Rima Belguechi

Estelle Cherrier

Christophe Rosenberger

Texture based Fingerprint BioHashing: Attacks and Robustness

BioHashing is a popular biometric template protection scheme defined in the last decade. Most of previous studies on this algorithm focus on the performance optimization or the use of this privacy protection scheme on many types of biometric modalities (face, fingerprint, palmprint. . . ). The objective of this paper is to study the robustness of this algorithm on a texture based representation by testing and simulating operational attacks. We consider in this study some quantitative measures of the robustness of the BioHashing algorithm and we show some new results on its security on fingerprints represented by texture features.

Introduction

Literally, biometrics is the science that measures the characteristics of living beings. In recent years, biometrics more specifically refers to the identification or identity verification of individuals based on a morphological analysis (face, fingerprint, iris. . . ) or a behavioral one (e.g. voice, signature dynamics, keystroke dynamics. . . ) [START_REF]Minutiae interoperabilty exchange test[END_REF], [START_REF] Giot | Keystroke dynamics with low constraints svm based passphrase enrollment[END_REF]. Many biometric applications have been developed including border control by a biometric electronic passport, physical access control to secure buildings or fingerprint sensors embedded on laptops for logical access control. However, biometrics presents some risks in terms of compliance rights and fundamental freedoms. The fact of capturing and keeping a raw biometric data may be an invasion of privacy. These data are sensitive and are not yet protected by an international standard. Among the considered solutions, it is possible to create anonymous databases and more generally to incorporate the notion of the privacy respect during the design of a biometric system. Another problem concerns an important violation of privacy: the intrinsic non-revocability of the biometric data. Unlike a password or a PIN code, biometric personal char-acteristics may not be changed in case of theft or forgery. The concept of cancelable biometrics has been defined for the first time in the article [START_REF] Ratha | Enhancing security and privacy in biometrics-based authentication system[END_REF] as the transformation of raw biometric data, using a chosen function such that the transformed data are safe, cancelable and respect the user privacy. The book [START_REF] Maltoni | Handbook of Fingerprint Recognition[END_REF] gives the essential characteristics of a convenient cancelable biometric system:

• Revocability: one must be able to easily remove the data if compromised,

• Non-invertibility: from the transformed data, it should not be possible to obtain information on the biometric raw data,

• Performance: the fact that biometric data is cancelable shall not deteriorate the performance of the biometric system,

• Diversity: it should be possible to generate different data for multiple applications.

This paper is organized as follows. We present a brief state of the art in section 2 on solutions for the protection of biometric data. Section 3 describes the general principle of BioHashing and its variations given the biometric modality. A comparison of existing methods is realized. Section 4 presents the protocol and the various attacks to analyze the security of this protection scheme. Experimental results are detailed and discussed. We conclude and give some perspectives of this study in section 5.

Background

To protect a biometric template, there are several solutions in the literature. When designing a biometric system, the difficulty to meet all conditions outlined above mainly concerns the natural variability of the biometric signal. Therefore, classical cryptography is not really fitted for this problem.

1

The transformation functions represent an interesting solution to compensate for the variability of the biometric raw data by directly performing the comparison between the capture and the biometric reference in the transformed domain. Based on Ratha's concept of cancelable biometrics, the pioneering article written by Teoh et al. [START_REF] Teoh | Biohashing: two factor authentication featuring fingerprint data and tokenised random number[END_REF] presents the general principle of the BioHashing algorithm. This method introduces a distortion of the biometric signal using a chosen transformation function to generate a BioCode. Revocability is guaranteed because, when a BioCode is compromised, one simply needs to change the transformation function. Diversity is also ensured by the choice of different functions for each application. However, finding such functions is not easy. Indeed, besides non-invertibility, these functions exhibit two important properties: intra-class variability robustness (that is to say a robustness face to the variations of the biometric raw data of an individual) and inter-class sensitivity (it should be possible to distinguish two different individuals given their BioCodes).

BioHashing description

The general principle of BioHashing is to generate a binary BioCode (used for the enrolment and verification steps) from the representation of the biometric data (such as texture parameters or minutiae for fingerprints) and a random number [START_REF] Teoh | Biohashing: two factor authentication featuring fingerprint data and tokenised random number[END_REF]. This process is used at the enrolment step (where only the generated BioCode is stored) and at the verification one (where the BioCode is recalculated for each verification and the stored random number is required). The verification result is obtained from the computation of a simple Hamming distance between the reference BioCode and the one issued from the new capture. The advantage of this approach lies in the ability to revoke the BioCode (by applying the same process with a different random number). Another interest lies in the possibility to generate different BioCodes to authenticate oneself to different services from the same biometric raw data (fingerprint by example). Figure 1 illustrates the overall process.

In the sequel, we will focus on fingerprint modality. If we detail the Biohashing process, it first consists in projecting the (normalized) raw biometric data (called Finger-Code) on an orthogonal basis generated from the random number. The resulting dimension is at most equal to the dimension of the initial representation of the biometric data. This step somehow amounts to hiding the biometric data in a part of the multi-dimensional space. Using an orthogonal basis ensures the conservation of similarity relationships between the BioCodes, as demonstrated by the lemma Johnson-Lindenstrauss (see reference [START_REF] Dasgupta | An elementary proof of the Johnson-Lindenstrauss Lemma[END_REF]). The second step has for objective to quantize this result using a simple thresholding. This step ensures the non-invertibility of the process (preventing an intruder from finding the raw biometric data from a BioCode) and increases the robustness of the process (by allowing minor differences in the projected vector inherent to the acquisition of the raw biometric data). The general principle is summarized in Figure 2. This two-factor process ensures that it is not possible to retrieve the raw biometric data given the BioCode. To resist the brute-force attack (BioCode prediction of a genuine user), it is necessary to have a representation of the biometric data which provides the largest entropy. Minutiae are commonly used to represent a fingerprint but this representation is too compact in general to be used in this context. Authors in [START_REF] Aoudia | Cancelable authentication based on ngerprints texture[END_REF] proposed to use a representation based on texture features (obtained by Gabor filters) to generate a 384 bit BioCode with the Ratha's method . We use in this paper the same approach that is to say a Gabor filter bank to generate a FingerCode given a fingerprint. This leads to a dimension of representation equal to 128 bits (8 orientations, 16 scales). As detailed previously, the BioHashing method is a generic approach enabling the revocation of raw biometric data. It has been used on multiple biometric modalities (palmprint [START_REF] Connie | Palmhashing: a novel approach for dualfactor authentication[END_REF], face [START_REF] Lumini | An improved biohashing for human authentication[END_REF], fingerprints [START_REF] Nagar | A hybrid biometric cryptosystem for securing fingerprint minutiae templates[END_REF], finger knuckle prints [START_REF] Belguechi | Evaluation of cancelable biometric systems: Application to finger-knuckle-prints[END_REF]. . . ). The issue of protection of biometric data was often discussed in a surprising way considering performance (i.e. error rate minimization and maximization of the BioCode size). Apart from some works, including [KCZ + 06, LCM09, SLMM09, Nag10, KTT10, BCAR11], there are very few studies focusing on the robustness of these algorithms, especially including the definition and test of attacks scenarios. The main contributions of the paper are:

• a rigorous study of the BioHashing scheme using textural features,

• the proposition of a new attack based on multiple listenings,

• the study of the identification case (to estimate if an attacker can be identified as genuine user).

Study of BioHashing robustness

The proposed protocol and the performed attacks are detailed below.

Protocol

Generally speaking, the performance of biometric systems is equally determined by: the sensor quality, the capture ergonomics and the algorithms performance. In the following, only the third point is dealt with. We suppose the other conditions are fulfilled. When dealing with authentication by password verification, the process is said deterministic in the sense that the output is either positive (if both passwords are found identical), either negative (if both passwords are found different). However, comparing two (transformed or not) biometric data is a statistical process. Indeed, each capture of the same biometric data is different: the verification system has to evaluate a degree of similarity and then, depending on a fixed threshold, has to decide whether the user is authorized or not. Some standard error rates will be used as the FAR (False Acceptance Rate), the FRR (False Rejection Rate) and the EER (Equal Error Rate).

In this paper, we consider the FVC2002 benchmark [FVC] dB3 composed of 8 fingerprints (resolution 355 x 390 pixels) for 100 individuals. The FingerCode of each user is generated following the method presented in section 3, with resort to a Gabor filter bank. Once this is achieved, 8 FingerCodes are available for each person, which means 800 FingerCodes of length 128 to 512 bits. After random projection and quantization, 800 BioCodes are issued. For each person, one BioCode is kept as a reference, the other 7 BioCodes are used to test the different attack scenarios.

Performance evaluation

First, the performances of both biometric systems based on the use of the FingerCode and the BioCode respectively are studied through an analysis of their ROC curves.

Test 1 : FingerCode In this case, the biometric system is not cancelable since it uses the raw fingerprint data. The obtained score is measured with the Minkowski distance between the fingerprint kept as reference (i.e. the reference FingerCode) and the other fingerprints of the database. The obtained EER is equal to 19%, see figure 3(a). This performance is obviously far from being the best compared to results in the literature. But, this value allows us to set a baseline performance of the system.

Test 2 : BioCode In this case, the performance of a cancelable biometric system is evaluated. Notice that the EER is null as illustrated by figure 3(b), which means that another user in the database will not be able to impersonate another genuine user. This scenario is known as a zero-effort attack. The corresponding threshold is equal to 0.32. Compared to the FingerCode performance, this improvement looks very interesting: it is mainly due to the smoothing of the intrinsic intra-class disparity by the random projection (the random value is kept fixed for each user). In other words, that means a reduction of the intra-class variability, leading to better performances. In the sequel, we suppose that the threshold of the BioHashing system remains at this value of 0.32.

Robustness evaluation

In this section, we analyze the behavior of the studied system against some attacks.

Description of the different scenarios

Studying BioHashing robustness amounts to evaluate the system performance with respect to:

• unavoidable variations of a biometric data, also called intra-class variations

• the differences between data issued from distinct persons, also called inter-class variations An ideal cancelable biometric system would exhibit both robustness to intra-class variations and sensibility to inter-class variations. This criterion is very challenging, since these two conditions are quite difficult to conciliate. In this paper, we propose to test some well-known attack scenarios, such as stolen biometric data, stolen-key attack, brute-force attack. But, we also propose to test some new attacks (such as BioCode correlation attack) with a view to defining a framework (or a minimum security level) for the further study of future cancelable biometric systems. Let us recall the database configuration: 100 users, 1 reference BioCode for each user (enrolment), 7 other BioCodes for each user (testing). First, known attacks are tested, with an original approach to quantify their operational impact. More precisely, the relevant value we will study is 1-FAR: indeed, given the reference BioCode of a genuine user, the intruder will try to generate an eligible BioCode, using different available data (token, FingerCode. . . ). Recall that the threshold has been fixed to 0.32 to ensure the better performances i.e. an EER equal to zero in ideal conditions. Therefore, the intruder aims at generating a BioCode whose Hamming distance with the reference BioCode is less than 0.32.

Test 3 : Brute-force attack Now, we suppose that the intruder has no information, more precisely, he/she does not know anything about the Finger-Code nor the tokenized random number. The only available information is the length of the binary BioCode. The attack consists in the comparison of randomly issued BioCodes (with a random FingerCode and a random number different each time) to the genuine BioCodes. The figure 4 illustrates the evolution of the rate 1-FAR of the original BioCode and that of the brute-force attack. It can be seen that the bruteforce attack 1-FAR is almost always less than 1 for thresholds less than 0.32. There is only a narrow interval in the threshold values for which this value is different from 1: to evaluate the attack performance, one needs to precisely compute the value 1 -F AR at the abscissa 0.32, leading to an efficiency of the brute-force attack equal to 0.14%.

Test 4 : Stolen FingerCode

In this test, we assume that the intruder has stolen one fingerprint among the 800 in the database. Then, he/she will try to impersonate this authorized user. Then, the intruder is able to generate a FingerCode (we suppose he/she knows how to compute it) and a corresponding BioCode with a random number different from that which has been used to compute the reference BioCode. The figure 4 illustrates the performances of the stolen FingerCode attack. With the same reasoning as in the previous test, the efficiency of this attack is estimated at around 0.14% at the fixed threshold of 0.32. This proves that the knowledge of the FingerCode does not significantly improve the brute-force attack, so the FingerCode is not an interesting information source for the intruder. This is a very good property for privacy.

Test 5 : Stolen token In this test, we suppose that the intruder has stolen the token. In this case, the random number is available, but not the FingerCode. The fake BioCode will be generated from a random FingerCode (in fact from the intruder's fingerprint, considered as random in our numerical simulations). For this test only, the random number is fixed at the same value for all the authorized users of the database. The performances of this attack can be seen at figure 4. Roughly speaking, this attack is again not very effective, since the efficiency rate is estimated at 0.28%. We remark that this rate is twice that of the former attacks. This conclusion underlines the importance of the tokenized random number, and the need for its relevant secure storage.

Contrary to the previous attacks that can be found in the literature (we refer the reader to parts of the works [START_REF] Teoh | Cancellable biometrics and annotations on biohash[END_REF] or [START_REF] Jain | Biometric template transformation: A security analysis[END_REF] for example), some new (to the authors knowledge) attack scenarios are detailed now. These attacks ensue from the revocable feature of BioHashing: assume that an intruder has eavesdropped a genuine user so as to collect N different BioCodes {B 1 , .., B N } of this user (each BioCode has been generated with a different random number). Then, the intruder generates a new BioCode, from these N interceptions, by statistically setting the bits at the value 0 or 1, depending on the most frequent value among {B 1 , .., B N }. The following tests aim at analyzing if the information contained in the spurious BioCode is sufficient to be accepted by the system. We chose to study two cases (N = 3 and N = 11) to analyze if more interceptions (and hence a better statistical analysis) lead to a better efficiency of this attack. Considering a larger value for N indeed becomes quite unrealistic.

Two readings can be made from these statistical attacks. On the one hand, the value 1-FAR will be examined as in previous tests, to determine if the intruder can impersonate the genuine user corresponding to the intercepted BioCodes. In this case, the attack is called personal. On the other hand, the intruder may simply want to impersonate one of the authorized users. In this second case, this attack is called global: the ROC curve and the EER must be rather examined.

Test 6 : Attack by eavesdropping In this test, we assume that the intruder has eavesdropped N = 3 or N = 11 BioCodes of the same user (these BioCodes have been intercepted after revocation). The figure 5 shows that the system is able to resist the personal attack for both values of N . More precisely, the efficiency of the attack does not increase much when N becomes larger: the risk amounts to 0.06% when N = 3 and to 0.16% when N = 11. The obtained efficiency rates indicate that the personal attack is not the most effective one: the intruder should prefer to steal the token of the user. Even if this is not realistic, more interceptions will lead to a slight improvement of the efficiency of the personal attack. Test 7 : Global attacks In this test, assume the intruder only wants to be authorized by the system as one of the 100 genuine users, without a precise identity theft, using N stolen BioCodes. The ROC curves plotted at figure 6 for N = 3 and N = 11 display an EER equal to 0.5 in both cases. This means that the intruder is likely to be accepted by the system, but without knowing which user he/she impersonates. When the same study of the ROC curves and the EER values is conducted for the other attacks (brute force, stolen token, stolen FingerCode), the same conclusion can be drawn: a global attack is always efficient.

Synthesis

This section is devoted to a summary of the conducted attacks and a comparison of their efficiency. Considering any personal attack scenario, a very low risk exists, which means a flaw in BioHashing, that will require countermeasures in future works. We compute the same attacks for BioCodes of size 128, 256 and 512 bits. For the three sizes, the FingerCode performance is similar and a perfect performance is achieved using the BioCode in ideal case. In table 2, the obtained efficiency risks of the different attacks are gathered, corresponding to the value of 1 -F AR when the threshold is fixed at 0.32 (for a BioCode of size 128 bits). This allows us to classify the scenarios against each other: the most efficient attack corresponds to the stolen token scenario, nevertheless the risk is rather weak with 0.28% of success. We tested the same attacks for different sizes of the BioCode (by adapting the number of Gabor filters). For BioCodes higher than 128 bits, none of the attack is operational. Therefore, the size of the BioCode is important for robustness issues. of attack does not allow the intruder to know which user he/she impersonates.

Conclusion

Despite active research in recent years in the proposal of protection schemes of biometric data, very few studies have focused on the security and robustness of these protocols. This is however vital in an area such as biometrics which handles highly sensitive data. The main contribution of this paper is to propose an experimental analysis of the robustness of these algorithms for different attack scenarios. We defined a methodology to compare the risk associated to an attack. This work was performed on a popular cancelable algorithm on a significant fingerprint database of the literature. The proposed study has shown a good robustness of the scheme in the context of theft identity. The risk identified for the most severe attack reaches 0.28%. It was also shown that an attacker is able to generate fairly easily a BioCode eligible by the identification system showing a significant weakness of this protection scheme. The prospects of this study are the development of more complex attacks for the identity theft. We intend to analyze the distribution of bits in the BioCode to define heuristic search for the generation of identity theft attacks.

Figure 1 .

 1 Figure 1. General principle of the BioHashing algorithm

Figure 2 .

 2 Figure 2. BioCode generation

  Figure 3. ROC curves

Figure 4 .

 4 Figure 4. BioHashing robustness analysis against brute-force, stolen FingerCode and stolen token attacks

Figure 5 .

 5 Figure 5. Personal attacks by interception of N BioCodes

Figure 6 .

 6 Figure 6. Global attack by interception of N BioCodes

Table 1 .

 1 Performance evaluation through the EER value (without attack) Considering the global attacks, they have been found operational and thus raise privacy issues. Notice that this kind BioCode size Brute force Stolen FingerCode Stolen token N = 3 interceptions N = 11 interceptions

		128 bits 256 bits 512 bits
	FingerCode	19%	18%	17%
	BioCode	0%	0%	0%

Table 2 .

 2 Attack risk value (1-FAR) for a cancelable biometric system with prescribed threshold ensuring EER = 0% in ideal case (without attack)


S Souayeh

N Kacem

INTERNAL RESONANCES IN NONLINEAR NANOCANTILEVER ARRAYS UNDER ELECTROSTATIC ACTUATION

The nonlinear dynamics of nanoelectromechanical cantilever arrays is investigated using a comprehensive analytical multiphysics model that takes into account geometric and electrostatic nonlinearities. In particular, the internal resonances between the different cantilevers are analyzed using a multi-modal Galerkin discretization coupled with a perturbation technique. Such systems offer a perfect mechanical synchronization, interesting nonlinear behaviors and exchange of energy between their different components which makes them potential candidates for multi-mass sensing applications.

INTRODUCTION

Despite the fact that internal resonances (IR) have interesting dynamic properties, many designers strive to avoid it in their models. In recent years, this phenomenon is more and more used due to its property of suppressing oscillations in cantilever [START_REF] Tuer | Development of a generalised active vibration suppression strategy for a cantilever beam using internal resonance[END_REF] or also enhancing the coupling effect in dynamical systems [START_REF] Siddiqui | Vibration suppression in flexible gyroscopic system using modal coupling strategies[END_REF]. Sethna [START_REF] Sethna | Vibrations of dynamical systems with quadratic nonlinearities[END_REF] was one of the first researchers who investigated the phenomenon of IR. He studied the influence of quadratic nonlineriarities in a system which exhibits two-to-one (2:1) internal resonances with subharmonic parametric resonance. He showed that the steady-state motions are more interesting when the system possesses external and internal resonances. Moreover, several studies were performed regarding resonant response of system under harmonic excitation forces [START_REF] Balachandran | Observations of modal interactions in resonantly forced beam-mass structures[END_REF][START_REF] Kumar | Nonlinear parametric amplification and attenuation in a base-excited cantilever beam[END_REF]. Nayfeh and Mook [START_REF] Nayfeh | Nonlinear Oscillations[END_REF] have given a complete treatment of this subject. A common result from these researches is that the IR ratio depends on the type of coupling of the system. For quadratic coupling two-to-one (2:1) IR ratio can be used and for cubic nonlinearities both one-to-one (1:1) and three-to-one (3:1) IR ratios give amplitude modulated response. Recently, Gutchemidt and Gottilieb [START_REF] Gutschmidt | Bifurcations and loss of orbital stability in nonlinear viscoelastic beam arrays subject to parametric actuation[END_REF] modeled a continuum initial-boundary-value problem of a doubly-clamped microbeam array excited at several DC biases and periodic AC voltages. They showed that, for DC near systems first pull-in instability, three-to-one internal and combinational resonances were identified.

Motivated by the previously cited researches, and aware about the important influence of the internal resonances (IR) in nonlinear systems such as NEMS, this work is conducted to investigate the IR that can occur in a device composed by one or several coupled nanocantilevers under an electrostatic actuation. In this context, two types of configurations are considered: the first one, used by Kacem et al [START_REF] Kacem | Dynamic range enhancement of nonlinear nanomechanical resonant cantilevers for highly sensitive nems gas/mass sensor applications[END_REF], is a single nanocantilever actuated by an electrosatic force while the second configuration consists of an array containing N coupled nanocantilevers actuated by a single electrode. The two systems are represented in Figure 1.

MODEL

As a first step, a single nanocantilever (Figure 1 (a)) is considered. In order to identify the internal resonance conditions, a multi-modal Galerkin method is used to calculate the natural frequencies of the three lowest bending modes. Figure 2 (a) shows the variation of these frequencies with respect to the DC voltage. After a meticulous investigation of the possible IR, and despite the fact that there are many possibilities of internal resonances and exchange of energy among higher and lower order modes, two major issues are noticed: the study of such systems gives a very complex set of amplitude and phase equations and above all, it is arduous to obtain in experiments such relations between the different modes.

In order to avoid these complexities, another approach is considered. It is inspired from [START_REF] Gutschmidt | Nonlinear internal resonances of a microbeam array near the pull-in point[END_REF] and consists of an array of N nanocatilevers depicted in Figure 1 (b). The dynamics of the considered system is modeled using a set of coupled nonlinear partial differential equations. A reduced-order model is generated by modal decomposition transforming the equations of motion into a finite degree-of-freedom system. Then, the method of multiple scales is used as a direct attack of the resulting equations while assuming the dominance of the first bending mode for each cantilever. This permits deriving the phase and amplitude modulation equations.

For instance, we consider the case of two coupled cantilevers. The variation of the natural frequency of the first bending mode of each beam with respect to the DC voltage is presented in Figure 2 (b). The internal resonances 2:1 and 3:1 between the two cantilevers are possible for particular values of V dc given by the intersection points of the corresponding curves. Figures 3 and4 display simulated frequency-response curves of the considered device for 3:1 IR and two set of design parameters. Remarkably, the model enables the capture of the transition from softening to hardening behavior for the second cantilever.

Ω 1 Ω 2 3Ω 2 2 Ω 1 7Ω 1 Ω 3 Ω 1 0 (1.23;0) (0.55;21.17) Ω 2 7 Ω 1 Ω 3 =3Ω 2 2 Ω 1 (1.02;61.62) 0.5 1.0 1.5 2.0 V dc V 10 20 30 40 50 60 Ω n (a) Ω 1,2 3 Ω 1,1 Ω 1,2 2 Ω 1,1 (1.06;7.5)
(1.15;7.5)

Ω 1,1 0 (1.23;0) Ω 1,2 2Ω 1,1 3Ω 1,1 Ω 1,1 0.5 1.0 1.5 2.0 V dc V 5

CONCLUSION AND PERSPECTIVES

A simple electrostatic actuation of a nano-beam can provoke progressively the oscillation of several coupled nonlinear cantilevers due to internal resonances. This effect can be beneficial for multi-mass detection by providing a perfect control of the synchronization via the mechanical coupling between the cantilevers.

Cantilever

Figure 1 :

 1 Figure 1: (a) A single nanocantilever electrostatically actuated. (b) An array of N nanocantilever beams. Only the first cantilever is excited by the electrode and l N = r * l 1 with r > 1.

Figure 2 :Figure 3 :

 23 Figure2: (a) Variation of the dimensionless natural frequencies of the first three bending modes for a single nanocantilever with respect to the driving voltage V dc . 7:1 and a combinational (ω 3 = 3ω -2ω 1 ) IR are identified. (b) Variation of the natural frequencies of a two-beam system with respect to the driving voltage V dc . 2:1 and 3:1 IR are identified.

Figure 4 :

 4 Figure 4: Variation of the modal amplitude a 1,i of each cantilever with respect to the detuning parameter σ in the case of 3:1 IR, for V ac = 10 mV , r = 4.5, l 1 = 3 µm, b = 200 nm, h = 110 nm and g = 120 nm. The quality factor is Q = 10000 and the coupling parameter is d = 0.5.


S Zghal

M-L Bouazizi
email: lamjed.bouazizi@ipein.rnu.tn

R Nasri

N Bouhaddi Compdyn

N Bouhaddi

REDUCTION METHOD APPLIED TO VISCOELASTICALLY DAMPED FINITE ELEMENT MODELS

Keywords: Sandwich, Viscoelastic Materials, Finite Element Modeling, Guyan condensation, Dynamic Condensation

We propose in this paper to combine the GHM (Golla-Hughes-Mc Tavish) method with model reduction technique, especially direct condensation methods to resolve the problem of increased model order of viscoelastically structures. In fact, modeling structures using the GHM method leads to global systems of equation of motion whose numbers of degrees-offreedom largely exceeds the order of the associated undamped system. As result, the numerical resolution of such equations can require prohibitive computational (CPU) time. So, to overcome this problem, both Static and Dynamic methods are used to reduce the order of finite elements matrices while preserving its capability to represent the dynamic behavior of viscoelastically damped structures. This paper intends to compare these two methods in direct reduction. Numerical example applied to cantilever beam structure is presented. This example will highlight the domain of validity of the studied methods. Results obtained from these two reduction methods are compared with the full model in order to illustrate its performances and its practical interest in the dynamic analysis of viscoelastically damped structures.

INTRODUCTION

In the design of large industrial structures, the use of viscoelastic sandwich structures [START_REF] Salençon | Viscoélasticité, Presse des ponts et chaussés[END_REF][START_REF] Ferry | Viscoelastic properties of polymers[END_REF] can provide an effective means of vibration control. However, these structures are highly dependent on the viscoelastic materials properties, which depend strongly on the excitation frequency. Therefore, a correct modeling of the viscoelastic behavior is required for the analysis of such structures. One effective approach used to model the viscoelastic behavior is the Golla-Hughes Mc Tavish [START_REF] Mc-Tavish | Dynamics of viscoelastic structure-a time domain, finite element formulation[END_REF][START_REF] Mc-Tavish | Modeling of linear viscoelastic space structures[END_REF] model (GHM) which is based on the addition of internal or dissipative variables. This approach leads generally to largely dimension systems. Therefore, a model reduction should be applied to the augmented GHM model.

The present work presents an alternative two reduction methods for this problem. The first one is the Guyan condensation method [START_REF] Guyan | Reduction of Stiffness and Mass Matrices[END_REF][START_REF] Park | Model reduction of Viscoelastic finite element models[END_REF] which is applied to the structures through a partition of the equation of motion in term of master and slave coordinates leading to a static transformation whose coordinates are a subset of the original coordinates system. The second reduction is the dynamic condensation method [START_REF] Craig | Coupling of substructures for dynamic analyses[END_REF] in which some slave modes are retained and added to the Guyan static transformation leading to enriched basis. The reduced order models are compared in terms of accuracy, performance and computational efficiency for the cantilever beam structure.

GHM FINITE ELEMENT MODEL

The viscoelastic shear modulus is represented, in the GHM model, by a series of functions in the Laplace domain such that:

( ) 2 N s + 2ξ ω s G i i G s = G 1+ α i 0 2 2 i=1 s + 2ξ ω s + ω i i i     ∑     (1)
Where: G 0 is the static modulus; s is the Laplace complex variable; α i , ξ i , ω i are the parameters of the i mini-oscillator, and N G is the number of mini-oscillators. This leads to derive the equation of motion in term of structural dofs { } q and dissipative dofs { } z i which are defined as follows:

( ) { } ( ) { } 2 ω i z s = q s i 2 2 s + 2ξ ω s + ω i i i           (2)
After some manipulations and back to time domain, the following equation of motion in the Laplace domain is obtained:

[ ] [ ] [ ] [ ] K K q qz q(s) 0 0 M 0 f(s) 2 s + s + = T z (s) 0 D 0 M 0 z z K K i z qz                                                             (3)
Or in compact form:

{ }{ } { } 2 s M + s D + K q (s) = F (s) G G G G G             (4)
Where: [ ]

M G     ; D G     and K G     ℝ ,
M 0 0 α 0 1 0 K 0 v 2 ω 1 M = 0 0 G α N 0 G 0 0 K v 2 ω N G                                         ⋯ ⋮ ⋮ ⋱ ⋯ ; 0 0 0 2α ξ 0 1 1 0 K 0 v ω 1 D = 0 0 G 2α ξ N N 0 G G 0 0 K v ω N G                                       ⋯ ⋮ ⋮ ⋱ ⋯ ; [ ] 0 0 K + K -α K … -α K e v v v 1 N G T 0 0 -α K α K 0 v v 1 1 K = G 0 0 T 0 0 -α K … 0 α K v v N N G G ∞                                                                   ⋮ ⋮ ⋱ ; { } f F = G 0       ; { } i q q = G z       ; With: 0 K = G K v v 0           ; N G 0 K = K 1+ α v v i i=1   ∞       ∑          
are respectively, the static or low frequency stiffness matrix and the dynamic or high frequency stiffness matrix.

(

) 5
Consequently, the inclusion of dissipative coordinates increases the order of the differential equation of motion such that the structural degrees-of-freedom are least doubled. This increases the computational time of the system and motivates the use of reduction methods.

Models reduction procedures are used in order to reduce the GHM model dimension and his associated large computational times. This can be done based on the assumption that the exact responses given by the resolution of equation ( 4) can be approached by projections on a reduced vector basis as follows:

{ } [ ]{ } q = T q c G (6)
Where: [ ] T ℝ , is the transformation matrix formed column wise by a vector basis, { } q c ℝ , are the generalized coordinates, and NR≪ is the number of reduced vectors in the basis. The generalized coordinates representing the contribution of each column of [ ] T are chosen arbitrary in which the reduced model provides a reasonable predictive into the frequency bandwidth.

The reduced equation of motion can be written as follows:

[ ]{ } [ ]{ } [ ]{ } { } M q + D q + K q = f c c c c c c c ɺɺ ɺ (7)
Where

:[ ] M c ;[ ] D c and[ ] K c ℝ ,
are respectively the reduced mass, stiffness and damping matrices expressed as

follows: [ ] [ ] [ ] T M = T M T c G     ; [ ] [ ] [ ] T D = T D T c G     [ ] [ ] [ ] T K = T K T c G     ;{ } [ ] { } T f = T f c G
Two reduction methods are adopted regarding the computation of reduction basis: Guyan condensation and Dynamic condensation.

Guyan condensation method

Guyan condensation method [START_REF] Guyan | Reduction of Stiffness and Mass Matrices[END_REF][START_REF] Park | Model reduction of Viscoelastic finite element models[END_REF] is based to divide the displacements vector of structural dofs { } q into two subvectors:

{ } m q
ℝ , : Subvector of master dofs.

{ } s q

ℝ , : Subvector of slave dofs. With m + s = N being the order of the physical dofs of the viscoelastic structure and m≪ .

By neglecting the inertia and the external load associated to the first equation of motion [START_REF] Mc-Tavish | Dynamics of viscoelastic structure-a time domain, finite element formulation[END_REF], partitioning it into master and slave coordinates (or dofs), the reduced model is obtained with the Guyan transformation which can be expressed as: [ ]

I 0 1 T = t t 1 2 0 I 2             ℝ , -1 ss sm t = -K K q q 1             ℝ , -1 ss sm ss t = -K K K q qz qz 2             ,
In this case, the size of reduced mass, stiffness and damping matrices is NR= + .

Consequently, the reduced model have the follows dimension [ ]

M c ; [ ] D c and [ ] K c ℝ , .

Dynamic condensation method

This method [START_REF] Craig | Coupling of substructures for dynamic analyses[END_REF] consists to enrich the Guyan matrix transformation of some slaves modes obtained by the resolution of the slave eigenfrequencies problem as follows:

( ) { } i i ss ss K -λ M = 0 q φ         i=1,…..,s (8)
Where:

ss K q     and ss M   
 are respectively the slaves' structural stiffness and mass matri- ces.

[ ]

1 2 i s φ φ φ φ = ; 1 ( ,........., ) i s diag λ λ λ =
This base is trounced to p first slave modes

1 2 sp p φ φ φ φ   = 
 ℝ , (p ≪ ) which are re- tained and added to the static basis to enrich it. Thereby, the dynamic transformation can be expressed as follows:

[ ] sp I 0 0 1 T = t t 1 2 0 I 0 2 φ             ℝ , !! " (9)
In this case, the size of reduced mass, stiffness and damping matrices is NR= + +

. Consequently, the reduced model have the follows dimension [ ]

M c ; [ ] D c and [ ] K c ℝ ,
In this section, numerical application is presented to illustrate the main features of the used condensation strategy of viscoelastic sandwich structures. We consider one mini-oscillator ( =1) of viscoelastic cantilever beam which is constituted by two elastic layers (faces) in Aluminum and a viscoelastic layer (core) of the nuance ISD112. All the calculations are developed using the software MATLAB ® . The material and geometrical characteristics of the used structure are shown in Table1. The values of the parameters of the viscoelastic commercially available ISD112, manufactured by3M TM used at 27°C for one mini-oscillator are presented in Table 2. Thickness: h 9 = 0,127mm

Length: L=177,8mm Width: l=12,7mm The used FE mesh of the beam involves one element through the width and 20 elements along the length, containing in total 1000 dofs. The excitation point and the response point are selected at the extremity of the beam as shown in figure 1. The « blue » curve corresponds to the frequency response of the viscoelastic beam described by the frequency dependent GHM model and the « Magenta » curve is his associated undamped model in the frequency range of [0-1000] Hz. Indeed, these curves show a shift of both amplitudes and frequencies between the GHM rational model and his associated undamped model. This resulting first in dimuniation of amplitudes of 40% of the viscoelastic damped structure compared to his associated undamped structure. This is explained by the damping effect introduced by the GHM model form (1) as a series of mini-oscillators while the associated undamped model is described by a static modulus

( )

G ω = 0 = G 0 which does not take account this effect. In second time, the shift of frequencies between the two models allows to determine the natural frequencies (which cannot determine The frequency response of the rational model ( 1) and the developed model ( 3) are confused. This leads to conclude that these two models are equivalent. They are used as reference in the modeling of the viscoelastic sandwich beam. The interest here is to verify the accuracy and the performance of the direct condensation methods applied to viscoelastically damped structure by comparing both Guyan static condensation and Dynamic condensation methods.

The first test is intended to evaluate the Guyan condensation method by using T 01 base which contains the static modes; T = Θ 01 0     (1000×520), with m=20 dofs and s=480 dofs.

Then, the dynamic condensation method is tested by using T 02 and T 03 bases which are obtained by enriched the static base by some slave modes. For T of 50 slave modes. Figure 4 (a), (b) and (c) shows the frequency responses computed by using three reduction bases> *) ; > *? ; > *5 and compared to the amplitude of the response of the reference full model in the frequency band of interest [0-1000] Hz. As can be clearly seen, the accuracy is continuously improved upon successive enrichment of the reduction basis by the inclusion of 10 slave modes and 50 slave modes for > *? ; > *5 respectively. This leads to confirm that the use of dynamic condensation is sufficient to represent with good accuracy the dynamic behavior of viscoelastic sandwich structure.

1 sp T = Θ 02 0 φ     (
Table 3 provides the comparison between the time computation of full model and Guyan and dynamic condensation methods using> *) ; > *? ; > *5 .It shows that the use of enrichment basis > *? ; > *5 take a little bit more time of computing FRF than the use of static base > *) but make a drastic reduction which up to 90% with > *? and 87% with > *5 compared to full model. Moreover, one can take advantage of dynamic condensation method which combines the compromise of accuracy and time performance leading to a drastic reduction for the structures incorporating viscoelastic materials. The interest now is to compare the performance and the accuracy of the Guyan condensation method and the dynamic condensation method for the same order of both transformations. Indeed, we construct a Guyan transformation matrix with master dofs and slave dofs, having the same size with the dynamic transformation base> *5 . We consider > ABCD => *5 (1000×570), in the frequency band of interest [0-1200] Hz.

Model

Figure5: FRFs for the full and the reduced systems-Guyan condensation/Dynamic condensation Figure 5 shows the FRFs responses of the viscoelastic sandwich beam for the Guyan condensation method and the dynamic condensation method compared with those of full model. It can be seen that the frequency response of the dynamic condensation stick with of full model more than which is derived from Guyan condensation. The observed differences between the two direct condensation method lead to conclude that the Guyan condensation basis is not capable of overall accurately representing of the dynamic behavior of viscoelastic sandwich structures compared to the dynamic condensation method which gives satisfactory significant more accurate prediction. In fact, the static method is limited by a certain frequency called cutoff frequency which defines the domain of validity of the method and from which the results are not acceptable. For this example the cutoff frequency is around 1000 Hz. This result confirms that the use of dynamic condensation method is more efficient to represent with good accuracy the dynamic behavior of viscoelastic sandwich structures.

Finite element modeling procedures of structures incorporating viscoelastic materials are able to reproduce the FRFs responses before and after reduction was implemented, with emphasis placed on the GHM model and the implementation of two model order reduction methods: the Guyan condensation method and the dynamic condensation method.

An academic example derived from the industrial interest for the viscoelastic sandwich structures was used to illustrate the efficiency and the performance of these methods for predicting the dynamic behavior of these structures. The obtained results demonstrated the effectiveness of the two condensation strategy mainly in terms of the drastic reduction of the whole number of dofs and CPU time's computations.

  are respectively the mass, damping and stiffness matrices of viscoelastic GHM model with = × (1 + ) and is the dimension of structural dofs (size of{ } q ).

  # $ = 9,6 × 10 )* Pa Poisson ratio: + $ = 0,3 Density :ρ -= 2766Kg. m 45 Thickness: h -= 1,524mm Shear modulus: GHM modulus (1) Poisson ratio: υ 9 = 0,49 Density :ρ 9 = 1600Kg. m 45

Figure1:

  Figure1: Illustration of the FE model implemented for the Clamped-Free (C-F) viscoelastic beamThe response of the damped GHM model (described by rational fraction) and his associated undamped model of the beam under a harmonic excitation are presented in figure2.

Figure2:

  Figure2: FRFs of GHM damped model and his associated undamped model of the viscoelastic sandwich beam

  Figure3: FRFs for the rational and the developed GHM model of the viscoelastic sandwich beam

Figure4:

  Figure4: FRFs for the full and the reduced systems by using > *) (a), > *? (b), > *5(c)

  , the static Guyan transformation is enriched by 2 sp

Table 1 :

 1 Material and geometrical properties of the used sandwich structures[START_REF] Bilasse | Modélisation numérique des vibrations linéaires et non linéaires des structures sandwiches à âme viscoélastique[END_REF]

	Model GHM (i=1)	Value
	: ;	4.8278
	< ;	28045
	= ;	22.013
	# * [MPa]	0.1633
	Table2. Parameters of the GHM viscoelastic model identified for material ISD112 3M TM for one mini-oscillator

Table 3 :

 3 Times evaluations of full and reduced methods.


K Khelifi

M.-L Bouazizi
email: lamjed.bouazizi@ipein.run.tn

R Nasri

N Bouhaddi

on Structural Dynamics and Vibroacoustics Marrakech (Morocco) Vibration pumping of mdof structures using optimised multiple dynamic absorbers

Keywords: Energy pumping, dynamic absorber, Cubic non-linearity, nonlinear energy sink, tuned mass damper, Optimisation

The concept of energy pumping is an innovative dynamic phenomenon; it gives rise to new generation of dynamic absorbers. Theoretical studies and feasibility tests are necessary for better understanding of their dynamic behaviour and to be applied on real structures or machines. In this paper, numerical evidence is firstly given for the passive and broadband targeted energy transfer in the case of a linear system under shock excitation with Multiple Dynamic Absorbers or Nonlinear Energy Sink (NES). Secondly, it is shown that many NES absorb shock energy in only way and dissipate this energy locally, without "spreading" it returns to the linear system. The numerical results of optimisation in the case of NES linked to a linear beam are compared to Tuned Mass Dampers (TMD) linked to the same beam.

INTRODUCTION

The phenomenon of energy pumping is an irreversible transfer of energy from a main structure to a secondary structure, as dynamic absorbers called nonlinear Energy Sink (NES) are linked to the main structure. In previous works [START_REF] Georgiades | Dynamics of a linear beam with an attached local nonlinear energy sink[END_REF][START_REF] Vakakis | Dynamics of linear discrete systems connected to local,essentially non-linear attachments[END_REF][START_REF] Vakakis | Non-linear dynamics of a system of coupled oscillators with essential stiffness non-linearities[END_REF], it has been shown that essentially nonlinear oscillators attached to linear discrete structures that act as broadband passive absorbers of vibration energy.

Particularly, it has been shown that transient resonance captures of the transient dynamics may initiate one way, irreversible targeted energy transfer from a linear (main) subsystem to a local essentially nonlinear attachment, which acts, in essence, as nonlinear energy sink (NES). In this work, we propose to optimise the portion of energy damped by the linear and nonlinear dampers linked separately to a beam. The design parameters to optimise are mass ratio, linear and nonlinear stiffness and damping ratio of the dynamic absorbers. For this multi-objective optimisation we calculate the Pareto solutions using NSGA algorithm (Non-dominated Sorting Genetic Algorithm) [START_REF] Bouazizi | Robust optimisation of the non-linear behaviour of a vibrating system[END_REF][START_REF] Bouazizi | Multi-objective optimization in dynamics of the structures with nonlinear behaviour: Contributions of the metamodels[END_REF].

DYNAMIC EQUATIONS OF MOTION OF MDOF SIMPLY SUPPORTED BEAM

The studied structure consists of an impulsively forced simply supported damped linear beam, comporting multiple dynamic absorbers (Figure 1). This system was introduced in [START_REF] Georgiades | Dynamics of a linear beam with an attached local nonlinear energy sink[END_REF] with only one NES. The beam finite element model is based on the Euler-Bernoulli theory.

( ) ( ) ( ) ( ) ( ) [ ] ( ) ( ) ( ) ( ) ( ) ( ) [ ] ( ) ( )          = =       ∂ ∂ - + - + - =         -             - ∂ ∂ + - + ∂ ∂ + ∂ ∂ + ∂ ∂ ∑ = n i t t d
i i i i n i i i i i i ...... 2 , 1 0 , v , ) ( v ) ( v v , v , , , , i 3 i i 1 i 3 i 2 2 4 λ δ δ λ ρ λ (1)
The finite element model for the beam with NES is written as follow:

( ) ( ) ( ) ( ) ( ) My t By t K y y t F t + + = && & (2)
Where , M K and B are respectively the mass, stiffness and damping matrix.

The energy dissipated by the NES and the TMD at time t is defined by the ratio:

( ) ( ) ( ) ( ) ( ) ∫ ∫ ∑ = = = = = T a x t n i d x i inj TMD NES d F d E t E t i 0 0 1 2 / v y - v τ τ τ λ η
Where F , i λ , v & and y & represent respectively the impulse force, damping ratio and the velocity at

OPTIMISATION STUDY

In this section, we propose the multi-objective optimisation of the linear and nonlinear dynamic dampers (TMD, NES). The NSGA genetic algorithm is used to explore the design space and exploit the whole solution of the Pareto front [START_REF] Bouazizi | Robust optimisation of the non-linear behaviour of a vibrating system[END_REF]. For this study the multi-objective optimisation is defined in the following form:

[ ] 1 ( 1) , , , 1, 2 , ... ( 2 )
i i i i n i i M a x F w h e r e x m k C i n x m M in F M x η λ =  = ∈ =      =    ∑ (6)
Where , , ,

i i i i m k C
λ are the coefficient of the mass, damping and stiffness of the TMD or the NES; M is the primary structure mass.

Optimisation of the beam with two TMD

In the first case of this optimisation, we consider the beam defined in section2. The parameters of the two TMD are identical: . Then, we examine the influence of variation of the optimum values of stiffness and damping ratio. The figure2 illustrates this variation. We note that a variation of 3% of opt k and opt λ leads to a variation of 0.03% of 1 F . This low variation shows that the optimal Cost-Function is robust to dissipate the vibration energy of the beam

Optimization of the beam with two NES

In this section, we consider the same beam with a two NES at different locations (Fig. 1). The following parameters of the two NES are identical: . We consider the same variation levels of the design parameters defined in the previous section except that the variation of C is 50% . As a results, the maximum of 1 F is 95% for 2 0.2

F kg =
and the optimum value obtained by optimisation of design parameters are: C λ ) by variation of 3%. We note that the variation of opt C and opt λ for this percentage ( 3%) causes a small variation of 0.04% of the cost-function 1 F . So, these optimum values are robust to dissipate the maximum of energy from the beam. Then, we examine the efficiency of two NES to dissipate the shock energy before and after optimisation by varying its location on the beam. Figure3b illustrates the energy ratio dissipated by two NES for different positions on the beam. We note that this ratio reaches 95.40% after optimisation with two positions 1 0.2 d m = and 2 0.8 d m =

, whereas before optimisation this ratio is 91% η = . As a conclusion, the variation of the position of the two NES affects its efficiency on the middle of the beam and we note that the two NES design are more efficient than two TMD design.

CONCLUSION

In this paper, we present a multi-objective optimisation of the dynamic absorbers (TMD and NES). In the first step of optimisation, we consider beam with two TMD the dissipated energy ratio after optimisation is 85%. On the other hand, this ratio reached 95% in the case of the beam with two NES. The robustness study with two TMD and two NES shows that the variation of the design parameters around the optimal values does not affect the dissipated energy ratio. Finally, the variation of the position of the two TMD and two NES affects its efficiency on the middle of the beam.

Figure 1 .

 1 Figure 1. Simply supported beam with Multiple Dynamic Absorbers

  of the NES and TMD).

  variation levels of the design parameters are 20% for ( , m k ) and 90% for λ . As a results the maximum of the 1

Figure 2 .Figure 3 :

 23 Figure 2. Variation of dissipated energy ratio in two TMD: -(a) variation of stiffness -(b) variation of damping ratio Finally, we examined the efficiency of the two TMD to dissipate the energy with different locations d before and after optimisation. Figure3a shows this variation, we note that the energy ratio absorbed by the two TMD before optimisation is 89% η = and after optimisation it becomes 78% η = at two locations of TMD : 0.2 d m = and 0.8 d m = .

  examine the robustness of the optimum values ( , opt opt

& & & &

& & &(5)


Rima Belguechi

Estelle Cherrier

Christophe Rosenberger
email: christophe.rosenberger@ensicaen.fr

How to Evaluate Transformation Based Cancelable Biometric Systems? (

I. INTRODUCTION

The concept of cancelable biometrics has been defined for the first time in the pioneering article [START_REF] Ratha | Enhancing security and privacy in biometrics-based authentication system[END_REF]. It is aimed at enhancing privacy protection and template security, as detailed in the recent reference [START_REF] Jain | Biometric template security[END_REF]. Two main approaches can be distinguished dealing with cancelable biometrics. On the one hand, biometric cryptosystems or secure sketches, such as those presented in [START_REF] Juels | A fuzzy commitment scheme[END_REF], [START_REF] Daugman | Iris recognition and anti-spoofing countermeasures[END_REF], [START_REF] Uludag | Securing fingerprint template: fuzzy vault with helper data[END_REF], [START_REF] Chabanne | Optimal iris fuzzy sketches[END_REF], [START_REF] Bringer | An application of the Goldwasser-Micali cryptosystem to biometric authentication[END_REF], [START_REF] Barni | A privacy-compliant fingerprint recognition system based on homomorphic encryption and fingercode templates[END_REF], resort to cryptography. On the other hand, we find feature transformations approaches. The BioHashing algorithm is one of the most popular technique and is based on biometric data salting. It has been developed for different biometric modalities such as those presented in [START_REF] Teoh | Biohashing: two factor authentication featuring fingerprint data and tokenised random number[END_REF], [START_REF] Belguechi | Biohashing for securing minutiae template[END_REF], [START_REF] Saini | Soft biometrics in conjunction with optics based biohashing[END_REF]. In order to validate their proposition, authors generally provide some experimental results based on performance evaluation (EER value, ROC curves, etc.) and sometimes through a security analysis by considering different scenarios [START_REF] Scheirer | Cracking fuzzy vaults and biometric encryption[END_REF]. None standard methodology has been defined in order to qualify these privacy by design biometric systems [START_REF] Solove | Understanding privacy[END_REF] even if some previous research works have been proposed recently [START_REF] Nagar | Biometric template transformation: A security analysis[END_REF].

We intend in this paper to clearly define the properties that are requested for the evaluation of cancelable biometric systems, and we propose different attacks that can be simulated to assess how the targeted system fulfills these properties. The plan of the paper is the following. Section 2 first gives an overview of definitions. We then list security and privacy properties in the state of the art for the evaluation of cancelable biometric systems. We present different attacks from the impostor point of view in order to assess the previous properties. Some measures are also given to complete this security and privacy analysis of a transformation based cancelable biometric system. We conclude and give some perspectives in section 4.

II. DEFINITIONS AND PROPERTIES

In the sequel, we focus on BioHashing since some weaknesses have been reported in the former approach in [START_REF] Kong | An analysis of biohashing and its variants[END_REF], [START_REF] Lumini | Empirical tests on biohashing[END_REF], [START_REF] Simoens | Privacy weaknesses in biometric sketches[END_REF]. We suppose having a biometric modality where the template is represented by a vector of real values (it can be generalized to any representation like a map of interested points).

We use the following notations like in the paper [START_REF] Nagar | Biometric template transformation: A security analysis[END_REF]. Let b z and bz represent the template and query biometric features of user z, respectively. Let f be the feature transformation function. We denote n the dimension of the f (b z ) biocode for user z. Let K z be a set of transformation parameters corresponding to user z. Let D O denotes a distance function between the biometric features in the untransformed (original) domain and D T be a distance function in the transformed one. The cancelable biometric system outputs a verification decision denoted R z if the distance between the reference biocode and query biocode is less than a threshold denoted as ǫ:

R z = 1 {D T (f (bz,Kz),f ( bz,Kz))≤ǫ} (1)
Very few works have been dedicated to the evaluation of such biometric systems in the literature [START_REF] Adler | Biometric system security, ser. Handbook of biometrics[END_REF], [START_REF] Zhou | Feature correlation attack on biometric privacy protection schemes[END_REF], [START_REF] Nagar | Biometric template transformation: A security analysis[END_REF]. The ISO/IEC 24745 "Information technology Security techniques Biometric information protection" defines the security properties of a biometric system, we use the same terms. Cancelable systems must fulfill several properties as also mentioned in [START_REF] Maltoni | Handbook of Fingerprint Recognition[END_REF]:

• Revocability/Renewability:

It should be possible to revoke a biometric template and to generate a new one from the original data. Given the biometric template of user z, through a transformation based cancelable biometric system, it is possible to compute one biocode f (b z , K z 1 ) given parameters K z 1 and to revoke it by computing f (b z , K z 2 ) with other parameters K z 2 . As only the reference biocode is stored, the revocability can be achieved easily.

• Performance:

The template protection shall not deteriorate the performance of the original biometric system. As the performance is related to the security of the authentication process (e.g., minimizing the number of false acceptance), a cancelable biometric system must be as efficient as possible. For transformation based cancelable biometric systems, the seed (contained in K z for user z) can be seen as an a priori information (or a secret key). For this reason, a gain of performance is expected. To assess the efficiency of a biometric system (without any transformation), we generally consider two error metrics:

F RR O (ǫ) = P (D O (b z , bz ) ≤ ǫ) (2) F AR O (ǫ) = P (D O (b z , bz ) > ǫ) (3)
Where F RR O is the false reject rate and F AR O is the false accept rate of the original biometric system (without any template protection). For a transformation based cancelable biometric system, we consider the two following metrics:

F RR T (ǫ) = P (D T (f (b z , K z ), f ( bz , K z )) ≤ ǫ) (4) F AR T (ǫ) = P (D T (f (b z , K z ), f ( bz , K z )) > ǫ) (5)
Where F RR T is the false reject rate and F AR T is the false accept rate of the cancelable biometric system (with template protection).

• Non-invertibility or Irreversibility: From the transformed data, it should not be possible to obtain enough information on the original biometric data, to prevent any attack consisting in forging a stolen biometric template (as for example, it is possible to generate an eligible fingerprint given minutiae [START_REF] Cappelli | Fingerprint image reconstruction from standard templates[END_REF]). This property is essential for security purposes. For any attack, an impostor provides an information in order to be authenticated as the legitimate user. The success of the attack is given by:

F AR A (ǫ) = P (D T (f (b z , K z ), A z ) ≤ ǫ) (6)
Where F AR A is the probability of a successful attack by the impostor for a decision threshold set to ǫ. The A z biocode is computed by the impostor by taking into account as much information as possible within different contexts.

• Diversity or Unlinkability: It should be possible to generate different biocodes for multiple applications, and no information should be deduced from the comparison or the correlation of different realizations. This is an important property for privacy issues as it avoids the possibility to trace an individual based on the authentication information. Let be

B z = {f (b z , K z 1 ), .., f (b z , K z Q
)} a set of Q generated biocodes for user z and K z i the set of parameters for user z for the ith revocation, it shall constitute a random sub-sampling of {0, 1} Q . This property prevents also the linkage attack consisting in using different biocodes of an user to predict an admissible one. This is related to an attack consisting in for an impostor to listen different realizations of biocodes for the same user.

These properties are well known and often cited in papers from the state of the art. We go further in this paper: given a cancelable biometric system, how can we verify if these properties are fulfilled ? Is it possible to quantify the risk associated to the feasibility of an attack limiting one of these properties ? We propose in the next section some measures and attacks to answer these two questions.

III. SECURITY AND PRIVACY ANALYSIS

Based on some of the early works [START_REF] Ratha | Enhancing security and privacy in biometrics-based authentication system[END_REF], [START_REF] Bolle | Biometric perils and patches[END_REF] which identified weak links in each subsystem of a generic authentication system, some papers considered the possible attacks in cancelable biometric systems (such as those presented in [START_REF] Teoh | Cancellable biometrics and annotations on biohash[END_REF], [START_REF] Jain | Biometric template security[END_REF], [START_REF] Nagar | Biometric template transformation: A security analysis[END_REF], [START_REF] Saini | Soft biometrics in conjunction with optics based biohashing[END_REF]). We follow the Shannon's maxim ("The enemy knows the system"), we so assume that the impostor has all necessary information on the process used to generate the biocode (feature generation method, biocode size...).

Note that the following study requires that the decision threshold ǫ to be fixed. In this paper, we set the decision threshold ǫ EER T to the EER value of the cancelable biometric system (without any template protection). Even if this functioning point of the biometric system has no operational meaning, it is often used and can always be estimated. Different other values can be used for ǫ depending on the security requirements of the application. In order to quantify the robustness of the studied cancelable biometric system, we suppose having a biometric database with multiple biometric samples for each user. Some samples permit to generate the biometric template of each user while the others are used for the tests. We detail below how we quantify if the properties previously mentioned are fulfilled: eight criteria are described below. For each criterion, a value A i ∈ [0, 1], i = 1, . . . , 8 is computed on the BioHashing scheme (there is at least one criterion for one required property). These risk values will be gathered in an eight-dimensional vector to characterize the evaluation of the studied cancelable biometric scheme.

The security and privacy analysis can be done for the two classical steps in biometrics. We first focus on an authentication problem (one against one matching): we develop different attack scenarios that an intruder would manage to impersonate a particular genuine user. In a second step, the identification (one against many matchings) problem is considered. In this case, the impostor tries to impersonate one of the individuals in the database.

A. Authentication 1) Performance (A 1 ):

To verify if the efficiency is not decreased by using the template protection scheme, we propose to compute the following measure:

A 1 = 1 - AUC(FAR T , FRR T ) AUC(FAR O , FRR O ) (7)
where AU C denotes the area under the ROC curve for both systems. Many cases are interesting to consider.

First, it may happen that A 1 = 1 meaning that the cancelable biometric system provides a perfect performance (without any error or EER = 0%).

Second, if the value A 1 is negative, it means that the efficiency of the biometric system is deteriorated by the template protection scheme. Otherwise, the scheme improves performance as expected.

2) Non-invertibility or Irreversibility (A 2 to A 5 ): This essential property can be evaluated through different attacks. For all these attacks, we use one or multiple biometric samples to generate an admissible query bz of the user z. Based on the principle of each attack, we generate many fake attempts A z of the genuine user (as described in equation 6):

• Zero effort attack (A 2 ): an impostor user x provides its biometric feature bx and parameter K x to be authenticated as the user z :

A z = f ( bx , K x )
• Brute force attack (A 3 ): An impostor tries to be authenticated by trying different random values of A: A z = A

• Stolen token attack (A 4 ): An impostor has obtained the token K z of the genuine user z and tries different random values b to generate:

A z = f (b, K z )
• Stolen biometric data attack (A 5 ): An impostor knows bz (directly or after computation of the feature on a biometric raw data) and tries different random numbers K to generate:

A z = f ( bz , K)
To evaluate the efficiency of these four attacks, we propose to compute for each of them, the following criteria:

A i = FAR A (ǫ EERT ), i = 2, . . . , 5 (8)
Indeed, from the impostor point of view, the FAR is the relevant value: the intruder has to generate f ( bz , K z ) using different available data (K z , bz . . . ). Recall that the threshold has been fixed to the value ǫ EER T (obtained by computation of the EER of the cancelable biometric system).

From the impostor's point of view, the values A i , i = 2, . . . , 5 must be as high as possible.The obtained value for each attack A i , i = 2, . . . , 5 allows us a ranking of the different attacks and directly gives the risk for the system that an impostor can be authenticated as a genuine user.

3) Diversity or Unlinkability (A 6 to A 8 ) :

A prominent feature of a cancelable biometric system is its ability to produce different biocodes for the same individual and for different applications. The first criterion we want to assess concerns the unlinkability property for privacy issues.

• Mutual information of biocodes:

In order to measure the diversity property in this case, we propose to compute the mutual information provided by several biocodes issued from same biometric data as defined in (9):

I(X, Y ) =
x y P (x, y) log( P (x, y) P (x)P (y) )

where X and Y are two random variables and P the estimation of the probability. In order to measure the diversity property, we quantify the highest value of the mutual information among different biocodes for each individual. The value A 6 is then computed using the average value for all users of the highest value of mutual information, according to equation 10: The second criterion we want to assess concerns the unlinkability property for security issues.

A 6 = 1 N z M j=1 max(I(f (b z , K z ), f (b j z , K z ))) (10) Where:
• Listening attacks: An impostor must not be able to extract any information from different biocodes issued from the same user. Since biocodes can be revoked, an impostor can intercept Q of them and issue a new biocode by predicting an admissible value (as for example by setting each bit to the most probable value). These attacks are tested given by the following process:

-Generation of Q biocodes for user z:

B z = {f (b z , K z 1 ), .., f (b z , K z Q )}
-Prediction of a possible biocode value by setting the most probable value of each bit given B z , -Computation of equation [START_REF] Jain | Biometric template security[END_REF]. ⇒ A 7 value for Q = 3 and A 8 for Q = 11

Of course, more complex prediction methods of the biocode given B z could be proposed. This is one perspective of this work. An evolution of the efficiency of this attack (depending on the evolution of Q) may be used to predict how many interceptions are necessary for the intruder to achieve an authentication.

These criteria allow us to quantify the robustness of cancelable biometric verification systems.

B. Identification

For identification, the properties are the same but the criteria computation are slightly different. First, the values A i , i = 1, 6 are the same for the authentication and identification contexts. Concerning the non-invertibility and irreversibility properties, equation ( 6) must be modified to:

F AR A (ǫ) = max z P (D T (f (b z , K z ), A z ) ≤ ǫ) (11)
Indeed, in the identification case, the impostor tries to impersonate all individuals in the database. Attacks are similar but quantified in a different way. The computation of A i , i = 2 : 5, 7 : 8 is realized considering equation 11.

As a conclusion of the proposed methodology, the security and robustness of a cancelable biometric system are characterized by an eight-dimensional vector (A i , i = 1, . . . , 8). The key benefit of this quantitative presentation is to allow easily the comparison of cancelable biometric systems.

IV. ILLUSTRATIONS

We illustrate this methodology on two biometric modalities for an authentication application: Finger knucle print and fingerprint. We use generic features based on Gabor filtering on the raw images. We obtain 128 parameters (16 scales, 8 orientations) for each image. We use a single enrollment process for both biometric systems. Without any template protection, we compute a simple distance (measured with the Minkowski's one) between the reference template b z and bz for each user z. Of course, these biometric systems are far to be the best in the state of the art, they can be seen as generic systems. In this study, we are interested in quantifying the robustness of these systems with template protection using the classical BioHashing process (size of the biocode: 128 bits).

In this paper, we use two biometric benchmarks:

• PolyU FKP Database [START_REF] Lin Zhang | Finger-knuckle-print verification based on band-limited phase-only correlation[END_REF]: 4 fingers of 165 volunteers, each individual has provided 12 images acquired during 2 sessions, • FVC2002 benchmark [START_REF] Maio | Fvc2002: Second fingerprint verification competition[END_REF] dB3: composed of 8 fingerprints (resolution 355 x 390 pixels) for 100 individuals.

Table I presents the values of the different criteria A i , i = 1..8 describing the robustness of the studied cancelable biometric systems. These results correspond to the average value of each criterion for 10 tries. It is not possible to compare results from these two biometric systems as the used benchmarks are different. But, it is possible to quantify which attack is the most efficient.

First, we remark that the protection scheme as expected increases the performance of the two biometric systems (A 1 > 0). For the fingerprint modality and for this benchmark, we obtain an EER value equals to 0%. Using fingerprints, none attack is efficient. If the threshold is set to a higher value, all attacks would be efficient (as it can be seen in Figure 1). It is interesting to notice that the less efficient attack is the one using the less a priori information (brute force). The most efficient attacks (represented by a curve the most on the left) are the stolen token and listening (N=11) ones. As the performance of the cancelable biometric system using finger knuckle print is lower, the threshold value to obtain the EER is higher. In this case, all attacks are possible with the highest value of the risk equals to 59%. That shows the importance of the setting of the threshold value for efficiency but also for security and privacy reasons.

V. CONCLUSION AND PERSPECTIVES

We propose in this paper a new methodology to quantify how security and privacy properties of a cancelable biometric system are verified. Eight criteria are proposed to quantitatively measure the robustness properties detailed in this paper. They allow a rigorous comparison of cancelable biometric systems. The key benefit of the retained quantitative-based approach is to easily allow the comparison of new cancelable biometric systems. The perspectives of this work are to compare the obtained results with the assessment of expert in biometrics for the privacy analysis of different cancelable biometric systems. We think also on new attacks and on more sophisticated approaches to generate a fake biocode given all the known information.

-

  b z : denotes the biometric template of the individual z in the database, -b j z : denotes the j th biometric query of the individual z in the database, -N : the number of individuals in the database, -M : the number of generated biocodes for each individual, -P : the estimation of the probability.

A

Fig. 1 .

 1 Fig. 1. Evolution of the efficiency of attacks for both biometric systems: (a) Fingerprint, (b) Finger knuckle print

TABLE I EVALUATION

 I RESULTS OF THE CANCELABLE BIOMETRIC SYSTEMS.

		1	A 2	A 3	A 4	A 5	A 6	A 7	A 8
	Fingerprint	1.0	0	0	0	0	0.4384	0	0
	Finger Knuckle print 0.1035	0.2473	0.4003	0.5368	0.3730	0.5834	0.5145	0.5908


Bruno Guillet

S H E N Gw

Sergio Ma C H O U R * ‡ ,C A R L Ob A R O N E †

Pagano

Jean-Marc Routoure
email: jean-marc.routoure@unicaen.fr

Uncertainties in the estimation of low frequency noise level extracted from noise spectral density measurements

It is well known that measurement uncertainty of noise spectral density is related to the time length of observation. With FFT spectrum analyzers, the measurement error can be reduced by averaging Navg measurements. Standard error is then reduced by the square root of Navg.T h i sp a p e rd e a l sw i t ht h e error introduced when one wants to extract from the noise spectral density measurement the 1/f level, white noise level and lorentzian parameters. In that purpose, different estimation techniques from different groups are compared and discussed.

I. Introduction

In this paper, several and different techniques used to estimate the extraction of 1/f noise level from a power spectrum analyzer are compared in terms of uncertainties. Each technique introduces different sources of error that can be quantified by the uncertainties u(Ei). The expanded uncertainty u with a coverage factor k is then given by u = k • i u(Ei) 2 [START_REF]BIPM : Guide to the expression of uncertainty in measurement[END_REF]. After a brief description of uncertainty estimation and the different ways used by the different groups to estimate the noise, the values of the uncertainty are given and discussed.

II. Uncertainty estimation

Different groups involved in this work performed several times the same analysis on two kinds of voltage noise spectral density data S V (f )( fi g u r e1 aa n db ) :

• spectrum A which mainly consists in white noise and 1/f noise with a corner frequency around 100 Hz (data obtained one oxide thin film),

• spectrum B with low frequency noise (1/f noise and several lorentzian spectra), white noise and a high corner frequency value close to 100 kHz (data obtained from advanced MOS transistors).

For each sp ectrum, several parameters have b een extracted: the white noise level W ,the1/fnoiselevelat1Hz K ,t h en u m b e ro fl o r e n t z i a nN L ,t h ep l a t e a ua i and the a:s p e c t r u mAf r o mo x i d et h i nfi l m characteristic frequency f i of each lorentzians according to the following equation:

S V (f )=W + K f + NL i=1 a i 1+ f fi 2 (1)
This extraction has been performed N times (here 7). In order to minimize memory effects which could bias the results by introducing some correlation, these extractions have been done using a quite long period between 2 consecutive estimations and without reading the previous extracted values. The different techniques used by the different group are described in the next section. Type A method (using statistical analysis of observation series) has then been used for the uncertainty estimation of the repetability error [START_REF]BIPM : Guide to the expression of uncertainty in measurement[END_REF] for each method : mean value (< X> )a n ds t a n d a r dd e v i a t i o n( σ X )o fe a c hp a r a m e t e rh a s then been calculated according to the following standard definitions :

<X>= N i=1 X i N and σ X = N i=1 (X i -<X>) 2 N (2)

III. Description of the different estimation techniques

From all the techniques p erformed by the different research teams, one can distinguish:

• manual estimation (noted Hand1 and Hand2) using al o g -l o gp l o to fe a c hs p e c t r ao n7d i ff e r e n ts h e e t s of paper. A design rule was used to estimate the different parameters. Hand1 method used log-log plot of the spectral density S V (f )w h e r e a sH a n d 2u s e d log-log plot of the spectral density normalized by the frequency S V (f ) • f ,

• comparison of measurements and computed values according to equation [START_REF]BIPM : Guide to the expression of uncertainty in measurement[END_REF]. The choice of the best fits is related to a human operator and not to a computer elaboration. Several plotting or computing softwares (named Labview, Mathcad and Gnuplot) were used.

In some softwares (Labview and Gnuplot), slides or cursors were available to improve the user interface.

For Mathcad, the same algorithm was used by two different persons (named Mathcad1 and Mathcad2),

• use of a decomposition algorithm [START_REF] Sassier | [END_REF] : the spectra are approximated with a linear combination of sample functions : one or several 1/f γi functions with 1 γi 2, and a family of Lorentzian functions with characteristic frequencies (f i )l o g a r i t h m i c a l l y distributed over the range of the studied spectrum. Once the sample functions are chosen, the linear combination of these functions which shows, on one hand, only positive coefficients and, on the other hand, the minimal distance to the approximated spectrum, is algebraically calculated. Since this approximation method is deterministic, repeating it several times cannot bring any further refinement. However, several calculation results are provided for each spectrum, obtained by varying in the sample functions family.

IV. Results and discussion

The results from the different techniques are plotted in the following figures for each parameters and each spectra.

The mean value of each parameters for all the techniques <X> assuming the same weight as well as errors bars showing the repetability error given by (2 or 3) • σ X of each techniques are also plotted. According to [START_REF]BIPM : Guide to the expression of uncertainty in measurement[END_REF], the probability to find the value in the range indicated by the error bars is equal to 95% when coverage factor k=2 and 98% when coverage factor k=3. It will then be assumed in the following discussion that the mean value gives a correct estimation of the real value of the concerned parameter. For one technique, when error bars do not cross this mean value line, it may be interpreted as a bias introduced by the technique. The case of the decomposition algorithm will be presented and discussed in a separated way. From all these results, several remarks and comments can be proposed : K and W parameters are often overestimated by manual techniques.

No lorentzians were observed for the spectrumA for all the technique. Up to three lorentzians were identified using the "software" techniques for the spectrumB. Only the results for the first two lorentzians are reported here. Only one lorentzian was observed for the manual techniques with a large value of uncertainty. The Lorentzians appear as bumps in the spectral density difficult to quantify or estimate with a right design rule.

Except manual estimations, all the parameter estimations performed by software techniques give almost the same result with the almost the same repetability. This remark is not true for the second lorentzian of the spectrum Bm a i n l yd u et oi t ss m a l l e s tw e i g h ti nt h et o t a ls pe c t r u m . The case of small repeatability uncertainty values for the manual technique in the case of the K parameter in spectrumB may be due to the fact that the value of K is close to a value close to the tick mark of the graph.

Acaseofspecialinterestistheerrorsintheestimationof the characteristic frequencies of lorentzians because when noise measurements are performed versus temperature, it allows to identify traps by using a method called "noise spectroscopy" (see [START_REF] Talmat | A s s e s s m e nt o f t e m p e r a t u r e d e p e n d e n c e o f t h e l ow f r c y noise in unstrained and strained FinFETs[END_REF] in this proceeding for instance). Whatever the software method used, 3 • σ f1 /<f 1 > is less than 27% and 3 • σ f2 /<f 2 > is less then 42%. Even if these values seems relatively high, when the noise spectroscopy method is applied, the characteristic frequency may vary over five decades of frequency ! fortunately, these relatively high uncertainty values may not thus affect the identification of the traps. The case of the decomposition algorithm is now discussed: for each spectra, three sample function families were used :

• Estimation 1 : the approximation is a linear combination of 21 functions 1/f γi with γi linearly distributed between 1 and 2, 101 Lorentzian functions with f i logarithmically distributed between 1 Hz and 100 kHz and the uniform function 1,

• Estimation 2 : the approximation is a linear combination of the function 1/f 2 ,the function 1/f, 101 Lorentzian functions with f i logarithmically distributed between 1 Hz and 100 kHz and the uniform function 1.

• Estimation 3 : the same as estimation 2 with 130 Lorentzian functions instead of 101 Only the components of the combination with positive non null coefficients have been reported. The main results are that no 1/f noise exists in the 2 spectra A and B. For spectrumA, only a 1/f 1.6 was obtained. For spectrumA, 6 lorentzians were reported and 7 lorentzians for spectrumB.

Finally, to compare the different techniques, a relative distance between the measured noise spectral density S V (f )a n dt h ea p p r o x i m a t e df u n c t i o n sS Vfit (f )h a sb e e n calculated according to the following definition :

d = f (S V (f ) -S V fit(f )) 2 (S V (f )) 2 (3)
The results are summarized in the following table. As expected, the decomposition technique gives the best results and worst results are obtained by manual estimation. The small differences between software techniques and the decomposition one validate these software techniques.

This study shows that two errors have to be introduced in the uncertainty calculation : the repetability error E1 (mainly due to the operator) estimated from σ X and a systematic error E2 (mainly due to the technique, resolution of software slides or design rule) estimated from the standard deviation of all the mean result for one parameter. Finally the expanded uncertainty u(K)= and 23% for spectrumB! The larger value obtained for spectrum B may be due to the difficulty to estimate this parameter in the case of lorentzians.

V. Conclusion

In this paper, the uncertainty in the estimation of noise parameters has been performed on two kinds of spectra. Bests results has been obtained by a decomposition algorithm. Relative expanded uncertainty between 10% and 20% has been obtained for the 1/f noise level of the 2 spectra.

This work should be completed by choosing several kinds of spectra with only 1/f noise and white noise with different corner frequencies to estimate the impact of the corner frequency on the expanded uncertainty of 1/f noise level. The impact of the number of acquisition N avg could also be study. We propose to make a large inquiry to investigate all these ideas. For that, we encourage you to use the following website to send suggestions, questions, comment and declaration of interest to a new investigation. http://www.greyc.ensicaen.fr/routoure/uncertainty.

Fig. 2 .

 2 Fig. 2. SpectrumA results for parameters K and W. <X>±2•σ X , <X>±3 • σ X and <X>for all the techniques.

Fig. 3 .

 3 Fig. 3. SpectrumB results for parameters K and W. <X>±2•σ X , <X>±3 • σ X and <X>for all the techniques.

Fig. 4 .

 4 Fig. 4. SpectrumB results for parameters a 1 and f 1 . <X>±2•σ X , <X>±3 • σ X and <X>for all the techniques.

Fig. 5 .

 5 Fig. 5. SpectrumB results for parameters a 2 and f 2 . <X>±2•σ X , <X>±3 • σ X and <X>for all the techniques.