Biometrics is the term that identifies the whole work method to automatically recognize an individual based upon his/her physiological and behavioral characteristics. Biometric methods include facial, fingerprints, hand geometry, handwriting, iris, retinal, vein, and voice recognitions.
In recent years, biometrics are successfully employed in various verification systems using smart cards such as credit cards and eID cards etc... In these systems, biometric trait is compared to the reference data either stored in a database server or a smart card for verification. The biometric reference data is stored as a plaintext, which is insecure, in a database or a smart card in most of such systems. This, however, arises some security and privacy concerns. Unauthorized users may compromise biometric data and bypass biometric control. It is obvious that if legal user’s biometric data is stolen, he will lose the control over them during their lifetime. Moreover, biometrics can reveal personal information about its owner and tracebility problems may arise. A proposed solution to cope with aforementioned threats is to encrypt biometric data stored in a smart card or a database by using cryptographic algorithms. The main drawback of these systems is that the encrypted biometric data stored in a smart card or a database must be decrypted to compare it with the claimer’s data. This makes the systems fragile to possible attacks at the verification stage. Also, there are “key storage and management” problems in these systems. Cancellable biometrics are promising solutions to handle such problems.
Biometric crypto systems, which belong to cancellable biometrics family, that combine crypto tools with signal processing tools are proposed in the scientific literature nowadays. They are very limitedly implemented in the market by industrial companies for only access control systems. Biometric crypto systems offer wide range advantages for current popular markets (eID, access control, e-health, mobile payment etc.), if they are properly designed by using provable secure crypto algorithms and protocols with the efficient signal processing based feature extraction methods.
In PRI-BIOSEC project, the innovation is the proposed uni-modal and multi-modal biometric crypto system. It is a software-intensive system whose outputs are user identities which are irreversible, revocable and can be created multiple times for the same user (revocable and cancellable) by using exactly the same biometric input. The PRI-BIOSEC will also be provably secure system. For instance, imagine that your company uses fingerprint recognition system for the access control system and you need your fingerprint in order to authenticate yourself and enter the company. If an attacker compromises your fingerprint, he can successfully attempt to enter the company. The existing solution for such a problem is to change your finger and give another fingerprint (you have at most 10 chances). On the other hand, with PRI-BIOSEC, you will have thousands of so-called fingerprints and even if attacker compromise one of them, you can easily re-generate a new so-called fingerprint for the system. Nowadays, biometrics are widely used in eID cards, travel documents (e-passports), and e-health systems for authentication purposes and in the near future they will also widely be used in mobile payment application with Near Field Communication technology and Professional Mobile Radios (PMRs). PRI-BIOSEC can be used in such systems without any further deployment.