Mohamad El-Abed
email: mohamad.elabed@ensicaen.fr

Romain Giot
email: romain.giot@ensicaen.fr

Baptiste Hemery
email: baptiste.hemery@ensicaen.fr

Christophe Rosenberger
email: christophe.rosenberger@ensicaen.fr

Evaluation of biometric systems: a study of users' acceptance and satisfaction

Keywords: biometrics, evaluation, users' acceptance and satsifaction, Kruskal-Wallis test, Bayesian networks, decision trees

This paper presents a modality-independent evaluation methodology to study users' acceptance and satisfaction of biometric systems. It uses a survey questionnaire for data collection, and some data-mining tools for their analysis. We have applied it on two biometric systems developed in our research laboratory. The results from this survey show the necessity of taking users' point of view when designing and evaluating biometric systems. A panel of 100 volunteers was more satisfied from the keystroke system than the face one. Users surprisingly considered that its perceived performance was also better, even if the used face system has a better performance with an EER of 8.76% than the keystroke one with an EER of 17.51%. The robustness of a system against attacks, computation time required during the verification phase and its easiness to use have been identified as important factors influencing their opinions regarding the tested systems.

Introduction

Biometrics is considered as a promising solution among traditional methods based on "what we own" (such as a key) or "what we know" (such as a password). It is based on "what we are" and "how we behave". Biometric authentication systems have many applications [START_REF] Jain | Biometrics: a grand challenge[END_REF]: border control, e-commerce, etc. The main benefits of this technology are to provide a better security, and to facilitate the authentication process for a user. Also, it is usually difficult to copy the biometric characteristics of an individual than most of the other authentication methods such as passwords.

Different biometric modalities have been proposed in the literature, which can be categorised into three kinds of modalities:

• biological • behavioural • morphological modalities.
Biological modalities are known to be the most expensive owing to the computation time, and the specific materials required to verify the user's identity. Performance of behavioural modalities provides a lower quality than the others because they depend a lot on user's feelings at the moment of the data acquisition: user may change his/her way of performing tasks owing to its stress, tiredness, concentration or illness. A survey of the literature on behavioural modalities is given by [START_REF] Yampolskiy | Behavioural biometrics: a survey and classification[END_REF]. Each modality has its own advantages and drawbacks. A previous work [START_REF] Mahier | Biometric authentication[END_REF] summarises a comparative study of biometric modalities in terms of universality, uniqueness, permanency, collectability, acceptability and performance.

Despite the obvious advantages of biometric systems, their proliferation was not as much as attended. To be used in an industrial context, the quality of a biometric system must be precisely quantified. We need a reliable evaluation methodology to put into obviousness the benefit of a new biometric system. Nowadays, several studies have been done in the literature to evaluate biometric systems. It is generally realised within three aspects as illustrated in Figure 1: [START_REF] Tabassi | A novel approach to fingerprint image quality[END_REF]. Using quality information, the bad-quality samples can be removed during enrolment or rejected during verification. Such information could also be used in soft biometrics or multimodal approaches [START_REF] Kryszczuk | Impact of combining quality measures on biometric sample matching[END_REF]. Such type of assessment is generally used to enhance the system performance, and could be used to quantify the quality of biometric sensors.

2 Usability: According to the international standard ISO 13407:1999 [ISO 13407:1999], usability is defined as "The extent to which a product can be used by specified users to achieve specified goals with effectiveness, efficiency, and satisfaction in a specified context of use".

• Efficiency, which means that users must be able to accomplish the tasks easily and in a timely manner. It is generally measured as a task time.

• Effectiveness, which means that users are able to complete the desired tasks without too much effort. It is generally measured by common metrics including completion rate and number of errors such as Failure-To-Enrol rate (FTE) as (ISO/IEC 19795-1, 2006).

• User satisfaction, which measures users' acceptance and satisfaction regarding the system. It is generally measured by studying several properties such as easiness to use and trust, etc.

3 Security: Measures the robustness of a biometric system (algorithms, architecture and devices) against attacks. Such type of assessment is important since several works in the literature (such as [START_REF] Ratha | An analysis of minutiae matching strength', Audio-and Video-based Biometric Person Authentication[END_REF] show the vulnerabilities of biometric systems.

Traditional evaluation methods have worked well to evaluate emerging technologies, new biometric modalities and algorithm revisions. Many databases have been collected (such as ENSIB face database [START_REF] Hemery | The ENSIB database: a benchmark for face recognition[END_REF]), many competitions (such as Fingerprint Verification Competition [START_REF] Maio | 1Fvc2004: third fingerprint verification competition[END_REF])) and platforms have been proposed (such as BioSecure [START_REF] Petrovska | Description and Documentation of the Biosecure Software Library[END_REF]) whose objective is mainly to compare enrolment and verification/identification algorithms in the literature. Many metrics have been defined by the International Organisation for Standardization (ISO/IEC 19795-1, 2006) in terms of error computations, time computation, memory allocations, etc. These statistical measures allow in general a precise performance characterisation of a biometric system. Nevertheless, these works are dedicated to quantify the system performance (algorithms, processing time, etc.) without taking into account user's view within the evaluation process. However, the biometric process is considered as a two-way interaction, between the user and the system. [START_REF] Jain | Biometrics: a grand challenge[END_REF] categorise the fundamental barriers in biometrics into three main categories:

• accuracy in terms of errors

• scale or size of the database

• usability in terms of easiness to use, acceptability, etc.

One government can decide that an individual would be identified through a biometric data embedded in the passport. For logical or physical access control in a company, it is more difficult to impose a system that would not be accepted by users. As for example, DNA analysis is one of the most efficient techniques to verify the identity of an individual or to identify him/her. Nevertheless, it cannot be used for logical or physical access control not only for time computation reasons, but also because nobody would be ready to give some blood to make the verification. Therefore, taking into account user's view when designing biometric systems is considered as a crucial requirement to the widespread of use of this technology.

Nowadays, there is a lack of a generic evaluation methodology that takes into account users' acceptance within the evaluation process, which constitutes one of the main drawbacks for biometric systems proliferation. To contribute to solve this problem, we propose in this paper a modality-independent evaluation methodology to study users' acceptance and satisfaction of biometric systems. Such kind of evaluation will:

• increase system performance [START_REF] Kukula | Effect of human-biometric sensor interaction on fingerprint matching performance, image quality and minutiae count[END_REF] • improve the accuracy of the optimistic results provided by biometric system designers in terms of errors (e.g., EER)

• reduce product complexity and increase user satisfaction [START_REF] Theofanos | Usability & Biometrics: Ensuring Successful Biometric Systems[END_REF].

The plan of the paper is organised as follows: Section 2 presents related previous research on users' acceptance and satisfaction of biometric systems. Section 3 presents the proposed evaluation methodology. We present in Section 4 the experimental results on two biometric systems developed in our research laboratory. Section 5 gives a conclusion and some perspectives of this work.

Background

The acceptability of biometric systems is affected by several factors. According to [START_REF] Smith | Humans in the loop: human computer interaction and security[END_REF], some members of the Human-Computer Interaction (HCI) community believe that interfaces of security systems do not reflect good thinking in terms of creating a system that is easy to use, while maintaining an acceptable level of security. Nowadays, several studies have been done to quantify users' acceptability and satisfaction of biometric systems such as: • The National Institute of Standards and Technology (NIST) has performed a usability test on fingerprints [START_REF] Theofanos | Usability Testing of Ten-print Fingerprint Capture[END_REF]. The survey was conducted on 300 adults recruited from a pool of 10,000 people. There were 151 women and 149 men ranging in ages from 18 to over 65 years. 77% of participants were in favour to provide fingerprint images as a mean of establishing identity for passport purposes. 2% of participants have expressed concerns about the cleanliness of the devices with which they would have physical contact. Another study has been done by NIST to examine the impact on fingerprint capture performance of angling the fingerprint scanners (flat, 10, 20 and 30 degrees) on the existing counter heights (99, 114.3 and 124.5 cm) as is presented in Theofanos et al. (2008a).

• Other studies presented in [START_REF] Deane | Perceived acceptability of biometric security systems[END_REF], [START_REF] Coventry | Honest it's me! self service verification[END_REF], [START_REF] Moody | Public perceptions of biometric devices: the effect of misinformation on acceptance and use[END_REF], [START_REF] Jones | Towards understanding user perceptions of authentication technologies[END_REF], [START_REF] Elliott | The perception of biometric technology: A survey[END_REF], [START_REF] Pons | Understanding user perspectives on biometric technology[END_REF], Giot et al. (2009b), [START_REF] Uzoka | An investigation of factors affecting biometric technology adoption in a developing country context[END_REF] and El Abed et al. ( 2010) have highlighted several points about biometrics such as:

• Acceptance is linked to the number of uses of the biometrics in general, and information provided by the biometric device can also improve user acceptance.

• There is a potential concern about the misuse of personal data (i.e., templates), which is seen as violating users' privacy and civil liberties. Another important concern is the probability that criminals may perpetrate heinous acts to gain access. This could include stalking or assaulting individuals to steal their biometric information.

• Individuals complain that once the biometric template is stolen, it is compromised forever.

• There are also concerns about hygiene with touching such devices and health risks for more advanced technologies such as iris or retina. According to our knowledge, no paper has emphasised physical harm to users of these systems. But despite of this, several concerns were highlighted along this interaction. Anecdotally, some users of biometrics have complained that hand geometry systems dry their hands, while military aviators participating in an experimental programme voiced concern that retinal scanning would damage their vision with extended use over time.

Most of the works done on evaluating biometric systems have focused on the performance aspect. Limited research has focused on usability issues relating to how users perceive and use biometric systems. However, most of the studies in this area are modality-dependent (such as the usability study presented by Theofanos et al. (2008a)). Hence, it could not be applied to any kind of biometric system. In addition, these studies are based on statistical answers to a questionnaire, but no mature data analysis is conducted for understanding respondents' answers to identify reasons. To contribute to solve this problem, we propose a modality-independent methodology that studies users' acceptance and satisfaction of biometric systems. As for us, taking into account users' point of view within the biometric process (hardware, software and instructional design) is not only beneficial to the end-users, but it will also help to improve the performance and effectiveness of a system.

Proposed method

The proposed methodology was designed to quantify users' acceptance and satisfaction when using biometric systems. To accomplish this objective, we developed a survey instrument for data collection. These kinds of surveys enable to gather information to be statistically analysed. The proposed methodology principle is as follows: It collects the data using a survey questionnaire (see Appendix). This step is followed by a pre-processing phase to extract the significant knowledge (Section 3.2). Then, the Kruskal-Wallis (KW) test [START_REF] Higgins | An Introduction to Modern Nonparametric Statistics[END_REF] is performed to determine if there is a significant relationship between demographic characteristics and respondents' answers (Section 3.3). Data-mining tools are used to explain these answers, to determine the reasons that influence their acceptance and satisfaction of biometric systems (Section 3.4).

Data collection

The first step of the proposed method consists of creating a satisfaction questionnaire. Existing works presented in Section 2 highlighted different important factors impacting their acceptance of biometric systems such as:

• Socio-demographic factors: Such as age and gender

• Learnability and memorability: They mainly concern how rapidly a user can use the system after instruction or training.

• Confidence or trust: Indicates how the performance of the system is perceived by users. It depends mainly on feedbacks from users and their experience.

• Easiness to use: Depends on the quality of the biometric sensor and the ergonomic interface. It may also depend on the time required for verification or identification. For example, if the biometric system takes several minutes between the acquisition of the required data and user identification, users may feel that the biometric system is not easy to use.

• Privacy issues: There is a potential risk concerning the misuse of the personal collected data, which is seen as violating user's privacy and civil liberties. Many debates have been conducted over the central storage of biometric templates vs. holding the personal template on a smart card where the verification is locally processed.

• Physical invasiveness: The acquisition of biometric data requires a user interaction with the biometric sensor. Depending on the used method, the acquisition of the biometric raw data is performed with or without contact with the biometric sensor.

• Cultural issues: The acceptability denotes the way how users perceive the biometric system and interact with it. Acceptability is highly dependent on the culture of users. As for example, cultures with an aversion to touch public surfaces would prefer to use biometric systems with contactless sensors (e.g., iris or palm veins).

The developed questionnaire (see Appendix) aims to extract these factors to study users' acceptance and satisfaction of biometric systems. It was designed to collect demographic, experiential and attitudinal characteristics that might have an impact on or a relationship to respondents' views on the use of biometrics.

The questionnaire was created owing to the results of extensive desk research presented in the literature. We took into account these studies and we added new questions to complete it. It also noted unsolicited questions that we found it valuable when collecting two biometric databases [START_REF] Hemery | The ENSIB database: a benchmark for face recognition[END_REF]Giot et al., 2009a) (both databases are publicly available to the biometric community), during the recent usability studies of biometric systems presented in previous works (Giot et al., 2009b;[START_REF] El Abed | A study of users' acceptance and satisfaction of biometric systems[END_REF], and the opinions of two experts working in the social psychology research topic. This help was important especially for the wording and ordering of the questions. Indeed, the question must be as neutral as possible to avoid bias answers. A 4-point Likert-type scale is used to evaluate respondents answers on the satisfaction questions. This scale requires for the respondent to make a positive or negative choice, which avoids to many neutral answers. The survey questionnaire contains 18 questions divided into two sets:

• General perception of biometric systems (Appendix, part B), which contains 7 questions aiming to understand users' experience on biometric technology.

• Perception of the tested system (Appendix, part C), which contains 11 questions aiming to measure users' acceptance and satisfaction of the tested system.

In addition to these questions, we request some information on the individual such as gender (Appendix, part A). These demographic characteristics are requested to determine if there are significant relationships between them and respondents' answers on biometric technology and the tested system. We also request the question 16 (Appendix, part C) to identify where the use of the tested system would be appropriate for the user.

Data pre-processing

Before analysing the pilot data, we use a technique to enhance the accuracy and the reliability of the extracted knowledge. It consists of deleting answers having a predefined number of questions without answers.

Respondent demographics analysis

To determine whether there is a significant relationship between demographic characteristics and respondents' answers on biometric technology and the tested system, we use the KW test. It is a non-parametric (distribution free) test, which is used to decide whether K independent samples are from the same population.

In other words, it is used to test two hypothesis given by equation ( 1) the null hypothesis H 0 assumes that samples originate from the same population (i.e., equal population means) against the alternative hypothesis H 1 which assumes that there is a statistically significant difference between at least two of the subgroups.

H0:µ 1 = µ 2 = ••• = µk H1:µ i = µ j ∃ (i, j) with i = j (1)
The KW test statistic H is given by equation ( 2), and the p-value is calculated using a χ 2 distribution with k -1 degrees of freedom. The decision criterion to choose the appropriate hypothesis is given in equation ( 3).

H = 12 N (N +1) g i=1 n i r2 i. -3(N +1) (2)
where n i is the number of observations in group i, r ij is the rank of observation j from group i and N is the total number of observations across all groups.

r2 i. = ni j=1 r ij ni and r = 1 2 (N +1) p-value ≥ 0.05 accept H 0 otherwise reject H 0 (3)

Data-mining analysis

To analyse respondents' answers, we use two types of classifiers: Bayesian networks [START_REF] Friedman | Bayesian network classifiers[END_REF] and decision trees [START_REF] Breiman | Classification and Regression Trees[END_REF]. They are formal graphical tools for representation of decision scenarios requiring reasoning under uncertainty. We present in sections 3.4.1 and 3.4.2 the Bayesian networks and the decision trees, respectively. Section 3.4.3 presents its performance evaluation to choose the best decision model. The method used to learn the Bayesian network structure B S is based on conditional independence tests as described in [START_REF] Bouckaert | Weka Manual[END_REF]. This method mainly stem, from the goal of uncovering causal structure. The assumption is that there is a network structure that exactly represents the independencies in the distribution that generated the data. The method is divided into two stages:

Bayesian networks

• Find a skeleton: Starting with a complete undirected graph, the method tries to find conditional independencies {x → y}∪∀z ∈ Zz → y in the data. If an independency is identified, the edge between x and y is removed from the skeleton. We use the following conventions to identify counts in the database D of a network structure B S :

• Let r i (1 ≤ i ≤ n)
be the cardinality of the variables x i .

• We denote by q i the cardinality of the parent set of x i in the network structure B S . Hence, q i can be calculated as the product of cardinalities of nodes in pa(x i ), q i = xj ∈pa(xi) r j .

• We denote by N ij (1 ≤ i ≤ n, 1 ≤ j ≤ q i ) the number of records in D for which pa(x i ) takes its jth value.

• We denote by

N ijk (1 ≤ i ≤ n, 1 ≤ j ≤ q i , 1 ≤ k ≤ r i )
the number of records in D for which pa(x i ) takes its jth value and for which x i takes its kth value. Hence,

N ij = ri k=1 N ijk . • We use N to denote the number of records in D.
To test whether variables x and y are conditionally independent given a set of variables Z, a network structure with arrows ∀z ∈ Zz → y is compared with one with arrows {x → y}∪∀z ∈ Zz → y. A test is performed by using a predefined score metric. In this study, we use four score metrics as defined here

• Entropy metric H(B S ,D) defined as

H(B S ,D)=-N n i=1 qi j=1 ri k=1 N ijk N log N ijk N ij (4)
• Akaike Information Criterion metric Q AIC (B S ,D) defined as

Q AIC (B S ,D)=H(B S ,D)+K (5)
where

K = n i=1 (r i -1) • q i • Minimum Description Length metric Q MDL (B S ,D) defined as Q MDL (B S ,D)=H(B S ,D)+ K 2 log N (6)
• Bayesian metric Q Bayes (B S ,D) defined as

Q Bayes (B S ,D)= n i=0 qi j=1 (r i -1)! (r i -1+N ij )! ri k=1 N ijk ! (7)
• Direct acyclic graph (DAG): the second stage consists in directing all the edges in the skeleton to get a DAG. The first step in directing arrows is to check for every configuration x --z --y where x and y not connected in the skeleton whether z is in the set Z of variables that justified removing the link between x and y.I fz/ ∈ Z, we can assign direction x → z ← y. Then, a set of rules (presented in [START_REF] Bouckaert | Weka Manual[END_REF] is applied to direct the remaining edges.

Decision trees

Introduced by [START_REF] Breiman | Classification and Regression Trees[END_REF], decision trees are one of the few knowledge representation schemes, which are easily interpreted and may be inferred by very simple learning algorithms [START_REF] Baldwin | Intelligent Information Processing II, Chapter Simple fuzzy logic rules based on fuzzy decision tree for classification and prediction problem[END_REF]. A decision tree is a tree in which:

• each internal node tests an attribute

• each branch corresponds to an attribute value

• each leaf node assigns a classification. Decision trees are powerful predictors and provide an explicit concept description for a data set.

Nowadays, several methods have been proposed for learning decision trees. For this study, we have used the most well known and used methods in the literature: C4.5 developed by [START_REF] Quinlan | C4.5: Programs for Machine Learning[END_REF] and CART [START_REF] Breiman | Classification and Regression Trees[END_REF] algorithms. The learning algorithms of decision trees contain three main functions:

• deciding if a node is a leaf

• selecting an attribute for a test node

• associating a label to a leaf.

Before presenting the used algorithms, we introduce the following notions. For a database of observations D, a target variable C = {1,... ,c} and a decision tree t, we define for each position p in the tree t:

• N (p) is the cardinality of the set of observations associated to the position p in the database D.

• N (k/p) is the cardinality of the set of observations associated to the position p belonging to the class k.

• P (k/p) is defined as:

P (k/p)= N (k/p) N (p) (8)
• The diversity functions used as a splitting criterion are the information content (IC) and the Gini index defined as follows:

IC(p)=- c k=1 P (k/p) × log(P (k/p)) (9)
Gini(p)=1- 1 Deciding if a node is a leaf: A node p is a leaf if Gini(p) ≤ i 0 or N (p) ≤ n 0 , where i 0 and n 0 are initial parameters of the learning algorithm.

2 Selecting an attribute for a test node: For a position p, the algorithm selects the attribute that maximises the gain defined in equation ( 11) using the Gini index as a splitting criterion.

Gain(p, test)=Gini(p) -(P lef t × Gini(p 1 )+P right × Gini(p 2 )) (11)
where P lef t (respectively P right ) represents the proportion of the elements associated to position p and going to the node in position p 1 (respectively, p 2 ).

3 Associating a label to a leaf: The majority rule is used to label each leaf in the decision tree.

3.4.2.2 C4.5 algorithm C4.5 is an extension of the ID3 [START_REF] Quinlan | Induction of decision trees[END_REF] algorithm developed by Ross Quinlan in 1986. C4.5 builds decision trees from a set of training data using the concept of information content defined in equation ( 9). At each node of the tree, C4.5 chooses one attribute of the data that most effectively splits its set of samples into subsets enriched in one class or the other. Its criterion is based on the gain ratio, defined in equation ( 12), that results from choosing an attribute for splitting the data. The attribute with the highest gain ratio is chosen to make the decision. The C4.5 algorithm then recurses on the smaller sublists.

GainRatio(p, test)= Gain(p, test) SplitInf o(p, test) (12)
where Gain(p, test) and SplitInf o(p, test) are defined as:

Gain(p, test)=IC(p) - n i=1 P i × IC(p i ) (13) SplitInf o(p, test)=- n i=1 P ′(i/p) × log(P ′(i/p)) ( 14
)
where test is the test attribute having n values, P ′(i/p) is the proportion of elements in D at position p and satisfying the ith test attribute value.

Performance metrics

Classifiers are useful tools, which are commonly used in decision analysis, to help identifying a strategy most likely to reach a goal [START_REF] Edwards | Clustering and classification of maintenance logs using text data mining[END_REF]. They provide a highly effective and simple structure that can be explored to make predictions and decisions. Despite the obvious advantages of these tools, they do not provide a 100% accuracy result. Because of this inaccuracy, several performance criteria have been proposed in the literature [START_REF] Rakotomalala | Graphes d'induction[END_REF] to identify the quality of a classifier. The main criteria used are:

• Accuracy: Denotes the percentage of the correctly classified instances.

• Area under the ROC curve (AUC): It is equal to the probability that a classifier will rank a randomly chosen positive instance higher than a randomly chosen negative one. In this study, AUC is estimated using Mann-Whitney statistic test as presented by [START_REF] Ling | AUC: a better measure than accuracy in comparing learning algorithms[END_REF]. The AUC of a classifier G is defined as:

AUC = S 0 -n 0 (n 0 +1)/2 n 0 n 1 ( 15
)
where n 0 and n 1 are the numbers of positive and negative examples respectively, and S 0 = r i , where r i is the rank of the ith positive example in the ranked list. [START_REF] Ling | AUC: a better measure than accuracy in comparing learning algorithms[END_REF] suggest that its use should replace accuracy when measuring and comparing classifiers: the best classifier is the one with the largest AUC value.

• Comprehensibility: Qualifies the exploitability of the produced model. For example, in a Bayesian network, the important number of a node's parents affects the identification of its strong relations with them.

Experimental results

In this section, we detail the experimental protocol and the results we obtained. We present first the test protocol and test materials used in this study, followed by the pre-processing phase prior to the data analysis. Then, we present the data analysis phase to study users' acceptance and satisfaction of the two tested biometric systems (GREYC-Keystroke (Giot et al., 2009a) and GREYC-Face [START_REF] Hemery | Study on color spaces for single image enrolment face authentication[END_REF]) developed in the GREYC research laboratory.

Test protocol

The pilot study was distributed on a paper sheet to a sample of 100 volunteers, including students (70% of the population) coming from different countries and employees. Tests have been conducted in public places over a 3-month period.

It consists in testing both systems (enrolment then multiple verification attempts playing the role of an impostor and a legitimate user). Then, they were requested to answer a questionnaire (see Appendix): part A, part B and two times part C (one for each tested system). Volunteers completed the survey voluntarily and received none remuneration. During the tests, volunteers were informed about the purpose of the study, and their responses would be confidential and anonymous.

The age and gender distribution of the volunteer crew are shown in Figure 2.

Test materials

In this study, we have used two biometric verification systems developed in our research laboratory: GREYC-Keystroke and GREYC-Face. The first is a behavioural-based analysis, while the second is a morphological-based analysis.

We have chosen to illustrate the proposed methodology on these two biometric systems for many reasons. First, we would like to quantify the acceptability of our developed systems to improve them (in terms of performance and ergonomic interface based on users feedbacks). We are mainly interested of these modalities since they belong to the possible candidates that may be implemented in an Automated Teller Machine (ATM), and can be used for e-commerce applications.

Second, it would be important to test which kind of modality (morphological or behavioural) is better perceived by the volunteers. Obviously, we have to include other types of systems (e.g., iris verification) to test in an accurate way this hypothesis. Third, we would like to see which type of modality is better perceived to be used to manage physical (e.g., border control) or logical (e.g., e-commerce) access. Finally, evaluation results provided by these two very different biometric systems should be also as different as possible. Therefore, we believe that it is a good choice to illustrate this evaluation methodology on these systems. The performances of tested systems are calculated with captures provided by our volunteer crew. We plot their Detection Error Trade-off (DET) curves in Figure 5:

• GREYC-Keystroke verification system: It is a biometric system based on behavioural analysis (see Figure 3). The main goals of this software are to allow the creation of a keystroke dynamics database and to compare different algorithms in the literature, within the same conditions (e.g., acquisition conditions), for evaluation issues. The system provides an EER value equal to 17.51% on a database composed of 70 individuals with 3 vectors used for enrolment and 2 for the tests. The system implements a score-based method presented by [START_REF] Hocquet | User classification for keystroke dynamics authentication[END_REF]. To achieve the enrolment in the system, users type 5 times a predefined password 'greyc laboratory'. For the verification process, users tried freely (i.e., in term of number of attempts) both genuine and impostor attempts. For each user, we have at least two genuine attempts and one impostor attempt. • GREYC-Face verification system: It is a biometric system based on morphological analysis (see Figure 4). The system implements a SIFT-based [START_REF] Lowe | Distinctive image features from scale-invariant keypoints[END_REF] algorithm. The used matching similarity principle is described in a previous work [START_REF] Hemery | Study on color spaces for single image enrolment face authentication[END_REF]. The system provides an EER value equal to 8.76% on a database composed of 70 individuals with 1 image used for enrolment and 2 for the tests. To achieve the enrolment in the system, a single picture is captured per user. For the verification process, users tried the face system using the same process than the previous one.

Data pre-processing

The first step of the proposed methodology consists in the deletion of respondents' answers that did not answer a certain number of questions of the questionnaire. For three unanswered questions, two vectors of answers (one from each system) have been eliminated from this study. Therefore, the results presented in the next subsections are done using 99 vectors of answers on both systems.

Respondent demographics analysis

We study in this section the relationship, on each system, between respondents' demographic characteristics and their answers on biometric technology and satisfaction questions (Appendix, parts B and C). Table 1 shows the results for a confidence degree equal to 95%. Bold values indicate significant relationships based on the criterion defined in equation ( 3). From this table, we can put into obviousness these significant relationships:

• Age was significantly related to their answers about keystroke's robustness against attacks: aged respondents (≥ 28) considered that the system is less robust against attacks than youngest ones.

• For keystroke system, education level was significantly related to the disturbed, threats to privacy, verification quickness and correct answer factors:

• high school graduate respondents were less disturbed than the others.

• none graduated respondents have expressed much more concerns about their privacy than the others.

• high school graduate respondents considered that the computation time during the verification phase is faster than the college graduate respondents.

• keystroke performance was perceived better by the high school graduate respondents than the college graduate respondents. • Education level was significantly related to the use of face system: college graduated respondents found it more complicated (in term of easiness to use) than the others.

Comparative study of the studied systems

In this section, we present respondents' knowledge about biometric technology, and a comparative analysis between the studied systems based on a statistical analysis of their answers. A Kruskal-Wallis test was performed to identify the significant differences among this comparison. Table 2 shows the results for a confidence degree equal to 95%. Bold values indicate significant relationships based on the criterion defined in equation ( 3). From the respondents' answers and Table 2, we can put into obviousness some interesting points:

• Most of the respondents (74.8%) have already heard before our study of biometric authentication systems, and less than half of them (40.4%) have already used a biometric system.

• 38.4% of the respondents have expressed a good knowledge about biometric technology.

• Using Kruskal-Wallis test (p-value <0.01), respondents considered that biometric technology (90.9% agree) is much more appropriate than secret-based solutions (33.3% agree) against fraud.

• There were no significant differences on easiness to use, verification quickness, use in the future and trust factors: 24.2% of the respondents have found that face system is not easy to use and 14.1% for keystroke one. 10.1% found that the computation time during the verification phase of face system is not fast and 14.1% for keystroke one. 22.2% of the participants hesitate or refuse the use of face system in the future and 17.2% for keystroke one. For their perception about trust, 32.3% do not trust face system and 20.2% for keystroke one.

• There were significant differences on disturbed, threats to privacy, correct answer, system can be easily attacked and general appreciation factors: respondents were much more disturbed while using face system (25.3%) than keystroke one (16.2%). Respondents have expressed much more concerns about their privacy while using face system (47.5%) than keystroke one (13.1%). They found that keystroke performance is better than the face one. They found that keystroke system (53.5%) is more robust against attacks than face one (34.3%). For their general appreciation, they were more satisfied from the use of keystroke system (88.9%) than face one (75.8%).

• Finally, 23.2% prefer to use the face system and 62.6% for keystroke one for managing logical access, 41.4% prefer to use the face system and 14.1% for keystroke one for physical access, 31.3% prefer to use the face system and 21.2% for keystroke one for both kinds of access. This indicates that the keystroke system is more requested to be used for managing logical access, while the other system for physical access (which is of course an expected result).

Discussion

The results of this study and the statistical analysis of answers brought many interesting information. We found a surprising high rate (47.5%) concerning their concerns about privacy issues while using face system. The results also brought surprising rates concerning the perceived performance of the tested systems, and their general appreciation. Respondents found that keystroke performance (with an EER =17.51%) is better than the face one (with an EER =8.76%), and they were more satisfied from the keystroke system (88.9%) than the face one (75.8%). Therefore, it would be important to explain respondents' answers to more understand these rates, and the significant differences among the studied systems. This is what we present in the next section.

Data-mining analysis

The purpose of this section is to study the dependences between satisfaction questions (Appendix, parts B and C except Q 16 ) to understand respondents' answers. We would also like to more understand the surprising rates provided by the previous section. Owing the nature of construction of Bayesian networks and decision trees (i.e., the target question should be a nominal attribute), we proceed as follows:

1 Since the target question should be nominal, we divide the satisfaction questions into two sets (S Cause and S Ef f ect ), according to the Cause and Effect relationship. We consider that the questions in , 5, 6, 7, 11, 12, 14} set are numerical attributes, while questions in S Ef f ect = {Q i /i =9, 10, 13, 15, 17, 18} set are nominal attributes.

S Cause = {Q i /i =4
For example, we put concerns about privacy issues question (Q 10 )i nS Ef f ect set, since we would like to explain why we have a high rate (47.5%) concerning privacy issues while using face system.

2 To generate the Bayesian networks and decision trees models, missing values (i.e., questions without answers) are handled for both kinds of attributes.

For nominal attributes, they are replaced by the most frequent choice. While for numerical attributes, they are replaced by the average value.

Using Bayesian networks and Decision Trees, several points can be concluded:

• Using Table 3, respondents' concerns about their privacy while using the face system can be explained by their perception about its robustness against attacks. From the respondents who have expressed concerns about their privacy while using face system, more than half of them (66%) found that it can be easily attacked. Since more than half of the respondents (51.5%) do not found the face system robust against attacks, this explains why a lot of respondents (47.5%) have expressed such concerns. Using both clauses C 1 and C 2 (Table 3), we can also deduce that the easiness to use face system is an another possible candidate having impact on respondents' concerns about their privacy. • Respondents' perception about keystroke performance (Table 4) was related to the robustness of the system against attacks, and its easiness to use. From the respondents who found that keystroke performance is important, 23.5% of them considered that the system is quite easy to use, and 24.7% found that the system is robust against attacks. For the face system (Table 5), it was related to their perception about its robustness against attacks, and their awareness about fraud identity. From the respondents who do not found that face performance important, 15% of them found that their awareness about fraud identity is not at all important, and 20% considered that the system is not robust against attacks. From these results, we find that the robustness of the system against attacks is a possible candidate having impact on their perception about the performance of both systems. Since respondents significantly (with a p-value =0.005) considered that the robustness of keystroke system against attacks is better than the face system, and most of them (85.9%) considered that keystroke system is easy to use, this clearly explains why respondents found the performance of the keystroke system is better than the face one. • Respondents' general appreciation on both systems (Tables 6 and7) was related to the robustness of the system against attacks, and its easiness to use.

From the respondents who were not satisfied while using face verification system, 57.1% of them do not found the system is robust against attacks, and 14.3% considered that it is not easy to use. From the respondents who were satisfied from keystroke system, at least 12.5% of them found that keystroke system is robust against attacks, and almost 40.9% found that the system is easy to use. In addition, the computation time during the verification phase of keystroke system is also considered as a possible candidate having impact on respondents' general appreciation. Therefore, we find that respondents' perception about the robustness of the system against attacks is the major reason explaining why they were more satisfied from keystroke system than face one.

Table 6 Excerpt from decision tree explaining respondents' answers for their general appreciation of the face verification system. Bold rules indicate important ones Table 7 Excerpt from decision tree explaining respondents' answers for their general appreciation of the keystroke system. Bold rules indicate important ones

Conclusion and perspectives

The study of users' acceptance and satisfaction of biometric systems is considered as an important factor to take into account when designing and evaluating such systems [START_REF] Theofanos | Usability & Biometrics: Ensuring Successful Biometric Systems[END_REF]. Despite this, existing studies in the literature are very few in comparison with performance ones. However, most of the studies in this area are modality-dependent (such as the usability study presented by Theofanos et al. (2008a)). In addition, these studies are based on statistical answers to a questionnaire, but no data analysis is conducted for understanding respondents' answers to identify reasons. To contribute in more taking into account users' point of view when designing biometric systems, we proposed in this paper a modalityindependent evaluation methodology to study users' acceptance and satisfaction of biometric systems. The methodology is based on a survey questionnaire for data collection. It uses

• the Kruskal-Wallis test to extract significant relationships between demographical characteristics and satisfaction questions

• two data-mining tools, Bayesian networks and decision trees, that illustrate dependencies to analyse respondents' answers and behaviours.

The main advantage of the proposed methodology is twofold. First, it is independent from the tested modality. Hence, it could be applied to any kind of biometric systems. Second, it uses data-mining tools to explain respondents' answers. Such kind of analysis would determine the possible candidates that may influence their acceptance and satisfaction in a specified context of use and a target population. We have illustrated the proposed methodology on a crew of 100 volunteers, using two biometric systems developed in our research laboratory for clarifying its benefits. The first system is a morphological-based analysis (face verification with an EER equal to 8.76%), the second one is a behavioural-based analysis (keystroke dynamics with an EER equal to 17.51%). The main results outlined from this study are:

• Respondents considered that biometric-based technology is more appropriate than secret-based solutions against fraud.

• Socio-demographic characteristics have influenced their answers on some satisfaction questions.

• Both systems are acceptable and respondents were more satisfied with the keystroke system (88.9%) than the other one (75.8%).

• The robustness of a system against attacks, its easiness to use and the computation time during the verification phase are identified as important factors influencing respondents acceptance and satisfaction.

• Finally, from the volunteers who have willingness to use the studied systems in the future, the keystroke system was more requested to be used to manage logical access and the other system for physical access.

These findings clearly show that users' acceptance and satisfaction should be taken into account when developing and evaluating biometric systems. Even if the performance of a biometric system outperformed another one, this will not necessarily mean that it will be more operational or acceptable. In our opinion, there is a lack of an evaluation methodology that more take into account users' point of view when designing and evaluating biometric systems, which constitutes one of the main drawbacks of biometric systems proliferation.

For the perspectives, we intend to develop a web-based software to compare different types of biometric systems (fingerprint, iris, keystroke dynamics, signature dynamics and face verification), and to have a much larger population.

Terms and definitions

Figure 1

 1 Figure 1 Evaluation aspects of biometric systems

  algorithmCART method, introduced by Breiman et al., consists of learning binary decision trees. The CART learning algorithm consists of:

Figure 2

 2 Figure 2 Age and gender distribution of the volunteer crew

Figure 3

 3 Figure 3 GREYC-Keystroke verification system (see online version for colours)

Figure 4 Figure 5

 45 Figure 4 GREYC-Face verification system. An example of a matching attempt resulting from a genuine user (see online version for colours)

  A Bayesian network (B S ,B P ) is a probabilistic graphical model that represents a set of random variables U = {x 1 ,x 2 ,...x n } and their conditional independencies. The Bayesian structure B S is a Directed Acyclic Graph (DAG) where nodes represent propositional variables in a domain, and the arcs between nodes represent the dependency relationships among the variables. The Bayesian probability distributions B P is a set of probability tables B

P = {p(u | pa(u))|u ∈ U } where pa(u) is the set of parents of u in B S .

Table 1

 1 Respondents' answers and demographic factors, Kruskal-Wallis analysis: lines with two p-values correspond to systems' specific questions (face/keystroke)

		p-value
	Questions	Gender	Age	Education	Profession
	Biometric technology knowledge	0.089	0.652	0.134	0.911
	Awareness about fraud identity	0.247	0.831	0.14	0.578
	Secret-based against fraud	0.482	0.804	0.213	0.778
	Biometric-based against fraud	0.71	0.324	0.74	0.546
	Disturbed	0.419/0.385 0.509/0.473 0.096/0.007 0.696/0.428
	Threats to privacy	0.206/0.556	0.65/0.649	0.196/0.044	0.756/0.36
	Easiness to use	0.145/0.438 0.063/0.522 0.012/0.392	0.46/0.406
	Verification quickness	0.135/0.144 0.226/0.294 0.195/0.039 0.095/0.202
	Correct answer	0.982/0.075 0.779/0.717	0.78/0.034	0.369/0.058
	System can be easily attacked	0.276/0.226	0.492/0.02	0.558/0.204	0.405/0.22
	Use in the future	0.079/0.48	0.604/0.883 0.721/0.821	0.33/0.255
	Trust	0.414/0.689 0.469/0.218 0.709/0.947 0.372/0.068
	General appreciation	0.078/0.129 0.984/0.873	0.3/0.768	0.459/0.917

Table 2

 2 Comparative analysis of acceptance and satisfaction between the studied systems, Kruskal-Wallis analysis

	Mean ratings of the studied systems
	Satisfaction questions	Face system	Keystroke system	p-value
	Disturbed	1.916	1.67	0.034
	Threats to privacy	2.427	1.626	<< 0.05
	Easiness to use	3.133	3.242	0.355
	Verification quickness	3.329	3.357	0.611
	Correct answer	3.176	3.51	0.007
	System can be easily attacked	2.659	2.3	0.005
	Use in the future	2.989	3.112	0.238
	Trust	2.84	3	0.176
	General appreciation	2.823	3.175	0.0021

Table 3

 3 Excerpt from decision tree explaining respondents' answers for privacy issues of the face verification system. Bold rules indicate important ones

Table 4

 4 Excerpt from decision tree explaining respondents' answers of the keystroke performance. Bold rules indicate important ones

Table 5

 5 Excerpt

from decision tree explaining respondents' answers of the face verification performance. Bold rules indicate important ones

Acknowledgement

The authors thank the Basse-Normandie Region and the French Research Ministry for their financial support of this work.

Authentication: Security measure designed to establish the validity of a transmission, message, or originator, or a means of verifying an individual's authorisation to receive specific categories of information.

Biometric: Any specific and uniquely identifiable physical human characteristic (e.g., of the retina that may be used to validate the identity of an individual).

enrolment: The process of collecting biometric samples from a person and the subsequent preparation and storage of biometric reference templates representing that person's identity.

False Acceptance Rate (FAR): Rate at which an impostor is accepted by an authentication system.

False Rejection Rate (FRR): Rate at which the authorised user is rejected from the system.

Equal Error Rate (EER): This error rate equates to the point at which the FAR and FRR cross (compromise between FAR and FRR).

Vulnerability: A weakness in the system that can be exploited to violate its intended behaviour.

Threat: A potential event that could compromise the security integrity of the system.

Appendix

Survey questionnaire


Julien Mahier
email: julien.mahier@ensicaen.fr

Baptiste Hemery
email: baptiste.hemery@ensicaen.fr

Mohamad El-Abed
email: mohamad.elabed@ensicaen.fr

Mohamed T El-Allam

Mohamed Y Bouhaddaoui

Christophe Rosenberger
email: christophe.rosenberger@ensicaen.fr

Computation EvaBio: A Tool for Performance Evaluation in Biometrics

Keywords: Biometrics, Performance Evaluation, Benchmark, Distributed Computing

Performance evaluation is a key factor in biometrics. In order to assess the quality of a new biometric system, one has in general to compute the performance on a large dataset to have significant results. It is not always an easy task as the computation complexity could be important. Moreover, the use of existing datasets is not obvious as it is represented in different ways (datasets, directory of images) and contain multiple scenarios (single enrollment process, different numbers of samples for the template generation for each user, etc.).

We propose in this paper a new distributed-based platform facilitating the computation on different datasets in biometrics. The architecture of the proposed platform is composed of a server distributing computation tasks on its available clients. Experimental results on two biometric datasets (PolyU finger knuckle print and AR face datasets) show the benefit of proposed computing platform.

Introduction

The interest for biometric technologies has increased during the last few years. The application of biometrics in industrial domains becomes a reality.

Apart from the traditional modalities such as fingerprints [START_REF] Jain | An identity-authentication system using fingerprints[END_REF] or iris recognition [START_REF] Wildes | A system for automated iris recognition[END_REF], new modalities are studied such as keystroke dynamics [START_REF] Giot | Keystroke dynamics with low constraints svm based passphrase enrollment[END_REF], gait [START_REF] Sarkar | The humanID gait challenge problem: data sets, performance, and analysis[END_REF] or finger knuckle prints [START_REF] Kumar | Personal authentication using finger knuckle surface[END_REF].

As there are many research works in biometrics, there is a strong need for comparing and benchmarking biometric algorithms. Several datasets are made available in order to ease this comparison process. However, a dataset can be used within several protocols, which sets up a benchmark, to establish the performance of an algorithm. This leads to an important complexity to correctly evaluate a biometric system. Moreover, there are some well-known performance metrics presented by the International Organization for Standardization ISO/IEC 19795-1 [START_REF]Information technology -biometric performance testing and reporting -part 1: Principles and framework[END_REF] for the evaluation process such as the ROC curve (Receiver Operating Characteristic) and the EER value (Equal Error Rate).

The EPC (Expected Performance Curve) is also another performance metric presented in [START_REF] Benjio | The expected performance curve[END_REF] towards the performance evaluation of biometric algorithms. It requires some datasets to be split in two parts, one dealing with development and the other one with experiment. However, it is still difficult to compare biometric algorithms. It is required that the used dataset is large enough to be significant, but this leads to a very long time consuming experiment. If we have a benchmark datasets of N individuals and M samples for each user, the definition of the FRR (False Rejection Rate) requires (M -1)• N computations and for the FAR (False Acceptance Rate) N (N -1)• M ones (for a single enrollment biometric system). In order to achieve a more accurate evaluation, we need to have a large dataset which exponentially grows the computation complexity. Some platforms dedicated to biometric algorithm evaluation exist (such as the online evaluation platform FVC-onGoing), but are generally specialized for only one kind of biometric modality and only one dataset.

We present in this paper a distributed-based computation platform called EvaBio dedicated to the evaluation of biometric systems. The proposed platform is modality-independent. Thus, it needs to be able to manage any biometric dataset. Moreover, this platform needs to be easy to use and efficient. Thus, the required computation tasks can be easily distributed on several computers. The outline of this paper is as follows: after the introduction, we present in section 2 the existing platforms dedicated to the evaluation of biometric algorithms. We also present the EvaBio platform we are working on in section 3 with a description of its computation capabilities and the scenarios generation for performance evaluation. Section 4 presents some experimental results.

Finally, we conclude and give the perspectives of this work in section 5.

State of the art

In comparison to traditional authentication systems (such as password-based methods), biometric systems are less accurate and do not provide a 100% reliable answer. Due to this inaccuracy, many efforts are done in the literature for the performance evaluation of such systems. We provide first in this section, a brief description of the used biometric performance metrics and some well known benchmarks, followed by an overview of the well known platforms which aim to evaluate monomodal and multimodal biometric systems.

Biometric Performance Metrics

The comparison of two biometric samples produces a similarity score. If the score is higher than a predefined decision threshold, then the system accept the claim user, otherwise the claim is rejected. Figure 1 illustrates the distribution of the genuine and impostor scores. This figure shows that depending from fixed decision threshold, we obtain different kind of errors: 1) genuine users who are incorrectly rejected by the system, and 2) impostors who are considered as genuine users. • Failure-to-enroll rate (FTE): proportion of the user population for whom the biometric system fails to capture or extract usable information from biometric sample;

• Failure-to-acquire rate (FTA): proportion of verification or identification attempts for which a biometric system is unable to capture a sample or locate an image or signal of sufficient quality;

• False acceptation rate (FAR): proportion of impostors that are accepted by the biometric system;

• False rejection rate (FRR): proportion of authentic users that are incorrectly denied;

• False-match-rate (FMR): the rate for incorrect positive matches by the matching algorithm for single template comparison attempts. FMR equals FAR when the biometric system uses one attempt by a user to match its own stored template;

• False-non-match rate (FNMR): the rate for incorrect negative matches by the matching algorithm for single template comparison attempts. FNMR equals FRR when the biometric system uses one attempt by a user to match its own stored template;

• Equal error rate (EER): it is the value where both errors rates, FAR and FRR, are equals (i.e., FAR = FRR). It constitutes a good indicator, and the most used, to evaluate and compare biometric systems. In other words, lower the EER, higher the accuracy of the system. These performance metrics may be drawn to graphically visualize the precision of the target system. A well known curve is the ROC (Receiver Operating Characteristic) curve which plots both types of errors (FAR and FRR) as depicted in figure 2. This curve provides the performance of the tested system among several decision thresholds. In addition to these metrics, usability metrics are computed within competitions and platforms such as the average enroll time, average match time, average template size. These additional metrics are important in order to have useful and usable systems.

Benchmarks

In order to compute the performance metrics provided in the previous section, we need biometrics benchmarks. Several benchmarks are publicly available to researchers in order to evaluate their developed algorithms. Two categories of datasets exist in the literature: 1) monomodal datasets such as PolyU FKP [START_REF]Polyu fkp database[END_REF], GREYC-Kesytroke [START_REF] Giot | Greyc keystroke : a benchmark for keystroke dynamics biometric systems[END_REF], FACES94 [START_REF] Essex | Faces94 database, face recognition data[END_REF], AR [START_REF] Martinez | The ar face database[END_REF], FERET [START_REF] Phillips | The FERET database and evaluation procedure for face recognition algorithms[END_REF][START_REF] Phillips | The FERET evaluation methodology for face-recognition algorithms[END_REF], FRGC (Face Recognition Grand Challenge) [START_REF] Phillips | Overview of the face recognition grand challenge[END_REF], etc., and 2) multimodal datasets such as XM2VTSDB [START_REF] Messer | XM2VTSDB: The Extended M2VTS Database[END_REF], BANCA [START_REF] Popovici | The BANCA database and evaluation protocol[END_REF], BIOSECURE [START_REF]Biosecure Multimodal Biometric Database[END_REF], etc. The FVC-onGoing platform is a useful solution since the comparison process is done using the same protocol, and the used evaluation metrics cover the main criteria of having useful and usable systems. In addition, such kind of platforms is important since the evaluation process is done by the online platform side.

This facilitates the tasks of other researchers that may do not have the required materials (e.g., a cluster computing) towards the evaluation of their developed algorithms. However, FVC-onGoing is dedicated to the performance evaluation of fingerprint algorithms. Hence, it could not be exploited for other types of well used modalities such as face modality [START_REF] Belhumeur | Eigenfaces vs. fisherfaces: Recognition using class specific linear projection[END_REF].

BioSecure Reference and Evaluation framework

BioSecure was a project of the 6th Framework Program of the European Community. Its main objective was to build and provide a common evaluation framework, which investigates and compares the biometrics-based identity authentication methods. It provides twelve benchmarking reference systems freely available at http://share.int-evry.fr/svnview-eph/: 2D face, 3D face, fingerprint, hand, iris, signature, speech and talking-face reference systems.

These reference systems are made of replaceable modules (preprocessing, feature extraction, model building and matching) which allow developers and re-searchers to investigate the improvement of a specific part of the tested system.

In this case, a researcher can evaluate and compare its matching algorithm just by replacing the corresponding module in the reference system. An example of the used performance measures is the distribution of genuine and impostor comparison scores. BioSecure reference systems are useful since they cover several kinds and the most used modalities. In addition, the structure of these reference systems in allowing a researcher to test a specific part of a developed algorithm is a main advantage of these systems. However, in comparison to the FVC-onGoing online platform, the computation is done on the side of the developers which may do not have the specific materials dedicated to such kinds of evaluation. Moreover, these reference systems are dependent from the used modality and use a predefined dataset and protocol. This fact limits their use if the researchers want to evaluate their developed algorithms using other protocols or even other datasets.

Biometric experimentation environment (BEE)

The BEE distribution [START_REF] Phillips | Overview of the face recognition grand challenge[END_REF] is the test environment of the evaluation of face recognitions systems in the Face Recognition Vendor Tests (FRVT2006). It is a computational experimental environment which easily allows researchers to compare their developed facial-based algorithms. The BEE distribution contains all the data sets for performing and scoring the experiments. It also provide a PCAbased method (known as BEE system) that has been optimized for large-scale problems as a baseline algorithm, which applies the whitened cosine similarity measure. An example of its use to compare face recognition systems in given in [START_REF] Yang | Horizontal and vertical 2dpca-based discriminant analysis for face verification on a large-scale database[END_REF]. The BEE framework returns three kinds of ROC curves as a performance measure, corresponding to images collected within semesters, within a year, and between semesters, respectively. The BEE system is a useful framework to compare face recognition systems. However, BEE do not resolve the computation complexity of performance metrics, which is considered as a main drawback in biometrics research field. Towards resolving this problematic, we present in the next section a distributed computation platform of performance metrics.

Computation EvaBio platform

Proposed platform

The Computation EvaBio Platform started its development in February 2009. Its goal is to provide a low cost, scalable, adaptable, modalities independent and development tools independent platform dedicated to biometric computation. The main idea is to use the unexploited calculation power of existing computer pool in a research laboratory.

The interest for the researcher is to focus only on his/her algorithm assuming small development constraints. The main constraint is to develop a full autonomous application or script (without any interaction or IHM) dealing with an atomic computation task. The global vision of the different calculation steps is defined in the Computation Task List, within an XML file. Each task defined in this file describes a computation task to be done on the laboratory computers. The server is in charge of the repartition of the different computation tasks. Figure 4 shows the present architecture (v0.5). It is composed of four parts, the server and the distribution process (presented by Mahier et al. in [START_REF] Mahier | Toward a distributed benchmarking tool for biometrics[END_REF]), the administration client and the computation task list generation, the atomic algorithm creation and deployment, the dataset access and the different biometrics dataset abstraction.

Biometric datasets modeling

We present in this section an original meta model suitable for any biometric dataset, we choose to perform a modeling of four publicly available datasets. It will allow us to be able to launch a performance evaluation scenario described by this meta model. We choose to use the Merise method [START_REF] Avison | Merise: A european methodology for developing information systems[END_REF] for modeling four existing biometric datasets. It is a modeling methodology for the development of information systems, which is well suited for the dataset modeling. By analysing existing benchmarks in biometrics (AR, Poly U FKP, FERET and GREYC-Kesytroke, etc.), we can extract some tables that are general for all biometric datasets. We also had to add some tables specific in order to be able to manage several datasets. The obtained modeling can be seen at figure 5. The two top tables Dataset and Modality corresponds to specific tables we added to manage different biometric dataset. The modalityDesc field of the Modality corresponds to the used modality such as "face", "keystroke" and so on. It is linked to the Dataset table, where we store the name of the dataset and a short description. Next, we find the Individual table which contains data about individuals present in a dataset. It is limited to an individualNumber, which reflects the number of the individual in the dataset, and its gender. We add an externalID as a foreign key to a table with more details about this individual, such as first name, last name or date of birth. This table is not included in the model for anonymity reasons, but the externalID can still be used to retrieve the same individual in several dataset, which can be useful for multi-modality biometrics. Finally, an active field can be used to deactivate an individual if needed.

An individual is linked to several sessions, stored in the Session table, via the perform table. The sessionID field is thus unique for each individual/session number, and can be associated to a date. These tables are associated to the table BiometricData, which contains information relative to the biometric sample. The data field is a link to the biometric sample and metaData can be used to store an additional information about biometric data, such as the used password for a keystroke dynamics biometric sample. The success field can be necessary to compute failure to enroll rate. The addInformation field is a link to additional data provided with some datasets, such as localization of eyes for face ones. A biometric sample is also related to the Sensor table, so we can manage several capture devices such as different keyboards or cameras.

Finally, we choose to add some specific information on each dataset in the Type table. This table contains information about the type of data contained in the dataset, such as the resolution of images, in an XML format. Thus, we add the XSL table, wich will contain the information about the XML format of the Type table. In case we want to add a new biometric modality in this model, we only have to add a new XSL entry and keep this model intact.

Use case

A researcher, named Paul, focus his work on a new face biometric algorithm.

He first has to implement his algorithm for one data sample from one person (independently of the dataset and less coupled with the data format). To help him to code accurately, the platform provides design application templates on different languages. The different parameters of the algorithm will be passed as application arguments. When Paul succeeds in developing his basic console application, he will have to define the computation procedure, meaning to define

Discussion

The main interest of this solution is based on the biometric data definition format (the meta-model). Given the abstraction of the biometric data, the researcher focuses only on his algorithm and asks the platform to compute the preselected computation tasks. The abstraction enables a pre-selection from one part of a single dataset (for example only women and illumination altered samples of the AR dataset) to multiple parts of multiple datasets (for example only men of the AR and Feret datasets). The key point is on the tool which allows the researcher to question the meta-biometric-dataset and generates the XML task list. This tool will be presented in another paper.

Results

We present in this section some results of the computing EvaBio platform.

First, we present how an existing biometric dataset can be fitted into the proposed model. Then, we present some results from the existing distributed computation tool.

Fitting existing datasets

PolyU FKP dataset

The PolyU FKP images were collected from 165 volunteers (125 men and 40 women). Among them, 143 subjects were 20 to 30 years old and the others were 30 to 50. The images have been taken in two different sessions. In each session, the subject has provided 6 images for the right index finger, for the right middle finger, the left index finger and the left middle finger. There are therefore 48 pictures, from the 4 fingers from each person. In total, the dataset contains 7,920 images from 660 fingers. The interval average time between the first and second session is 25 days. The maximum interval and minimum were 96 days and 14 days respectively. The dataset consists of several files. Each file is written in a folder named as "nnn fingertype": nnn represents the identity of the person and fingertype can be left index, right index, left middle or right middle.

Each of these folders contains 12 pictures, from 01 to 06 belong to session 1 and 07 to 12 belong to the session 2. There is actually two datasets. The dataset "FKP Database.zip" contains the original images and the "FKP ROI.zip" one contains region of interest pictures [START_REF] Zhang | Finger-knuckle-print: a new biometric identifier[END_REF]. However, the construction of the two datasets is the same, and only the filename name changed, "ROI" being added at the end of the filename for the ROI dataset. An example of these datasets can be found in figure 7.

We present in figure 8 how the PolyU FKP dataset fits the meta-model.

We can see that the Poly U FKP fits well with this meta model. Some fields cannot be completed such as the date where an individual performs a session.

Moreover, some fields have default value for publicly available datasets such as the activate field of the Individual table, which is set to true. Apart from theses fields, we can see that other fields are filled with data related to the biometric sample. Some specific data related to a dataset can also be stored in the database. For example, the height and with of the images from the Poly U FKP dataset can be stored in the XML field of the Type table.

AR face dataset

The AR dataset contains over 4,000 color images, acquired with the same system, corresponding to 126 different faces (70 men and 56 women). The images were taken from the front with various facial expressions, lighting conditions varied, and sometimes with sunglasses or a scarf. Also, no restrictions on clothing (clothes, glasses, etc.), makeup, and hair cut was imposed on participants. Each person has participated in two sessions, separated by 14 days.

The same images were taken in both sessions. All image are in the same folder, and only the file name enable distinguishing biometric data. The name of the female), nnn identifies the person (can range from 001 to 070 for male and 001 to 056 for female) and mm identifies the session and the expression (01 to 26).

Examples of such images are presented in figure 9. Similarly to the Poly U FKP dataset, we present in figure 10 how the metamodel can be used to represent biometric data from the AR face dataset. We can see that the AR face dataset fits well the meta-model. We still have some fields that cannot be completed, but most of them are. We can also see that it is simple to create requests on this database. For example, if we want only male individuals from the AR dataset, we can create a SQL request containing two conditions such as Individual.gender=male and Dataset.datasetName=AR.

Moreover, as the same model is applied, we can use the same SQL requests for both datasets. This clearly shows the interest of this meta model. image. Each SURF keypoint is characterized by a vector in 64 dimensions. The matching similarity principle is presented in previous works [START_REF] Hemery | Study on color spaces for single image enrolment face authentication[END_REF]. The matching between two images im 1 and im 2 corresponds to compute a similarity between two sets of features X(im 1 ) and X(im 2 ). We thus use the following matching method which is a modified version of a decision criterion first proposed by Lowe [START_REF] Lowe | Distinctive image features from scale-invariant keypoints[END_REF]. Given two keypoints x ∈ X(im 1 ) and y ∈ X(im 2 ), we say that x is associated to y iff:

d(x, y) = min {z ∈ X(im2)} d(x, z) and d(x, y) ≤ C d(x, y′) (1)
where C is an arbitrary threshold, d(•, •) denotes the Euclidean distance between the SIFT descriptors and y′ denotes any point of X(im 2 ) whose distance to x is minimal but greater than d(x, y):

d(x, y′) = min {z ∈ X(im2), d(x,z)>d(x,y)} d(x, z) (2)
In other words, x is associated to y if y is the closest point from x in X(im For lines with a n + n, it means that two clients were used on n computer in order to benefit from the dual processor of computers. We can see that using two clients (line 1+1) on the same computer increases the performance. This is due to the fact that the computer used is a dual core processor and each task is single threaded. We can see that using as few as 3 computers is enough to clearly reduce the computation time.

Conclusion and perspectives

We proposed in this paper a new platform dedicated to researchers and engineers in the field of biometrics to develop new algorithms. The computing EvaBio platform permits to launch on different clients some computation tasks to quantify the performance of an algorithm in biometrics. A meta model has also been proposed to characterize a dataset and to facilitate the creation of benchmark and complex scenarios. This meta-model can be used to store the data related to users and biometric sample acquisitions for any biometric modality. It aims to ease the relation between biometric samples and data related to these samples. Thus, a single database, using this meta model, allow researchers to have a single access point for each biometric benchmark stored in it.

We plan to use this model in a platform dedicated to performance evaluation. This tool, containing a distributed computation tool, enables an easy performance evaluation system. The perspective of this work is to create a tool that will enable to easily create the XML file containing the difference computation tasks, used by the distributed computation tool. This tasks list creation tool will rely on this meta-model to have a unique access point to all kind of biometric datasets. We plan to provide this tool for the research community in biometrics.

Figure 1 :

 1 Figure 1: Distribution of genuine and impostor scores

Figure 2 :

 2 Figure 2: ROC curve

  Figure 3 illustrates an example of samples from AR, ENSIB and FACES94 datasets. A detailed description of the used datasets (PolyU FKP and AR datasets) are given in section 4.1.

Figure 3 :

 3 Figure 3: Biometric samples from the AR, ENSIB and FACES94 datasets

Figure 4 :

 4 Figure 4: Computing EvaBio Platform Architecture

Figure 5 :

 5 Figure 5: Meta-Model of a biometric dataset

Figure 6 :

 6 Figure 6: Administration interface

12 Figure 7 :Figure 8 :

 1278 Figure 7: Two biometric samples from the PolyU FKP datasets

Figure 9 :

 9 Figure 9: Two biometric samples from the AR face dataset

Figure 10 :

 10 Figure 10: Application of the meta model to the AR dataset

Figure 11 :

 11 Figure 11: Face verification attempts using SURF descriptor: red lines correspond to a match between two associated keypoints

Table 1 :

 1 An XML Computation Task List description

table 2 .

 2 For the two lines with local, the server and client were on the same computer, and thus does not require any network communication.

	ing result is given in 11(a) and 11(b), respectively. The number of associations
	is used here as a similarity measure.
	This experiment represents the computation required for 30 individuals from
	the AR face dataset, and thus, 900 task were present in an XML file. For a 26
	samples per individual, the definition of the FRR requires 750 comparisons and
	for the FAR 22620 ones. To do so, we used different numbers of clients to realize
	this computation tasks (some are present on the same computer). Results are

2 ) according to the Euclidean distance between SIFT descriptors and if the second smallest value of this distance d(x, y′) is significantly greater than d(x, y). The significance of the necessary gap between d(x, y) and d(x, y′) is encoded by the constant C. Then, we consider that keypoint x is matched to y iff x is associated to y and y is associated to x. An example of a genuine and an impostor match-

Table 2 :

 2 Computation time results for different number of clients.

Acknowledgements

The authors would like to thank the French Research Ministry for their financial support of this work.


Patrick Lacharme
email: patrick.lacharme@ensicaen.fr

Aude Plateaux
email: aude.plateaux@ensicaen.fr

PIN-based cancelable biometrics

Biometric authentication systems are more and more deployed in replacement of traditional authentication systems. Security of such systems is required in realworld applications and constitutes a major challenge in biometric field. An efficient approach of this issue is realized by cancelable biometrics. However, the security of such biometric systems is often overestimated or based on restrictive assumptions. This paper presents and investigates a PIN-based variant for cancelable biometrics applied to fingerprint, achieving 0-EER and templates diversity.

Introduction

Biometric authentication mechanisms are widely used in many security systems, with a large diversity of applications such as e-government or e-commerce. Biometric data are considered as unique for each person and are directly related to its owner. Biometric technologies are consequently supposed to provide stronger authentication than traditional mechanisms or can be deployed in complement of them. Nevertheless, these biometric characteristics are personal data and constitute very sensitive data. Moreover, original biometric data can not be revoked if they are stolen or compromised and this weakness is a critical threat for privacy. Recent results propose a new approach of this problem, using a new biometric template for each applications, without possibilities to recover the original template. This technique, called cancelable biometrics, increases the security and conveniance for users of such biometric systems.

Biometric authentication is traditionally subject to two types of errors, false acceptation and false reject [START_REF] Jain | An introduction to biometric recognition[END_REF]. Performances of such systems are generally described by the two following parameters. The False Acceptance Rate (FAR) relates the possibility for an impostor to be authenticated by the authentication system, whereas the False Rejection Rate (FRR) reports the possibility for a genuine person to be rejected. The level of these parameters is a trade-off, because the reduction of the FAR would naturally increase the FRR, and conversely. Additionally, when these rates are equal, the corresponding rate is called Equal Error Rate (ERR), with: ERR = (FAR+FRR)/2. Thus, perfect biometric systems should have ERR equal to zero, whereas a system with a high ERR could not be used in an operational authentication.

Principle of cancelable biometrics was introduced by Ratha et al. in [START_REF] Ratha | Enhancing security and privacy in biometricsbiased authentication systems[END_REF] and later developped with details in many papers, as [START_REF] Teoh | Cancellable biometrics featuring with tokenised random number[END_REF], [START_REF] Nagar | Biometric template transformation: A security analysis[END_REF], [START_REF] Ratha | Generating cancelable fingerprint templates[END_REF] or [START_REF] Kim | A performance driven methodology for cancelable face templates generation[END_REF]. It attemps to propose an alternative to classical biometric system, for privacy-preserving issues. The approach of this method is to use only cancelable templates for authentication and storage. These cancelable templates are computed from the original biometric template and an additional random value called seed. Consequently, if the cancelable template is leaked or stolen, a new template is computed from the original template and from a new random seed. Moreover, cancelable biometrics allows the generation of different templates for a person, for different applications, with the generation of a new seed. This randomized transformation should verify several criteria as cancelability, diversity and non-invertibility [START_REF] Teoh | Random multispace quantisation as an analytic mechanism for biohashing of biometric and random identity inputs[END_REF], [START_REF] Jain | Biometric template security[END_REF]. The randomized transform is one-way, consequently, this technique achieves the security of the original biometrics template. It should be impossible to recover the original biometric template with the knowledge of the cancelable template and the seed (non invertibility criteria). Moreover, recognition performance must not be reduced by this mechanism and must achieve low error rates. Cancelable biometrics can also be combined in hybrid systems with fuzzy vault [START_REF] Nagar | A hybrid biometric cryptosystem for securing fingerprint minutiae templates[END_REF] or fuzzy commitments [START_REF] Bringer | The best of both worlds: Applying secure sketches to cancelable biometrics[END_REF].

During the verification procedure, cancelable biometrics technique is able to realize very low error rates, comparing to traditional biometric approach. Thus, Teoh et al. [START_REF] Teoh | Biohashing: two factor authentication featuring fingerprint data and tokenised random number[END_REF] perform a biohashing algorithm on fingercode and achieve a 0-EER in a model where the random seed is not compromise. However, the knowledge of the random seed by an impostor is a realizable assumption, because the seed is used during the verification procedure and is generally stored with the cancelable template. The theft of the random seed and its use by an impostor is a classical assumption for the security analysis of cancelable biometric systems. In this situation, the EER is much higher, as presented by Kong et This paper proposes and investigates an alternative to the use of cancelable biometrics for fingerprint template applications, with an additional random value (e.g. a PIN code or a password). Introduction of a secret key or a password, instead of the random seed, was already proposed by several authors as [START_REF] Ang | Cancelable key-based fingerprint templates[END_REF] and [START_REF] Nagar | Biometric template transformation: A security analysis[END_REF], but the security of the system is only based on an additional device (e.g. token, smart card), as for the random seed. Our solution uses a traditional random seed and a PIN code, without assumptions on a secure storage. The PIN code is known by the user, and is only used as an additional security in a scenario where the random seed is stolen and used by an impostor, without the knowledge of the PIN code. This secret is combined with a pseudorandom number generator or a cryptographic hash function and the system achieves 0-EER, cancelling the statistical advantage of an impostor with the knowledge of the random seed on previous cancelable biometric systems.

This article is organized as follows: Section 2 describes the procedure for the construction of a biocode from a fingercode. Two classical attack scenarios: with and without the knowledge of the random seed are presented in Section 3. Finally, Section 4 proposes and evaluates a PIN-based (or password-based) countermeasure for an impostor knowing the random seed.

Cancelable biometrics for fingerprint templates

General process of biometric authentication mechanism requires at high level two operations: Enrollment phasis, when a user is added to a biometric system with acquirement and pre-processing of a biometric template. Verification phasis, when a user presents a new biometric data, attempting to be compared with the template stored during the enrollment phasis.

The biohashing enrollment mechanism requires two steps. In a first time, the biometric feature is computed in an extraction and discretization process for the enrollment procedure. In a second time, this biometric feature is transformed in a template, called biocode, in a Biohashing process, using a one-way function. This process uses a random seed, which should be stored, in order to be re-used during the verification phasis. Furthermore, this transformation is randomized and every enrolled biometric feature uses a different function, in order to create a specific biocode. If this template is compromised, a new biocode is created with a new random seed.

More precisely, the initial biometric feature F is represented by a vector of length n with real numbers values. As for the biocode, it is computed from the random seed and from the biometric feature in a four-step process, as described in [START_REF] Teoh | Biohashing: two factor authentication featuring fingerprint data and tokenised random number[END_REF] and presented in the following simplified way :

1. For i = 1, . . . , n, generate n pseudorandom vectors v i of length n, called pseudorandom matrix, from the random seed.

2. Use the Gram-Schmidt algorithm on the n vectors v i into n orthonormal vectors r 1 , . . . , r n .

3. For i = 1, . . . , n, compute the n scalar products p i =< F, r i > between the biometric feature F and the n orthonormal vectors r i .

4. Compute a n-bit biocode B = (b 0 , . . . , b n ) using the following threshold :

b i = 0 if p i < τ 1 if p i ≥ τ,
where τ is a given threshold.

The verification procedure uses the same random seed, as for the enrollment phasis. Consequently, this latter need to be stored with the biocode template computed in the enrollment phasis. A new biometric feature is extracted for the calculation of a new biocode, using the same algorithm as previously.

Thus, the resulting biocode is compared with the Hamming distance of the original biocode, computed during the enrollment procedure. If the Hamming distance between the two biocodes is lower than a given acceptance rate R (with 0 ≤ R ≤ n), then the new biocode is accepted. Otherwise, the biocode is rejected. Therefore, the value of the acceptance rate R is directly related to FAR and FRR rates. Indeed, if the acceptance rate R is low, then the probability that a genuine biocode is rejected is high. Converselly, if R is high, then the probability that an impostor is accepted is high. 16 20 24 28 32 36 40 FRR 38.9 18 6.8 2.1 0.6 0.2 0 0 FAR 0 0 0 0 0 0 0 0

Basic experiments on fingerprint

This experiment uses the fingerprint database with 800 images of 100 fingers (eight images per finger) issues from the public-domain FCV2002 database [FCV02]. For each of the 100 fingers (or persons) the first template is used for the enrollment phasis and the seven others for the verification phasis. All impressions of the FCV2002 database are used in our experiments, unlike to other experiments realized on the same database, as [START_REF] Lumini | An improved biohashing for human authentication[END_REF] or [START_REF] Belguechi | Biohashing for securing fingerprint minutiae templates[END_REF]. A general reference on fingerprint recognition is given by the book of Maltoni et al. [START_REF] Maltoni | Handbook of Fingerprint Recognition[END_REF].

In this paper, a classical procedure for the minutiae-based extraction procedure, using Gabor filters [START_REF] Jain | Filterbank-based fingerprint matching[END_REF], is adopted. Characteristics of these minutiae are stored in a feature vector with n components, composed of real numbers. This feature vector is called fingercode. In this experiment, a fingercode of size n = 128 is extracted, where each components are real numbers in the range [-128, 128]. Consequently, a pseudorandom matrix composed of 128 pseudorandom vectors of length 128 is generated from the random seed, during the biocode generation (step 1). The threshold τ , used at step 4, is 0.

The first simulation gives the FAR and FRR in a scenario where the random seed is unknown. It is realized with several acceptance rate R : 12, 16, 20, 24, 28, 32, 36 and 40, which means an acceptance rate R between 9.3% and 31% for a feature vector of length 128. Without knowledge of the random seed and with these acceptance rates, the FAR is zero. For an acceptance rate R = 36 or 40, the FRR and consequently the EER is 0, as claimed in [START_REF] Teoh | Biohashing: two factor authentication featuring fingerprint data and tokenised random number[END_REF]. In the Table 1, the detailed FRR are presented for several rates R.

The second simulation investigates the scenario where the impostor has the entire knowledge of the random seed. In this case, the FAR is not null and is sometimes high. The random seed is used during the verification phasis. Consequently, without additional protections, it is not realistic to suppose that this seed is secret. Clearly, the FRR does not depend to the knowledge of the impostor, but only to the acceptance rate R and is the same as presented in Table 1. In this scenario, FAR are given in Table 2 for the same acceptance rates as previously and EER is around 20.

Type of password (1) (2) (3) (4) (5) Entropy 13 19 38 26 52

Table 3: Entropy (in bits) of PIN code and passwords

PIN-based experiments on fingerprint

In this section, we realize a biometric authentication with an additional secret: a PIN code or different types of passwords. This secret value is considered as known only by the user. Consequently, it can not be stolen or compromised by an impostor because it is not stored with the biometric template or anywhere else. This additional secret is completly independant to the random seed and is not used for the generation of the seed or the random matrix. It is introduced and used inside the biohashing algorithm, in addition to the random seed in order to improve the security of the biohashing mechanism, when the seed is compromise by an impostor. The first experiment directly performs the bit wise addition modulo 2 of the password and the biocode. Let p = (p 1 , . . . p l ) be the password described in a binary vector of length l and b = (b 1 , . . . b n ) the biocode obtained at the end of the step 4 of the biohash process. Then, we realize a fifth step in this process in order to have the new biocode

b ′ = (b ′ 1 , . . . , b ′ n ) by b ′ i = b i ⊕ p i if 1 ≤ i ≤ l b i if l + 1 ≤ i ≤ n.
Five types of password are considered in this first experiment: a PIN code with 4 digits (Type 1), a password with 4 or 8 letters (Type 2 or 3) and a password with 4 or 8 letters, ciphers or other characters (Type 4 or 5). Table 3 gives the entropy of these five passwords.

This simulation uses the same fingerprint FCV2002 database as presented in the previous section. It is realized for all acceptance rates R between 12 and 40 (corresponding to acceptance rates R between 9.3% and 31% for a feature vector of length 128). Clearly, the FRR does not change in this scenario from a classical authentication, because the PIN code or the password is known by the user. FAR are presented in Figure 1 for acceptance rates between 12 and 40.

The second experiment uses a PIN code of 4 digits with the pseudorandom number generator of L'Ecuyer [L'E99], producing a pseudorandom binary sequence with large period. This generator combines several linear feedback shift registers (LFSR) and is not cryptographically secure. The following generator, called LFSR113, has a period approximately of 2 113 . It generates random 32-bits numbers and is described by the following source code in C language, given by L'Ecuyer, where z 1 , z 2 , z 3 and z 4 represent the current state of the generator: unsigned long lfsr113(void){ unsigned long b; The PIN-code is completed by zero's and is used as the initial state of the generator, where first outputs are deleted. Then, the n outputs of this generator are words of 32 bits, and p i 's are defined as the less significant bits of each output. Then, p 1 , . . . , p n are introduced in the biohashing process in the same way as previously: the new biocode

b ′ = (b ′ 1 , . . . , b ′ n ) id defined for 1 ≤ i ≤ n, by b ′ i = b i ⊕ p i .
Simulation is realized with acceptance rates R between 12 and 40 and the same fingerprint FCV2002 database, in the scenario where the random seed is known. In all cases, a FAR between 0 and 0.02 is reached, which corresponds to the same rate than with the scenario where the random seed is unknown, as presented in Table 1.

The combination of a PIN code of 4 digits with a pseudorandom number generator cancels the knowledge of the random seed by an impostor, because the advantage of this scenario is only statistical for him. Even if the size of the passwords space is not high (e.g. 10000 for a PIN code of 4 digits), an active impostor has to test each possibilities in order to come back in the situation of the classical attack scenario with knwon seed, which could be not possible even for a PIN code of limited size.

Other pseudorandom number generators, as proposed by the Estream European project for stream ciphers [eST], or a cryptographic hash function as Sha-1 or Sha-256 could be also used on the original PIN code, instead of the LFSR 113 generator.

Conclusion

Biometric authentication systems require additional security schemes for templates revocation and privacy preserving issues. This paper analyzes the security of cancelable biometrics using fingerprinting, in the scenario where the random seed is known. We propose to use an additional PIN code or a password, combined with a pseudorandom number generator or a cryptographic hash function as a countermeasure on this scenario. This mechanism achieves a 0-FAR and a 0-EER. A PIN code is not required to be stored somewhere, and consequently compromise. The choice and the type of passwords depends obviously of the application.

Figure 1 :

 1 Figure 1: PIN-based and password-based cancelable biometrics

  al. [KCZ + 06], Teoh et al. [TKL08] and Lumini and Nanni [LN06].

Table 1 :

 1 FRR and FAR without knowledge of the random seed

	R	12 16 20 24 28 32 36 40
	FAR 7 22 43 65 83 93 98 99

Table 2 :

 2 FAR with knowledge of the random seed