated with an individual, they could not be used anymore in case they are compromised. Since they cannot be replaced, they are also inherently non revocable. This makes "classical" biometric systems inappropriate for privacy and security critical applications. Therefore, these major issues should be solved urgently.

The idea of of a biometric electronic passport has been done after terrorism attack on September 11th in 2001. Since October 26th in 2006, it is required to enter the US. The number of countries that deliver a biometric passport is near 90. Most of European countries deliver it following the Schengen agreement. The number of biometric passports in the world is estimated to 100 millions. Even if the security of electronic passports is very good, some attacks are possible such as brute force to break a confidential transmission between the chipset and the terminal. Considering the fact a biometric information is not intrinsically revocable, some risks still remain.

Over the last decade, a new innovative multidisciplinary research field has emerged, that combines biometrics and cryptography. It has the capability to guarantee biometric data privacy in an algorithmic way. The resulting innovative hybrid systems have the following important properties: they confer to biometric characteristics the needed capabilities of revocability, privacy, and diversity, and provide cryptographic systems with a strong link to the user through biometrics. We propose to use this technology through the definition scheme for fingerprints privacy preserving for the protection of biometric information in the electronic passport.

In section 2, we present the different mechanisms that exist to guarantee the security of an electronic passport. Section 3 presents the proposed method after showing the state of the art in this domain. Section 4 presents some experimental results and a security analysis showing the benefit of the proposed solution. We finally give some conclusions and perspectives of this work.

Electronic passport

The International Civil Aviation Organization (ICAO) presented in 2004 a guideline proposing a set of specifications for Machine Readable Travel Documents (MRTD) [START_REF]Doc 9303 : Machine Readable Travel Documents[END_REF]. This specification is used as standard for a majority of countries for the first generation of electronic passports. It includes several cryptographic protocols to ensure authenticity, security and privacy of personal data. Later, European Union proposed in 2006 a new mecanism called Extended Access Control (EAC), to provide better security on personal data of the document [START_REF]EU standard specifications for security features and biometrics in passports and travel documents[END_REF]. EAC suite concerns the second generation of electronic passports. This suite presents a new PKI infrastructure and new cryptographic protocols.

Personal data

Electronic passports have an integrated chip, generally embedded in the cover page of the document, that contains personal information and biometrics data on the document owner. Biometrics information are used to have a more secure identification on the document holder than for previous passports. Additionally, a contactless (or RFID) technology has been chosen for the inspection process.

According to ICAO first specification, the choice for biometrics data is the digital facial image of the owner, and other biometrics data are optional as fingerprint data or iris scan. Nevertheless, facial images are not considered by ICAO as sensitive biometrics informations. Moreover, fingerprint data are mandatory for European Union passports since 2009.

In ICAO specification, the memory of the chip is composed of 16 data groups namely DG1,.., DG16, which correspond to the standardized Logical Data Structure (LDS). This data structure is divided in the following way :

• DG1 is a digital copy of the Machine Readable Zone (MRZ) of the electronic passport.

• DG2 is a digital picture of the face of the owner (in jpeg or jpeg2000 format).

• DG3 is composed of fingerprint data.

• DG4 is reserved for iris scan.

• DG14 and DG15 are used for public keys.

Moreover, the hash of all these data groups are stored in the Security Object of the Document(SOD) zone, and all these data are digitally signed by the issuing country. Finally, the chip contains additional information as private keys, stored in a secure section of the memory.

Fusion of RFID and biometrics technology is important in electronics passports, particulary for privacy considerations.

Following ICAO specification, the contactless chip is conform to the ISO 14443 norm, which is the standard for proximity contactless chip and specifies a radio frequency of 13,56 MHz (12). These chips are subject to classical attacks on contactless technology :

• Eavesdropping attacks : an attacker eavesdrops on a legitimate communication between the passport and a reader.

• Scanning attacks : an attacker communicates with the chip without the consent of the passport holder, using a false reader in proximity to the passport.

Other vulnerabilities on electronics passports using contactless technology are numerous (but not described in this paper). For example, a relay attack is developed by Hlavac and Rosa on Czech passport in [START_REF] Hlavac | A note on the relay attacks on e-passport : the case of Czech e-passport[END_REF]. Chotia and Smirnov presented in 2010 a method for tracking the passport holder [START_REF] Chotia | A Traceability attacks against e-passports[END_REF] and Richter, Mostowski and Poll show how to detect the presence of a passport and to retrieve its nationality, [START_REF] Richter | Fingerprinting passports[END_REF].

Eavesdropping attacks and scanning attacks can be used to retrieve data stored in the memory of the tag without the content of the passport owner, even for sensitive data such as biometrics data. Consequently, an access control protocol and a secure communication channel are necessary.

Secure access

The first ICAO standard specification of 2004 includes three cryptographic protocols, where only the first was mandatory (11) :

1. Passive Authentication is used to verify the authenticity of the data in the memory of the chip, with a control of the signature of all data of the chip.

2. Active Authentication is used for the authenticity of the chip himself, which must prove the knowledge of a private key used in a challengeresponse protocol.

3. Basic Access Control (BAC) is used to prevent unauthorised access and scanning attacks. BAC protocol produces also a session key, used to prevent eavesdropping attacks.

Passive and Active Authentication protocols are not described in this paper, because they concern authenticity of the data in the memory of the passport and the passport himself and are out of scope of this paper. A precise description of these protocols can be found in [START_REF] Nithyanand | A survey on the evolution of cryptographic protocols in ePasseports[END_REF].

In the Basic Access Control protocol, the reader proves to the passport that he knows informations of the MRZ zone which are visually printed in the first page of the passport. These informations are read by OCR (Optical Character Recognition) scanner. Then, an acces key K is directly derived from these data by the reader, using the 128 most significant bits of the hash function Sha-1, by K = 128msb(Sha-1(MRZ)).

Then, two keys of 128 bits K enc et K mac are derived from K (where || means concatenation) :

K enc = 128msb(Sha-1(K||1)), K mac = 128msb(Sha-1(K||2)).
These two keys are also contained in the memory of the chip and are used in a challenge/response mechanism with a 3-DES encryption (denoted Enc in all this paper) and a ANSI MAC with the following algorithm :

1. The chip generates a challenge C c of 64 bits and sends it to the reader.

2. The reader generates two words K r and C r of 64 bits, and computes with K enc and K mac

MAC(Enc(C r ||C c ||K r ))||Enc(C r ||C c ||K r ),
and sends it to the chip.

The chip retrieves the challenge C c and extracts

the key K r . The chip generates a key K c of 64 bits and sends to the reader the quantity

MAC(Enc(C c ||C r ||K c ))||Enc(C c ||C r ||K c ).
4. The reader retrieves the challenge C r and extracts the key K c .

The reader and the chip compute the new session keys with K

′ = K r ⊕ K c and K ′ enc = 128msb(Sha-1(K ′ ||1)), K ′ mac = 128msb(Sha-1(K ′ ||2)).
The aim of the BAC protocol is to ensure that only someone who has seen MRZ informations can access to the data of the chip. The reader directly derives the keys K enc and K mac used in the protocol with the knowledge of MRZ data.

The session keys K ′ enc and K ′ mac are used to establish a secure communication channel between the passport and the reader to prevent eavesdropping attacks.

The new suite of cryptographic protocols called Extended Access Control of European Union proposes to replace Active authentication by a new protocol, called chip authentication (not described here).

A new protocol is also specified for terminal authentication. This protocol means that the reader must be authenticated by the passport as a valid reader before the access of biometrics data. For this purpose, a PKI architecture is used, including country verifying certificate authorities, document verifiers and inspection systems. This infrastructure is hierarchical, which means that each country sign all document verifiers certificates and each document verifiers sign inspection system certificate. At each control, the passport must verify that the reader has a valid certificate. More details on this PKI architecture can be found in [START_REF] Pasupathinathan | An On-Line Secure E-Passport Protocol[END_REF]. Later, Pasupathinathan, Pieprzyk and Wang analyzed in 2008 the Australian electronic passport, and reported several flaws in the EAC suite [START_REF] Pasupathinathan | An On-Line Secure E-Passport Protocol[END_REF]. Authors presented a new protocol, called OSEP, where they propose to execute the terminal authentication protocol before the chip authentication protocol. Finally, Abid and Afifi modified this protocol using elliptic curves (4).

Consequently, the German organism BSI realized a new specification in 2008 for a new version of EAC, called EAC Version 2 [START_REF]Advanced Security Mechanism for Machine Readable Travel Documents[END_REF]. This specification proposes to execute the terminal authentication before the chip authentication as in the OSEP protocol. It contained also a new protocol for access control, called PACE protocol [START_REF]Advanced Security Mechanism for Machine Readable Travel Documents[END_REF] to replace BAC protocol.

The PACE protocol works in two independent times in the following way : firstly, the reader reads a specific data on the passport with an OCR scanner. This data is a random number π which is independent to personnal data of the passport owner. This number π must have enough entropy to avoid a brute force attack. In a second time, the reader and the passport realize a key exchange protocol to derive a common secret. This protocol can be the standard Diffie-Hellman protocol, or the elliptic curve key exchange protocol. In both cases, the key exchange protocol is denoted KA and the domain parameters are denoted D c , as notations of [START_REF]Advanced Security Mechanism for Machine Readable Travel Documents[END_REF]. Finally, a session key is derived from this common secret, using the following algorithm :

1. The chip generates a challenge R c , computes the key K π = Sha-1(π||3), encrypts the challenge R c with the key K π in z and sends it to the reader with domain parameters D c .

The reader computes the key

K π = Sha-1(π||3)
with the knowledge of the number π, decrypts z with the key K π and retrieves the challenge R c .

3. The chip and the reader compute the ephemeral domain parameters D ′ with the challenge R c and the domain parameters D c .

4. The chip and the reader compute a common key K using the key exchange protocol KA on the new ephemeral domain parameters D ′ : in a first time, the chip and the reader generate respectively two public and private key pairs (P uK c,pace , P rK c,pace ) and (P uK r,pace , P rK r,pace ), then they obtain a common key K by computing K = KA(P rK c,pace , P uK r,pace , D ′ ) = KA(P rK r,pace , P uK c,pace , D ′ ).

5. The chip and the reader compute the session key :

K enc = 128msb (Sha-1(K||1)), K mac = 128msb (Sha-1(K||2)).
6. The chip and the reader realize a mutual authentication protocol as following. The reader computes and sends its authentication token T r = MAC(K mac , P uK c,pace ) to the chip. The chip computes it and verifies the token T r .

The chip computes its authentication token T c = MAC(K mac , P uK r,pace ) and sends it to the reader. The reader computes it and verifies the token T c .

Discussion

Many works in the analysis of the BAC mechanism have been reported. One of the first security analysis is presented by Juels, Molnar and Wagner in 2005, where several flaws where identified [START_REF] Juels | Security and privacy issues in e-passports[END_REF].

Data of MRZ concern precisely the date of birth of the holder, the passport number and the expiry date of the passport. Firstly, informations of MRZ can be directly read on the passport by someone or partially known (for example, the date of birth of the passport owner is maybe on the web). Moreover, the entropy of MRZ information is very low, especially for country generating passport number in sequence. Possibility of brute force attacks on BAC mechanism was clearly presented on many passport as Belgian, Dutch or German passports [START_REF] Avoine | ePassport : Securing international contacts with contactless chips[END_REF].

The PACE protocol corrects the main weakness of the BAC protocol. This protocol is a state-of-the-art passsword-based access control resisting active attacks [START_REF] Chaabouni | The extended Access Control for Machine Readable Travel Documents[END_REF]. More precisely, the security of the mechanism is based on two points : firstly, there are no reasons to use personal data printed on the MRZ zone as a shared secret between the reader and the passport. The entropy of a (true) random number is not overevaluated. Secondly, the generation of the session key uses a publickey crypto-system (and not a symetric crypto-system where the secret key is written in the MRZ of the passport), realized independently to the first phase of access control.

Unfortunately, several flaws have been reported in this new specification by Chaabouni and Vaudenay in [START_REF] Chaabouni | The extended Access Control for Machine Readable Travel Documents[END_REF]. The RFID tag has no internal clocks and can not receive revocation list of reader. This means that the electronic passport considers date with the information received from reader the last time the passport is controlled, and compares it with expiration date of reader. As a consequence the terminal authentication of the EAC suite can be realized successfully by a reader with expired certificate.

Authors identify also an other weakness in the specification of [START_REF]Advanced Security Mechanism for Machine Readable Travel Documents[END_REF]. According this specification, if compatibility to ICAO is required, the passport shall grant access to less sensitive data to terminals authenticated by Basic Access Control. Therefore a false reader can require the passport to use BAC protocol with all its weakness. More generally, the number π is just printed on the passport and consequently can be retrieved by social engineering or directly read on the passport in the case where the electronic passport is stolen. In this case, an attacker with a fake reader can execute successfully the PACE protocol. Therefore a reader executing successfully the terminal authentication protocol (maybe with an expiree certificate) has access to all sensitive data.

Finally, it will be maybe possible in the future to access physically to data in memory of the chip even if, to our knowledge, nobody has presented a method to do this. However, it is not possible to change raw biometrics data if they are compromise. In this conditions it is important that raw biometrics data are not directly stored in the memory of the chip.

Proposed method

We put into obviousness the risk due to the protection of biometric templates with cryptographic keys. The proposed solution to this problem is to embed a cancelable biometric template of an individual in its electronic passport. We describe in the next section the general principle of the proposed solution for both of the enrolment and verification steps.

Principle

Figure 1 details the general scheme for the enrolment and verification steps. Note that the proposed enrolment scheme can be used for the update of the biocode (cancelable biometric template). Instead of storing a JPEG image of the fingerprint (that could be stolen and used by an attacker), we store in the electronic passport as DG3 information a biocode. This biocode is generated given a random number stored in a tamper resistant secure area of the passport (containing private cryptographic keys). During the verification step, the chipset sends this random number and the associated biocode to the terminal. The terminal computes a biocode given this random number and a biometric capture. The identity of an individual is verified by comparing the stored biocode and the computed one (using the Hamming distance). After a period, the biocode can be regenerated with another random number following the same process as previously explained.

Figure 1 Scheme of the proposed method

In order to define precisely this protocol, we have to implement a cancelable biometric generation method.

We present the state of the art in this domain in the next section.

Cancelable biometrics: state of the art

The solutions combining biometrics with cryptography can be classified into three categories: (a) protecting biometrics data with cryptographic techniques, (b) obtaining cryptographic keys using biometrics, and (c) cancelable biometrics.

A common solution in order to protect the privacy of users when using a biometric information consists in encrypting it with cryptographic. This solution has many drawbacks. First, it implies some key management issues (Publi Key Infrastructure or exchange of secret keys). Second, the privacy is guaranteed through the cryptographic scheme. Even if a cryptographic algorithm such as 3DES has not been broken yet, with progress in cloud computing, there are many chances it will be in a near future. This is a problem as it is not possible for an user to change its biometric information. To be completely safe, we should be able to guarantee a cryptographic algorithm would not be broken during the life of an individual (say 100 years) and it is difficult to be sure of that. Last, even if biometrics is combined with some other parameters (such as smart card, password, cryptographic key), it cannot improve the verification performance. Indeed, the comparison is always done in the biometric feature domain which can make it easier for an attacker to obtain the raw biometric data. As a conclusion, this first approach does not offer good guarantees on the privacy of users.

Along with revocability and privacy protection, stable cryptographic keys can also be obtained using biometric data. Examples of such systems are (17; 18; 19), etc., which deliver a stable bit-string, denotes as crypto-bio key, using biometric data. There are two possible modes of obtaining such keys it can be obtained directly from the biometric data (key generation) or a randomly generated key can be protected using biometric data and can be retrieved whenever it is required (key regeneration) by presenting fresh biometric data. These systems have the advantage to provide revocability, security, non repudiation, and privacy protection. In addition, these systems output a key which can be used in cryptographic systems. In the context of the electronic passport, we cannot use this approach because it does not fit the PKI used by governments.

In cancelable biometric systems (20; 21; 22), the biometric signal/feature vector is generally converted using an one-way transformation so that the biometric data is not stored in its usual form. The biometric template is transformed such that it does not reveal the original biometric data. The transformation makes it possible to issue different templates of a person for different applications by using different transformation parameters. Thus, the templates cannot be matched across databases providing privacy protection. Moreover, if the template is known to be compromised, it can be canceled. In this case, a new template can be issued using the same biometric information. This ability to change the template and issue a new one is called revocability. [START_REF] Ratha | Generating Cancelable Fingerprint Templates[END_REF] proposed three different transformations for fingerprints (Cartesian, polar, and functional). These transformations are oneway transformations in a way that it is not possible (or practically feasible) to obtain the original biometric data from the transformed one. However, the performances of the proposed systems are worse than the baseline biometric system. Using tokenized random numbers for biometric discretization is another solution proposed by [START_REF] Goh | Computation of cryptographic keys from face biometrics[END_REF]. Another advantage of combining tokenized pseudorandom number is to obtain a cancelable biometric data. To re-issue the user identity, a specific new token needs to be issued. The authors denote this model as BioHashing. [START_REF] Boult | Revocable Fingerprint Biotokens: Accuracy and Security Analysis[END_REF] proposed a fingerprint based revocable biotokens scheme in which they use robust matching techniques in encrypted domain. This scheme combines a user assigned token with biometric data, and as expected, improves the performance as compared to the baseline system. [START_REF] Kanade | Cancelable Iris Biometrics and Using Error Correcting Codes to Reduce Variability in Biometric Data[END_REF] propose to shuffle the iris code in order to improve the verification performance of the system and to protect the original biometric data (iris code). Moreover, a novel method of correcting biometric data variabilities using error correcting codes is proposed. When the proposed algorithm is applied on the iris data, the performance (in terms of Equal Error Rate EER) is improved by more than 90% (EER decreases from 1.70 to 0.057%).

Cancelable biometrics

We propose a cancelable biometric approach for fingerprints based on texture decomposition [START_REF] Belguechi | Study on the Convergence of FingerHashing and a Secured Biometric System[END_REF]. First, the general process is described. Secondly, the computational details of the biometric template are given. The BioHashing process is presented next.

Figure 2 illustrates the general process to compute the biometric feature based on Gabor filtering (texture analysis) delivering a fingercode of size 384 bits. The main advantage of this solution for feature computation is the resulting number of bits compared to minutiae extraction. For more details on this feature extraction part, please refer to the following article [START_REF] Belguechi | Study on the Convergence of FingerHashing and a Secured Biometric System[END_REF].

In order to generate a cancelable biometric information (biocode), we apply the Biohashing process to the previously described fingercode. In general, the process of BioHashing has two stages. In the first stage, some features (f 1 , f 2 , ..., f n ) are derived from the raw biometric signal. In the second stage, features are mapped to a binary descriptor b ∈ {0, 1} m , where m is the length of the bit-string code. Different biometric signals exploit different techniques in the first process,

b i = 0 if (< f, r i ⊥ >) ≤ Γ 1 otherwise
where Γ is a preset threshold.

The resulting bitstring b named biocode is compared using Hamming distance. The security of the process is assured if the biocode is non invertible. Note that the user must provide his biometric data (the fingercode) and the seed value to be authenticated.

Results and discussion

In this section, we present first a study on the performance on the verification realized with the biocode. A security analysis on the proposed passport architecture is given.

Verification performance

The performance of a biometric system is commonly described by its False Acceptance Rate (FAR) and False Rejection Rate (FRR). The two measurements can be controlled by adjusting a threshold, but it is not possible to exploit this threshold simultaneously reducing FAR and FRR. FAR and FRR must be traded-off, as reducing FAR increases FRR and vice versa. Another index of performance is Equal Error Rate (EER) defined as the point where FAR and FRR are equal. A perfect system would have zero EER.

In the experiment, following ICAO recommendations, we acquire an optical fingerprint scanner that meets the FBI image quality specifications [26] in order to be conform with a real border control scenario. Our constructed database has the following properties :

• The images of the people were taken on two different sessions and no efforts were made to ensure a minimum of quality acquisition.

• The image contains 80 individuals and 8 acquisitions for the same finger given a total of 640 images.

Figure 3 Fingerprints database

First of all, we present the performance of the fingercode method (without biohashing) on the databases. We simulate the genuine distribution, we obtain an EER value of 4% (see Figure 4). Note that the obtained performance is far from the best algorithm from the state of the art but it is not important for our study. This performance has to be compared in a relative way with the cancelable biometric method.

In order to quantify the robustness of the proposed cancelable biometrics method, we defined different Scenario 1 (genuine distribution) : to generate genuine distribution, each BioCode of each subject is matched against all other BioCode of the same subject leading to 2240 comparisons (7 × 8/2 attempts for each subject ×80). To plot the ROC curve, we simulate an impostor distribution by comparing the first BioCode of each subject against the first one of all other subjects and the same process done for all the database, leading to (80 × 79)/2 × 8 = 252850 attempts. We notice that after fixing parameters (quantization thershold and BioCode length) the error rate of 0% is obtained which means that a genuine user is always accepted and an imposter is always rejected (see Figure 5). This result means that the BioCode is able to correctly separate intraclass from inerclass distribution as long as parameters are well tuned. However, in a reality the claim of always having 0% error rate is not realistic. An impostor can steal a genuine passport and tries to masquerade as the authentic user. We explore this issue in the next scenario. Scenario 2 (always-stolen-passport) : here, we consider a very worst scenario when an impostor steals all the passports of the genuine users (not probable in practice) and presents himself to the border control. In term of our database, a passport is the combination of BioCode+user random number; to simulate this it is sufficient to put the same random number for all the subjects. As in scenario 1, we have 2240 genuine attempts and 252850 impostor attempts. We notice in this scenario that the performances are weaker compared to the use of the biometric alone (see Figure 6). By increasing the parameter m, we can improve the results. With m = 384 bits (maximal value considering the fingercode size), we obtain en EER of 6.78%

Privacy protection analysis

In this section, we study how the proposed biometric data management scheme is consistent with generally accepted privacy principles. First of all, we consider that our fingerprint representation based on fingerprint texture analysis (i.e. The Fingercode) is personally sensitive information this means that FingerCode can expose enough information about individual and can be used against his or her wishes (e.g. gaining acces to other biometric systems). We analyze privacy in terms of reversibility and linkage attacks.

Reversibility attack : for a feature vector f (n × 1) and a random matrix R(m × n). The BioCode B is B = Q(Rf ) where Q is a quantizer. The process is invertible if we can derive f from B having R. This may happen when EAC protocol fails and a false reader gain access to B and R simultaneously. Considering, the process B = Rf without quantization. The problem can be viewed as rectangular linear equation system where we have more unknowns than equations (n > m). If R is a non-full rank matrix, the infinite system solutions underlies the non-irreversibility of the equation B = Rf .

If R is a full rank matrix, using the QR factorization it is possible to find a close estimation a of f which minimizes the norm f -a in term of least squares approximation. Note that,a is never equal to f . Furthermore, the discretisation step enforces the noninvertible property of BioCode even if R and B are known.

In the other hand, we believe that this close estimation possibility is related to the contiguous nature of the vector f . If we make a certain random swapping before projection, the non-reversibility can be guaranteed in all cases.

Linkage attacks : Here we examine the possibility to link BioCode template with other fingerprint databases in order to track individual activities. Always based on the possibility of EAC protocol failure and the access to the biometric information (BioCode) , we try to analyze if a BioCode can be correctly submitted to any other BioCode-based databases. This depends on the strengths of revocability scheme. For testing this, we assign each individual with n different keys and make comparison between templates. We always find that Hamming distances is always above a certain threshold which means that revoked templates are sufficiently distant.

Conclusion

For privacy protection point, we can claim that the problem is mainly solved by our system. Indeed, having the BioCode without the seed, it is very complex to recover the original FingerCode. Having the seed and the BioCode, it becomes commonplace to get a FingerCode close to the initial one but the protection of BioCode by the system match-on-card never allows its migration out of the card which handicaps largely this type of attack.

Figure 2 4 .

 24 Figure 2 Fingercode generation

Figure 4

 4 Figure 4 Fingercode verification efficiency

Figure 5

 5 Figure 5 Biocode verification efficiency

Figure 6

 6 Figure 6 Biocode verification efficiency in the worst case on the first database