 

 

.. .I

, .. . i .3 .
:4 ._ . . . . . . . . .h£w.§;ﬁ.cum.
3. .1 3...? .. . . .. .. , . . . 4. 1.. .

5... .._

 

mi:

 

LIBRARY
Michigan State
University

3
I:

 

 

 

This is to certify that the
dissertation entitled

MULTIBIOMETRIC SYSTEMS: FUSION STRATEGIES AND
TEMPLATE SECURITY

presented by

KARTHIK NANDAKUMAR

has been accepted towards fulfillment
of the requirements for the

Ph. D. degree in COMPUTER SCIENCE AND
ENGINEERING

 

 

“My

 

Major Professor’s Signature

Feb LI, 4003

 

Date

MSU is an afﬁrmative-action, equal-opportunity employer

 

 

PLACE IN RETURN BOX to remove this checkout from your record.
To AVOID FINES return on or before date due.
MAY BE RECALLED with earlier due date if requested.

 

DATE DUE DATE DUE DATE DUE

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

5/08 K /Pro;lAcc&Pres/ClRC/DateDue indd

 

MULTIBIOMETRIC SYSTEMS: FUSION STRATEGIES AND
TEMPLATE SECURITY

By

Karthik Nandakumar

A DISSERTATION

Submitted to
Michigan State University
in partial fulﬁllment of the requirements
for the degree of

DOCTOR OF PHILOSOPHY
Department of Computer Science and Engineering

2008

ABSTRACT

MULTIBIOMETRIC SYSTEMS: FUSION STRATEGIES AND TEMPLATE
SECURITY

By
Karthik Nandakumar

Multibiometric systems, which consolidate information from multiple biometric
sources, are gaining popularity because they are able to overcome limitations such as
non-universality, noisy sensor data, large intra—user variations and susceptibility to
Spoof attacks that are commonly encountered in unibiometric systems. In this thesis,
we address two critical issues in the design of a multibiometric system, namely, fusion

methodology and template security.

First, we propose a fusion methodology based on the Neyman-Pear‘son theorem for
combination of match scores provided by multiple biometric matchers. The likeli-
hood mtz'o (LR) test used in the Neyman—Pearson theorem directly maximizes the
genuine accept rate (GAR) at any desired false accept rate (FAR). The densities of
genuine and impostor match scores needed for the LR test are estimated using ﬁnite
Gaussian mixture models. We also extend the likelihood ratio based fusion scheme
to incorporate the quality of the biometric samples. Further, we also Show that the
LR framework can be used for designing sequential multibiometric systems by con-
structing a binary decision tree classiﬁer based on the marginal likelihood ratios of the

individual matchers. The LR framework achieves consistently high recognition rates

across three different multibiometric databases without the need for any parameter
tuning. For instance, on the WVU-l\Iultimodal database, the GAR of the LR fusion
rule is 85.3% at a FAR of 0.001%, which is signiﬁcantly higher than the corresponding
GAR of 66.7% provided by the best single modality (iris). The use of image quality
information further improves the GAR to 90% at a FAR of 0.001%.

Next, we Show that the proposed likelihood ratio based fusion framework is also
applicable to a multibiometric system operating in the identiﬁcation mode. We further
investigate rank level fusion strategies and propose a hybrid scheme that utilizes both
ranks and scores to perform fusion in the identiﬁcation scenario.

While fusion of multiple biometric sources significantly improves the recognition
accuracy, it requires storage of multiple templates for the same user corresponding to
the individual biometric sources. Template security is an important issue in biomet-
ric systems because unlike passwords, stolen biometric templates cannot be revoked.
Hence, we propose a scheme for securing multibiometric templates as a single entity
using the fuzzy vault framework. We have developed fully automatic implementa-
tions of a fingerprint-based fuzzy vault that secures minutiae templates and an iris
cryptosystem that secures iriscode templates. We also demonstrate that a multibio-
metric vault achieves better recognition performance and higher security compared
to a unibiometric vault. For example, our multibiometric vault implementation based
on ﬁngerprint and iris achieves a GAR of 98.2% at a FAR of less than 0.01% and
provides approximately 49 bits of security. The corresponding GAR values of the
individual iris and ﬁngerprint vaults are 88% and 78.8%, respectively. When the iris

and fingerprint vaults are stored separately, the security of the system is only 41 bits.

© Copyright by
KARTHIK NANDAKUMAR
2008

To My Grandfather and Grandmother

ACKNOWLEDGMENTS

First and foremost, I would like to thank my grandfather Shri. P.S. Venkatachari
and my grandmother Smt. P.S. Vanaja for their prayers and blessings. Without
their support and encouragement at crucial periods of my life, it would not have been
possible for me to pursue graduate studies and aim for a career in research. Their hard
work and positive attitude even at the age of 80, is my main source of inspiration. I

am proud to dedicate this thesis and all the good things in my life to them.

I would like to express my Sincere gratitude to my advisor Dr. Anil K. Jain
for providing me the opportunity to work in the exciting and challenging areas of
pattern recognition and biometrics. His constant motivation, support and infectious
enthusiasm have guided me towards the successful completion of my graduate studies.
My interactions with him have been of immense help in deﬁning my research goals
and in identifying ways to achieve them. His encouraging words have often pushed
me to put in my best possible efforts. I would also like to thank him for his guidance
and help in identifying a suitable career path for me. Above all, the complete belief
that he has entrusted upon me has instilled a great sense of conﬁdence and purpose

in my mind, which I am sure will stand me in good stead throughout my career.

I also thank my guidance committee members Dr. George Stockman, Dr. Bill
Punch, Dr. Sarat Dass and Dr. Arun ROSS for their valuable comments and sugges-
tions that have greatly enhanced and shaped this thesis. In particular, I appreciate

vi

Dr. Stockman for the time and effort that he has spent in guiding my research, assist-
ing me in administrative tasks and moulding me professionally. Special thanks also
goes to Dr. Arun Ross and Dr. Sarat Dass for the enlightening research discussions
that have shown me the right path on many occasions. I would also like to thank
Dr. Sharath Pankanti and Dr. Salil Prabhakar for their assistance in the template
security project.

The research in this thesis was supported by grants from the National Science
Foundation (NSF-ITR grant number CNS-0325640), the Army Research Ofﬁce (ARO
grant number W911NF-06—1—0418) and the Center for Identiﬁcation Technology Re-
search at West Virginia University. I would like to thank the NSF, ARC and CITeR
for their generous ﬁnancial support.

I would like to thank all the faculty members in the Department of Computer
Science and Engineering and the Department of Statistics and Probability at Michigan
State University. In particular, I would like to express my thanks to Dr. Abdol
Esfahanian and Dr. Eric Torng for their help as CSE graduate directors, Dr. Li
Xiao for her encouragement and support, Dr. Jon Sticklen for his support during my
tenure as a teaching assistant and his special interest in my research work and career,
Dr. Herman Hughes and Dr. Matt Mutka for their guidance during my ﬁrst year
at MSU and Dr. James Stapleton for his encouragement and help as the graduate
director of the Statistics department. I would also like to express my appreciation
and gratitude to Linda Moore, Debbie Kruch, Cathy Davison, Starr Portice, Norma
Teague, Kim Thompson, Cathy Sparks, Sue Watson and Adam Pitcher for their
administrative assistance and support. I would also like to express my thanks to

vii

Mr. Dale Setlak, Dr. Kuntal Sengupta, Mr. Dick Jones and Dr. Mike Boshra
at Authentec, Inc. and Dr. Srimat T. Chakradhar, Dr. Anand Raghunathan and
Dr. Srivaths Ravi at NBC Labs America, Inc. for the internship opportunities. A
Special word of appreciation for Dr. Chandrasekara Rao Komma for providing me
with accommodation and transportation during my internship at Authentec.

The PRIP lab is an excellent place to work in and it is one place where you can
always ﬁnd good company, no matter what time of the day it is. My interactions with
members of this lab has certainly made me a better professional. Special thanks goes
to Dr. Umut Uludag for helping me acclimatize to the lab during the initial months.
I would also like to thank Dr. Xiaoguang Lu and Unsang Park for their assistance in
the soft biometrics project, Yi Chen for sharing the joys and frustrations in research,
Dr. Hong Chen for all his help during the NEC internship and Dr. Martin Law
who was always ready to help in case of any technical problems. Finally, I would
like to express my gratitUde to other contemporary Prippies Dr. Anoop Namboodiri,
Dr. Dirk Colbry, Yongfang Zhu, Meltem Demirkus, Steve Krawczyk, Jung-Bun Lee,
Pavan Kumar Mallapragada, Abhishek Nagar, Leonardo Max Batista Claudino, and
Miguel Figueroa-Villanue for creating and sustaining a lively and enjoyable research
environment during my ﬁve years of stay in the windowless PRIP lab.

As a person who had never left the comforts of my home and family until I
landed at Michigan State University, 2, 000 days of pleasant and unforgettable life in
Michigan would not have been possible without the company of many great friends.
First of all, I would like to sincerely thank my roommates Arun Prabakaran, Mahesh
Arumugam, Srikanth Sridhar and Sriram Raghunath for their deep camaraderie, emo-

viii

tional support and logistical help. In particular, the idea of doing a PhD with Dr.
Jain would have never crossed by mind but for Mahesh, who had constantly extolled
the virtues of this path and convinced me to follow it. I owe this thesis to him for
all his guidance and help. I am also grateful to Sunil Unikkat, Shankarshna Mad-
havan, Narasimhan Swaminathan, Aravindhan Ravisekar, Prasanna Balasundaram,
Loganathan Anjaneyulu, Raja Ganjikunta, Bruhadeswar Bezawada, Madhusudhan
Srinivasan, Sudharson Sundararajan, Senthil Kumar Venkatesan and Amit Gore for
all the fun-time we had together in Michigan. I am also very grateful to my friends
Mahadevan Balakrishnan, Jayaram Venkatesan, Hariharan Rajasekaran, Balasubra—
manian Rathakrishnan and Balaji Arcot Srinivasan for their long conversations over
phone that helped me feel at home.

Finally, I would like to thank my parents who have been the pillars of strength in
all my endeavors. I am always deeply indebted to them for all that they have given
me. I also thank all the other members of my family including my brother and two

sisters for their love, affection and timely help.

ix

TABLE OF CONTENTS

LIST OF TABLES xiii
LIST OF FIGURES xv
1 Introduction 1
1.1 Biometric Systems .............................. 2
1.2 Biometric Functionalities ........................... 6
1.3 Performance of a Biometric System ..................... 9
1.4 Challenges in Biometrics ........................... 16
1.4.1 Accuracy .................................. 16
1.4.2 Scalability .................................. 21
1.4.3 Security and Privacy ............................ 22
1.5 Summary ................................... 24
1.6 Thesis contributions ............................. 26
2 Multibiometric Systems 28
2.1 Design Issues in Multibiometrics ....................... 32
2.2 Sources of Multiple Evidence ........................ 33
2.3 Acquisition and Processing Sequence .................... 35
2.4 Levels of Fusion ................................ 38
2.4.1 Pbsion Prior to Matching ......................... 39
2.4.2 Fusion After Matching ........................... 43
2.5 Challenges in Multibiometric System Design ................ 46
2.6 Summary .................................. 49
3 Multibiometric Veriﬁcation 55
3.1 Likelihood Ratio Test ............................. 58
3.2 Estimation of Match Score Densities .................... 60
3.2.1 Kernel Density Estimation ......................... 63
3.2.2 GMM-based Density Estimation ..................... 73
3.3 Incorporating Image Quality in Fusion ................... 75
3.3.1 Pairwise Fingerprint Quality ........................ 80
3.3.2 Pairwise Iris Quality ............................ 82
3.4 Likelihood Ratio Based Fusion Rules .................... 83
3.5 Sequential Fusion Using Likelihood Ratio Framework ........... 85
3.6 Experimental Results ............................. 87
3.6.1 Evaluation Procedure ........................... 88
3.6.2 Performance of Likelihood Ratio Based Parallel Fusion ......... 89

3.6.3 Comparison With Other Score Fusion Techniques ............ 90

3.6.4 Comparison of Product and Complete Likelihood Ratio Fusion ..... 97
3.6.5 Performance of Quality-based Fusion ................... 102
3.6.6 Performance of Likelihood Ratio Based Sequential Fusion ....... 102
3.7 Summary ................................... 106
4 Multibiometric Identiﬁcation 110
4.1 Score Level Fusion .............................. 111
4.2 Rank Level Fusion .............................. 115
4.3 Experimental Results ............................. 118
4.4 Summary ................................... 123
5 Multibiometric Template Security 124
5.1 Review of Template Protection Schemes .................. 126
5.1.1 Feature Transformation .......................... 127
5.1.2 Biometric Cryptosystems ......................... 129
5.2 Fuzzy Vault .................................. 134
5.2.1 Fuzzy Vault Implementation ........................ 137
5.3 Proposed Fingerprint-based Fuzzy Vault .................. 139
5.3.1 Vault Encoding ............................... 141
5.3.2 Vault Decoding ............................... 144
5.3.3 Alignment based on High Curvature Points ............... 148
5.4 Proposed Iris Cryptosystem ......................... 156
5.4.1 Helper Data Extraction .......................... 158
5.4.2 Authentication ............................... 161
5.5 Multibiometric Fuzzy Vault ......................... 163
5.6 Experimental Results ............................. 166
5.6.1 Fingerprint-based Vault .......................... 166
5.6.2 Iris Cryptosystem .............................. 176
5.6.3 Multibiometric Vault ............................ 179
5.7 Security Analysis ............................... 181
5.7.1 Fingerprint-based Vault .......................... 182
5.7.2 Iris Cryptosystem .............................. 187
5.7.3 Multimodal Vault .............................. 188
5.8 Summary ................................... 191
6 Conclusions and thure Research 193
6.1 Conclusions .................................. 193
6.2 Future Research Directions .......................... 195
APPENDICES 198
A Databases ................................... 199
A1 Multibiometric Databases ......................... 199
A2 Fingerprint Databases ........................... 201
A3 CASIA Iris Database ............................ 202

xi

B Algorithms .................................. 203

B.1 Determining Discrete Components in a Score Distribution ....... 203
B2 Juels-Sudan Vault Encoding ........................ 206
B3 Juels-Sudan Vault Decoding ........................ 207
B4 Alignment using ICP ............................ 208
BIBLIOGRAPHY 209

xii

1.1

2.1

2.2

2.3

2.4

3.1

5.1

5.2

5.3

5.4

LIST OF TABLES

False reject and false accept rates associated with state-of-the-art ﬁnger-
print, face, voice and iris veriﬁcation systems. Note that the accuracy

estimate of a biometric system depends on a number of test conditions.

Examples of multi-sensor systems .......................
Examples of multi-algorithm systems .....................
Examples of multi-sample and multi—instance systems. ..........

Examples of multimodal systems. ......................

Performance improvement achieved due to likelihood ratio based fusion.
The GAR values in the table correspond to 0.01% FAR. .......

Summary of different template protection schemes. Here, T represents
the biometric template, Q represents the query and K is the key used
to protect the template. In salting and non-invertible feature trans—
form, T represents the transformation function and M represents the
matcher that operates in the transformed domain. In biometric cryp—
tosystems, .7: is the helper data extraction scheme and M is the error
correction scheme that allows reconstruction of the key K. ......

Parameters used for fuzzy vault implementation ...............

Performance of the proposed ﬁngerprint-based fuzzy vault implementation
on FVC2002-DB2 database. Here, n denotes the degree of the encoding
polynomial. The maximum key size that can be secured is 16n bits.
The Failure to Capture Rate (FTCR), Genuine Accept Rate (GAR)
and False Accept Rate (FAR) are expressed as percentages .......

Performance of the proposed ﬁngerprint-based fuzzy vault implementation
on MSU-DBI database. The Failure to Capture Rate (F TCR), Genuine
Accept Rate (GAR) and False Accept Rate (FAR) are expressed as
percentages. ................................

xiii

21

51

52

53

54

90

133

167

171

171

5.5

5.6

5.7

Performance of the multiﬁnger (right and left index ﬁngers) fuzzy vault
on the MSU-DBI ﬁngerprint database. The Failure to Capture Rate
(FTCR), Genuine Accept Rate (GAR) and False Accept Rate (FAR)
are expressed as percentages and the key size is expressed in bits.

Performance of the multimodal (right index ﬁnger and iris) fuzzy vault on
the virtual multimodal database derived from the MSU-DB1 ﬁngerprint
and CASIA iris databases. The Failure to Capture Rate (FTCR), Gen-
uine Accept Rate (GAR) and False Accept Rate (FAR) are expressed
as percentage and the key Size is expressed in bits ............

Security of the proposed fuzzy vault implementations. Here, the security
is measured in terms of HOO(T IV), which represents the average min-
entropy of the biometric template T given the vault V. The parameters
t, r and n represent the total number of points in the vault (genuine
and chaff), number of genuine points in the vault and the degree of the
polynomial used in the vault, respectively. ...............

Summary of multibiometric databases. Note that the NIST-Multimodal,
NIST-Fingerprint and NIST-Face databases are different partitions of
the NIST Biometric Score Set Release-1. ................

Summary of ﬁngerprint databases used in the evaluation of fuzzy vault. .

xiv

180

181

189

203

LIST OF FIGURES

1.1 Examples of body traits that can be used for biometric recognition.
Anatomical traits include face, ﬁngerprint, iris, palmprint, hand ge-
ometry and ear shape, while gait, signature and keystroke dynamics
are some of the behavioral characteristics. Voice can be considered
either as an anatomical or as a behavioral characteristic. ....... 5

1.2 Enrollment and recognition stages in a biometric system. Here, T repre-
sents the biometric sample obtained during enrollment, Q is the query
biometric sample obtained during recognition, X I and X Q are the tem-
plate and query feature sets, respectively, S represents the match score
and N is the number of users enrolled in the database. ........ 8

1.3 Illustration of biometric intra—class variability. Two different impressions
of the same ﬁnger obtained on different days are shown with minu-
tia points marked on them. Due to differences in ﬁnger placement
and distortion introduced by ﬁnger pressure variations, the number
and location of minutiae in the two images are different (33 and 26 in
the left and right images, respectively). The number of correspond-
ing/ matching minutiae in the two images is only 16 and some of these
correspondences have been indicated in the ﬁgure ............ 11

1.4 Performance of a biometric system operating in the veriﬁcation mode.
(a) The genuine and impostor match score densities corresponding to
the Face-G matcher in the NIST BSSRl database. The threshold, 77,
determines the FAR and GAR of the system. (b) Receiver operating
characteristic (ROC) curve for the Face-G matcher which plots the
GAR against FAR on a semi-logarithmic scale .............. 15

1.5 Cumulative match characteristic (CMC) curve for the Face-G matcher in
the NIST BSSRl database which plots the rank-m identiﬁcation rate
for various values of m. In this example, the rank-1 identiﬁcation rate
is a: 78% which means that for z 78% of the queries, the true identity
of the query user is selected as the best matching identity. ...... 17

1.6 Examples of noisy biometric data; (a) A noisy ﬁngerprint image due to

smearing, residual deposits, etc.; (b) A blurred iris image due to loss
of focus. .................................. 18

XV

1.7

2.1

2.2

2.3

2.4

2.5

2.6

3.1

Non-universality of a biometric trait. This ﬁgure shows three impressions
of a user’s ﬁnger in which the ridge details are worn-out. .......

A hypothetical mobile banking application where the user has the ﬂexi-
bility to choose all or a subset of available biometric traits (e.g., face,
voice and ﬁngerprint) for authentication depending on his convenience.
Research is under way to perform iris recognition based on images cap-
tured using the camera on the mobile phone [100] ............

Various sources of information that can be fused in a multibiometric sys-
tem. In four of the ﬁve scenarios (multiple sensors, representations,
instances and samples), multiple sources of information are derived
from the same biometric trait. In the ﬁfth scenario, information is
derived from different biometric traits and such systems are known as
multimodal biometric systems .......................

Acquisition and processing architecture of a multibiometric system; (a)
Serial (Cascade or Sequential) and (b) Parallel. ............

The amount of information available for fusion decreases progressively
after each layer of processing in a biometric system. The raw data
represents the richest source of information, while the ﬁnal decision
(in a veriﬁcation scenario) contains just a single bit of information.
However, the raw data is corrupted by noise and may have large intra-
class variability, which is expected to be reduced in the subsequent
modules of the system. (Reproduced from [169]) ............

Fusion can be accomplished at various levels in a biometric system. Most
multibiometric systems fuse information at the match score level or the
decision level. FE: feature extraction module; MM: matching module;
DM: decision-making module; FM: fusion module ............

Flow of information in a match score level fusion scheme. In this example,
the match scores have been combined using the sum of scores fusion rule
after min-max normalization of each matcher’s output. Note that the
match scores generated by the face and ﬁngerprint matchers are simi-
larity measures. The range of match scores is assumed to be [-—I, +1]
and [0, 100] for the face and ﬁngerprint matchers, respectively.

Non-homogeneity in the match scores provided by the two face matchers
in the NIST-Face database. Note that about 0.2% of the scores output
by matcher 1 are discrete scores with value -1, which are not shown in
this plot. .................................

xvi

18

31

34

36

40

41

45

3.2

3.3

3.4

3.5

3.6

3.7

3.8

Histograms of match scores and the corresponding Gaussian density es-
timates for the Face-G matcher in the NIST BSSRl database. (a)
Genuine and (b) Impostor. Note that the Gaussian density does not
account well for the tail in the genuine score distribution and the mul-
tiple modes in the impostor score distribution ..............

Histograms of match scores and the corresponding generalized density esti-
mates for MSU-Multimodal database. (a) and (b) Genuine and impos-
tor match scores for face modality. (c) and (d) Genuine and impostor
match scores for ﬁngerprint modality. (e) and (f) Genuine and impos-
tor match scores for hand geometry modality. The solid line above
the histogram bins is the density estimated using the kernel density

62

estimator, and the Spikes in (d) correspond to the discrete components. 66

Comparison of continuous and generalized density estimates for impos-
tor match scores provided by the ﬁrst face matcher in the NIST-Face
database. (a) Continuous density estimates in the entire score range
[—1, 1] and only in the range [0.4, 0.7]. (b) Generalized density esti-
mates (T = 0.002) in the entire score range {—1, 1] and only in the
range [0.4, 0.7]. ..............................

Joint density of the genuine match scores output by the two matchers
in the NIST-Face database estimated using (a) product of marginal
densities and (b) copula functions. The density estimate in (b) captures
the correlation between the matchers ...................

Density estimation based on Gaussian mixture models for the genuine
scores in the NIST-Face database. (a) Scatter plot of the genuine scores
along with the ﬁtted mixture components and (b) density estimates of
the genuine scores. In this case, 12 mixture components were found. .

Density estimation based on Gaussian mixture models for the impostor
scores in the NIST-Face database. (a) Scatter plot of the impostor
scores along with the ﬁtted mixture components and (b) density esti-
mates of the impostor scores. In this example, 19 mixture components
were found. ................................

Minutiae extraction results for ﬁngerprint images of varying quality. (a)
A good quality ﬁngerprint image. (b) A noisy ﬁngerprint image. (c)
Minutia points detected in the good quality ﬁngerprint image by an au-
tomatic minutiae extraction algorithm. (d) Minutia points detected in
the noisy ﬁngerprint image. The circles represent true minutia points
while the squares represent false (spurious) minutiae. While no spuri-
ous minutia is detected in the good quality ﬁngerprint image, several
false minutia points are detected when the ﬁngerprint image quality is
poor .....................................

xvii

68

72

76

77

79

3.9

3.10

3.11

3.12

3.13

3.15

3.16

3.17

3.18

3.19

Variation of match score with quality for ﬁngerprint modality in the WVU-
Multimodal database. W . observe that the genuine and impostor
match scores are well-separated only for good quality (with quality
index > 0.5) samples. . .........................

Performance of complete likelihood ratio based fusion rule and linear S\/ M-
based fusion on the NIST-Multimodal database .............

Performance of complete likelihood ratio based fusion rule and SVM—based
fusion on the NIST-Fingerprint database. A radial basis function ker—
nel with 7 = 0.005 was used for SV M fusion ................

Performance of complete likelihood ratio based fusion rule and SVM-based
fusion on the NIST-Face database. A radial basis function kernel with
”y = 0.1 was used for SVM fusion. ..........

Performance of complete likelihood ratio based fusion rule and linear SV M-
based fusion on the XM2VTS—Benchmark database Although there
are 8 different matchers in the XM2VTS-Benchmark database, only
the ROC curves of the best face matcher (DCTb-GMM) and the best.
speech matcher (LFCG-GMM) are Shown for clarity. .........

Performance of complete likelihood ratio based fusion rule and sum
of scores fusion rule with min-max normalization on (a) NIST-
Multimodal database and (b) XM2V'1'S-Benchmark database. In (b),
IT-MM denotes that an inverse tangent function is applied only to the
match scores of the MLP classiﬁers prior to normalizmg all the match
scores using min-max normalization. .................

Distribution of genuine and impostor match scores in the XMQVTS-
Benchmark database for (a) MLP classiﬁer and (b) GMM classiﬁer. ..

Performance of product and complete likelihood ratio based fusion rules
for the two face matchers in the NIST-Face database .........

Performance of product and complete likelihood ratio based fusion rules
for the LFCC~GMM and SSC-GMM speech matchers in the XMQVTS
database. .............................. _ .

Performance of product fusion and quality-based product fusion rules on

the WVU-Multimodal database ......................

A typical sequential fusion rule (decision tree) obtained using the NIST—
Fingerprint database. Here, L1 and L2 represent the marginal log-
likelihood ratios for the left index ﬁnger and right index ﬁnger. respec-
tively. ...................................

A

81

91

92

93

94

103

104

3.20 A typical sequential fusion rule obtained using the NIST-Multimodal

4.1

4.2

4.3

5.1

5.2

5.3

5.4

5.5

5.6

5.7

5.8

database. Here, L1, L2 and L3 represent the marginal log-likelihood
ratios for the left index finger, right index ﬁnger and face modalities,
respectively. ............. g ..................

Cumulative Match Characteristic (CMC) curve of highest rank fusion and
the hybrid score-rank fusion rules on the NIST-Multimodal database
(K = 4, N = 517) ..............................

Cumulative Match Characteristic (CMC) curve of highest rank fusion and

the hybrid score-rank fusion rules on the NIST-Fingerprint. database
(K = 2,N = 6,000). ...........................

Cumulative Match Characteristic (CMC) curve of highest rank fusion and
the hybrid score-rank fusion rules on the NIST—Face database (K 2
2, N = 3, 000) ............................

Categorization of template. protection schemes.

Authentication mechanism when the biometric template is protected using
a feature transformation approach. ...................

Authentication mechanism when the biometric template is secured using
a key generation biometric cryptosystem. Authentication in a key-
binding biometric cryptosystem is similar except that the helper data
is a function of both the template and the key K, i.e., H = .F(T; K).

Schematic diagram of the fuzzy vault scheme proposed by J uels and Sudan
[102] based on ﬁngerprint minutiae. (a) Vault encoding and (b) vault
decoding. .................................

Proposed implementation of vault encoding. ...............

Proposed implementation of vault decoding. (a) Block diagram of the
complete decoding process and (b) details of the ﬁlter used to eliminate
the chaff points ...............................

Algorithm for extraction of high curvature points ..........

Determination of maximum curvature points. (a) Curvature estimation at
point 6 j and (b) trace of curvature for a sample ﬂow curve along with
the local maximum ...........................

xix

107

119

120

122

127

128

130

136

142

14

151

1

0

3

5.9 An example of successful minutiae alignment based on high curvature
points and ICP algorithm. (a) Template image with minutiae and
high curvature points, (b) query image with minutiae and high curva-
ture points (c) template and overlaid query minutiae prior to alignment
and ((1) template and overlaid query minutiae after alignment. In this
ﬁgure, the template minutiae are represented as squares (tails indicate
the minutia direction) and the query minutiae are represented as cir-
cles. The template and query high curvature points are represented as
asterisks and diamonds, respectively. .................. 157

5.10 Schematic diagram of the iris cryptosystem based on iriscode features. (a)
Enrollment or helper data extraction and (b) authentication or key
recovery ................................... 159

5.11 Schematic diagram of a multimodal (ﬁngerprint and iris) fuzzy vault. . . 165

5.12 An example of successful operation of the fuzzy vault. (a) Template ﬁn-
gerprint image with minutiae, (b) selected template minutiae and high
curvature points, (c) vault in which the selected template minutiae
are hidden among chaff points (for clarity, minutiae directions are not
shown), (d) query ﬁngerprint image with minutiae, (e) selected query
minutiae and high curvature points, (f) ICP alignment of template
and query high curvature points and coarse ﬁltering of chaff points,
and (g) unlocking set obtained by applying a minutiae matcher that
eliminates almost all the chaff points. The two points shown in ﬁlled
squares in (g) are the only chaff points that remain in the unlocking
set. Here, ﬁgures (a)-(c) represent vault encoding and (d)-(g) represent
vault decoding. .............................. 169

5.13 Failure due to incorrect extraction of high curvature points. (a) Tem-
plate ﬁngerprint image with minutiae and high curvature points, (b)
query ﬁngerprint image with minutiae and high curvature points, and
(c) ICP alignment of template and query high curvature points along
with aligned template and query minutiae. High curvature points were
incorrectly detected in the template because the high curvature region
is near the boundary ............................ 174

5.14 Failure due to partial overlap. (a) Template ﬁngerprint image with minu-
tiae and high curvature points, (b) query ﬁngerprint image with minu-
tiae and high curvature points, and (c) ICP alignment of template and
query high curvature points along with aligned template and query
minutiae. Though the alignment is accurate, there are only few match-
ing minutiae in these two images. .................... 175

XX

5.15 An example of false accept when n = 8. (a) Template ﬁngerprint image
with minutiae and high curvature points, (b) query ﬁngerprint image
with minutiae and high curvature points, and (c) ICP alignment of
template and query high curvature points along with aligned template
and query minutiae. In (c), we observe that there are 9 matching
minutiae between the query and the template (represented as dotted
ellipses). .................................. 177

Images in this dissertation are presented in color.

Chapter 1

Introduction

Personal identity refers to a set of attributes (e.g., name, social security number, etc.)
that are associated with a person. Identity management is the process of creating,
maintaining and destroying identities of individuals in a population. A reliable iden-
tity management system is urgently needed in order to combat the epidemic growth
in identity theft and to meet the increased security requirements in a variety of appli-
cations ranging from international border crossing to accessing personal information.
Establishing (determining or verifying) the identity of a person is called person recog-
nition or authentication and it is a critical task in any identity management system.
The three basic ways to establish the identity of a person are “something you know”
(e.g., password, personal identiﬁcation number), “something you carry” (e.g., physical
key, ID card) and “something you are” (e.g., face, voice) [44].

Surrogate representations of identity such as passwords and ID cards can be eas-
ily misplaced, Shared or stolen. Passwords can also be easily guessed using social
engineering [136] and dictionary attacks [110]. Hence, the effective security provided

1

by passwords is signiﬁcantly less than the expected security. Studies by the National
Institute of Standards and Technology (N IST) [18] have estimated that on average,
an 8-character ASCII (7 bits/ character) password effectively provides only 18 bits of
entropy, which is much less than the expected 56 bits of security. Moreover, passwords
and ID cards cannot provide vital authentication functions like non-repudiation and
detecting multiple enrollments. For example, users can easily deny using a service
by claiming that their password has been stolen or guessed. Individuals can also
conceal their true identity by presenting forged or duplicate identiﬁcation documents.
Therefore, it is becoming increasingly apparent that knowledge—based and token-based
mechanisms alone are not sufﬁcient for reliable identity determination and stronger

authentication schemes based on “something you are” , namely biometrics, are needed.

1. 1 Biometric Systems

Biometric authentication, or simply biometrics, offers a natural and reliable solution
to the problem of identity determination by establishing the identity of a person based
on “who he is”, rather than “what he knows” or “what he carries” [84]. Biometric
systems automatically determine or verify a person’s identity based on his anatomical
and behavioral characteristics such as ﬁngerprint, face, iris, voice and gait. Biometric
traits constitute a strong and permanent “link” between a person and his identity
and these traits cannot be easily lost or forgotten or shared or forged. Since biometric
systems require the user to be present at the time of authentication, it can also deter
users from making false repudiation claims. Moreover, only biometrics can provide

2

negative identiﬁcation functionality where the goal is to establish whether a certain
individual is indeed enrolled in the system although the individual might deny it.
Due to these reasons, biometric systems are being increasingly adopted in a number
of government and civilian applications either as a replacement for or to complement
existing knowledge and token-based mechanisms. Some of the large scale biometric
systems include the Integrated Automated Fingerprint Identiﬁcation System (IAF IS)
of the FBI [150], the US-VISIT IDENT program [149], the Schiphol Privium scheme
at Amsterdam’s Schiphol airport [176] and the ﬁnger scanning system at Disney
World, Orlando [77].

A number of anatomical and behavioral body traits can be used for biometric
recognition (see Figure 1.1). Examples of anatomical traits include face, ﬁngerprint,
iris, palmprint, hand geometry and ear shape. Gait, signature and keystroke dynamics
are some of the behavioral characteristics that can be used for person authentication.
Voice can be considered either as an anatomical or as a behavioral trait because
certain characteristics of a person’s voice such as pitch, bass/ tenor and nasality are
due to physical factors like vocal tract shape, and other characteristics such as word
or phoneme pronunciation (e.g., dialect), use of characteristic words or phrases and
conversational styles are mostly learned. Ancillary characteristics such as gender,
ethnicity, age, eye color, skin color, scars and tatoos also provide some information
about the identity of a person. However, since these ancillary attributes do not pro-
vide sufficient evidence to precisely determine the identity, they are usually referred
to as soft biometric traits [89]. Each biometric trait has its advantages and limita-
tions, and no single trait is expected to effectively meet all the requirements such as

3

accuracy, practicality and cost imposed by all applications [99]. Therefore, there is
no universally best biometric trait and the choice of biometric depends on the nature

and requirements of the application.

A typical biometric system consists of four main components, namely, sensor,
feature extractor, matcher and decision modules. A sensor is used to acquire the
biometric data from an individual. A quality estimation algorithm is sometimes used
to ascertain whether the acquired biometric data is good enough to be processed
by the subsequent components. When the data is not of sufficiently high quality, it
is usually re—acquired from the user. The feature extractor gleans only the salient
information from the acquired biometric sample to form a new representation of the
biometric trait, called the feature set. Ideally, the feature set should be unique for
each person (extremely small inter-user similarity) and also invariant with respect
to changes in the different samples of the same biometric trait collected from the
same person (extremely small intra-user variability). The feature set obtained during
enrollment is stored in the system database as a template. During authentication,
the feature set extracted from the biometric sample (known as query or input or
probe) is compared to the template by the matcher, which determines the degree of
similarity (dissimilarity) between the two feature sets. The decision module decides
on the identity of the user based on the degree of Similarity between the template

and the query.

Face

Voice

Signature

Gait

   

Palmprint

Figure 1.1: Examples of body traits that can be used for biometric recognition.
Anatomical traits include face. ﬁngerprint, iris, palmprint, hand geometry and ear
shape, While gait, signature and keystroke dynamics are some of the behavioral char-
acteristics. Voice can be considered either as an anatomical or as a. behavioral char-
acteristic.

1.2 Biometric Functionalities

The functionalities provided by a biometric system can be categorized1 as veriﬁcation
and identiﬁcation. Figure 1.2 Shows the enrollment and authentication stages of a bio-
metric system operating in the veriﬁcation and identiﬁcation modes. In veriﬁcation,
the user claims an identity and the system veriﬁes whether the claim is genuine, i.e.,
the system answers the question “Are you who you say you are?”. In this scenario,
the query is compared only to the template corresponding to the claimed identity.
If the user’s input and the template of the claimed identity have a high degree of
similarity, then the claim is accepted as “genuine”. Otherwise, the claim is rejected
and the user is considered an “impostor”. Formally, veriﬁcation can be posed as the
following two-category classiﬁcation problem: given a claimed identity I and a query
feature set XQ, we need to decide if (I,XQ) belongs to “genuine” or “impostor”
class. Let XI be the stored template corresponding to identity I. Typically, XQ is
compared with X I and a match score S, which measures the similarity between XQ

and X I, is computed. The decision rule is given by

genuine, if S 2 77,
(I, XQ) E (1.1)
impostor, if S < 17,
where 77 is a pre—deﬁned threshold. In this formulation, the match score S is assumed

to measure the similarity between XQ and X I, i.e., a large score indicates a good

match. It is also possible for the match score to be a dissimilarity or distance measure

 

1Throughout this dissertation, the terms recognition or authentication will be used interchange-
ably when we do not wish to make a distinction between the veriﬁcation and identiﬁcation
functionalities.

(i.e., a large score indicates a poor match) and in this case, the inequalities in the
decision rule shown in equation (1.1) should be reversed.

Identiﬁcation functionality can be classiﬁed into positive and negative identiﬁca-
tion. In positive identiﬁcation, the user attempts to positively identify himself to
the system without explicitly claiming an identity. A positive identiﬁcation system
answers the question “Are you someone who is known to the system?” by determin-
ing the identity of the user from a known set of identities. In contrast, the user in
a negative identiﬁcation application is considered to be concealing his true identity
from the system. Negative identiﬁcation is also known as screening and the objec-
tive of such systems is to ﬁnd out “Are you who you say you are not?”. Screening
is often used at airports to verify whether a passenger’s identity matches with any
person on a “watch-list”. Screening can also be used to prevent the issue of multi-
ple credential records (e.g., driver’s licence, passport) to the same person. Negative
identiﬁcation is also critical in applications such as welfare disbursement to prevent
a person from claiming multiple beneﬁts (i.e., double dipping) under different names.
In both positive and negative identiﬁcation, the user’s biometric input is compared
with the templates of all the persons enrolled in the database and the system outputs
either the identity of the person whose template has the highest degree of similarity
with the user’s input or a decision indicating that the user presenting the input is not
an enrolled user.

Formally, the problem of identiﬁcation can be stated as follows: given a
query feature set XQ, we need to decide‘the identity I of the user, where I E
{11,12, - -- ,IN,IN+1}. Here, [1,12, . -- ,IN correspond to the identities of the N

7

Enrollment

( User Identity, I

 

 

 

 

 

 

 

 

. -iomein'c . Feature L System

86;:[- Sensor 'T' 7" EMCIOF Database
Veriﬁcation

{ Claimed Identity. I

 

 

 

Genuine/lmpostor

 

Identiﬁcation

 

 

 

 

 

 

User Identity

Figure 1.2: Enrollment and recognition stages in a biometric system. Here, T rep-
resents the biometric sample obtained during enrollment, Q is the query biometric
sample obtained during recognition, X I and XQ are the template and query feature
sets, respectively, S represents the match score and N is the number of users enrolled
in the database.

users enrolled in the system and I N +1 indicates the case where no suitable identity
can be determined for the given query. If X1" is the stored template correspond-
ing to identity In and Sn is the match (similarity) score between XQ and X [71’ for

n = 1, 2, - - - ,N, the decision rule for identiﬁcation is,

Ino, if no = argm1ax Sn and S710 2 r7,

XQ E (1.2)

I N +1, otherwise,

where 17 is a pre-deﬁned threshold. In some practical biometric identiﬁcation systems
such as FBI-IAFIS, identiﬁcation is semi-automated, i.e., the biometric system out-
puts the identities of the top m matches (1 < m < N) and a human expert manually
determines the identity (among the m selected identities) that best matches the given
query. Note that the number of enrolled users in the database can be quite large.
For example, there are more than 80 million subjects in the FBI-IAFIS system [150].
The presence of large number of identities in the database makes the identiﬁcation

task signiﬁcantly more challenging than veriﬁcation.

1.3 Performance of a Biometric System

Samples of the same biometric trait of a user obtained over a period of time can differ
dramatically. The variability observed in the biometric feature set of an individual
is known as intra-user variations. For example, in the case of ﬁngerprints, factors
such as placement of ﬁnger on the sensor, applied ﬁnger pressure, skin condition and
feature extraction errors lead to large intra-user variations [129]. Figure 1.3 shows

9

two impressions of the same ﬁnger obtained on different days. Note how these im-
pressions differ with respect to translation, rotation and non-linear distortion. On
the other hand, features extracted from biometric traits of different individuals can
be quite similar. For example, some pairs of individuals can have nearly identical
facial appearance due to genetic factors (e.g., father and son, identical twins, etc.).
Appearance-based facial features will exhibit a large similarity for these pairs of in-
dividuals and such a similarity is usually referred to as inter-user similarity.

A biometric system can make two types of errors, namely, false non-match and
false match. When the intra—user variation is large, two samples of the same biometric
trait of an individual (mate samples) may not be recognized as a match and this leads
to a false non-match error. A false match occurs when two samples from different
individuals (non-mate samples) are incorrectly recognized as a match due to large
inter-user Similarity. Therefore, the basic measures of the accuracy of a biometric
system are False Non-Match Rate (FNMR) and False Match Rate (FMR). FNMR
refers to the fraction of matches between two mate samples that are not recognized
as a match and FMR is the proportion of matches between two non-mate samples
that are incorrectly recognized as a match.

A False Non-Match Rate of 5% indicates that on average, 5 in 100 genuine at-
tempts do not succeed. A majority of the false non-match errors are usually due to
incorrect interaction of the user with the biometric sensor and can be easily rectiﬁed
by allowing the user to present his/ her biometric trait again. This is similar to the
case where the user in a password—based authentication system makes a mistake while
entering a password and is allowed to reenter the password.

10

    

", ﬂ;
’7be
v“
‘I
\

. ' I“ . 9/” :1
, ,v Q tape“. at...
I ”5‘ \\\\\\\ ? V0 3‘“);
‘/)\‘.‘§, 3 “
. ’ ' a:

k‘
i - "9,,er

\
«2..
‘L
,1
at“

g.

Figure 1.3: Illustration of biometric intra—class variability. Two different impres-
sions of the same ﬁnger obtained on different days are shown with minutia points
marked on them. Due to differences in ﬁnger placement and distortion introduced
by ﬁnger pressure variations, the number and location of minutiae in the two images
are different (33 and 26 in the left and right images, respectively). The number of
corresponding/matching minutiae in the two images is only 16 and some of these
correspondences have been indicated in the ﬁgure.

11

A False Match Rate of 001% indicates that on average, 1 in 10,000 impostor
attempts are likely to succeed. However, it must be emphasized that the security of a
biometric system operating at 0.01% FMR is not equivalent to the security provided
by a 4—digit PIN due to three reasons. Firstly, the adversary has to guess input values
in the biometric feature space, which is requires significantly more effort and domain
knowledge (e.g., knowledge about the features used in a particular biometric system,
the statistical distribution of the features, the format of the stored templates, etc.)
than what is required for guessing a PIN. Secondly, even if the adversary guesses
the feature values, he must circumvent a physical component in the biometric system
(sensor, feature extractor, or communication channels) in order to input the guessed
features. This circumvention can be made very difficult by securing the physical
infrastructure of the biometric system through appropriate techniques such as liveness
detection, secure code execution and cryptographic protocols. Finally, it should be
noted that the effective security provided by a 4—digit PIN is typically much less than
1 success in 10, 000 impostor attempts, because most users tend to use numbers that
are easy to remember (e.g., 1234, year of birth, etc.) and such PINS can be easily
guessed by the adversary in a few attempts.

Apart from false non-match and false match, two other types of failures are also
possible in a practical biometric system. If an individual cannot interact correctly
with the biometric user interface or if the biometric samples of the individual are of
very poor quality, the sensor or feature extractor may not be able to process these
individuals. Hence, they cannot be enrolled in the biometric system and the propor-
tion of individuals who cannot be enrolled is referred to as Failure to Enroll Rate

12

(FTER). In some cases, a particular sample provided by the user during authentica-
tion cannot be acquired or processed reliably. This error is called failure to capture
and the fraction of authentication attempts in which the biometric sample cannot be
captured is known as Failure to Capture Rate (FTCR).

In the context of biometric veriﬁcation, FNMR and FMR are also known as False
Reject Rate (FRR) and False Accept Rate (FAR), respectively. A match score is
termed as genuine or authentic score if it indicates the similarity between two mate
samples. An impostor score measures the similarity between two non-mate samples.
As discussed in section 1.2, a veriﬁcation system makes a decision by comparing the
match score 3 to a threshold 17. Therefore, FRR can be deﬁned as the proportion
of genuine scores that are less than the threshold 17 and FAR can be defined as the
fraction of impostor scores that are greater than or equal to 17. Let fgen(s) = p(S =
3| genuine) and fimp(5) 2 p(5' = slimpostor) be the probability density functions of
the genuine and impostor scores, respectively. The FAR and FRR of the biometric

system are given by

FARO?) = as 2 nli'mpostor) = f" fimpaws, (1.3)

17
FRR(17) = p(S < nlgenuine) = [00 fgen(s)ds. (1.4)

Both FRR and FAR are functions of the system threshold 77. If the threshold is
increased, FAR will decrease but the FRR will increase and vice versa. Hence, for
a given biometric system, it is not possible to decrease both these errors simultane-

13

ously by varying the threshold. The Genuine Accept Rate (GAR) can be used as
an alternative to FRR while reporting the performance of a biometric veriﬁcation
system. GAR is deﬁned as the fraction of genuine scores that exceed the threshold

77. Therefore,

GARM) 2 p(5 2 nlge‘nuine) = 1 — FRR('r]). (1.5)

The FAR and F RR of a biometric veriﬁcation system at different values of thresh-
old 71 can be summarized in the form of a Detection Error Tradeoff (DET) or Receiver
Operating Characteristic (ROC) curve. While the DET plot uses the normal devi-
ate scale, ROC curves are plotted in a linear, semi—logarithmic or logarithmic scale.
Equal Error Rate (EER) is the point in a DET or ROC curve where the FAR equals
the F RR. A lower EER value indicates better performance. In this dissertation, we
plot the ROC curve (GAR against FAR) on the semi-logarithmic scale to summarize
the verification performance. Figure 1.4(a) shows the genuine and impostor score
densities of the Face-G matcher in the NIST-BSSRl database [151] and ﬁgure 1.4(b)

shows the corresponding ROC curve.

The performance of a biometric identiﬁcation system is measured in terms of
the identiﬁcation rate. Identiﬁcation rate is the proportion of times the identity
determined by the system is the true identity of the user providing the query biometric
sample. If the biometric system outputs the identities of the top m matches, the
rank-m identiﬁcation rate, Rm, is deﬁned as the proportion of times the true identity
of the user is contained in the top m matching identities. The identiﬁcation rate at

14

0.14 . . , f

 

 

 

 

 

 

   
 

 

 

 

0.12- Impostor :: *ThreSho'dm) ,
density—>- .
A o_1 p(s|impostor),' : Genuine .
‘21 ' . density
£0.08- .' i p(s|genuine).
E ,' :
g 0.06 . ,
2 l' :
O. 0.04? .5 I ,\
0.02» :U_
"£5 :53" 65 70 {5 so 35
Match score (8)
(8)
100
D
a", 90-
.9
g
‘5. 80-
§ Threshold (11) = 74
< 70- FAR = 0.6%
E GAR = 85.5%
3
C
8 60-
50 _ ‘_ ._ .
10 3 10 2 1o 1 10° 101
False Accept Rate (%)

(b)

Figure 1.4: Performance of a biometric system operating in the veriﬁcation mode. (a)
The genuine and impostor match score densities corresponding to the Face-G matcher
in the NIST BSSRl database. The threshold, 7), determines the FAR and GAR of the
system. (b) Receiver operating characteristic (ROC) curve for the Face-G matcher
which plots the GAR against FAR on a semi-logarithmic scale.

15

different ranks can be summarized using the Cumulative Match Characteristic (CMC)
curve [139] (see Figure 1.5), which plots Rm against 777. for m = 1, 2, - - - ,N, where N
is the number of enrolled users. When the same matcher is used for both veriﬁcation
and identiﬁcation, then the corresponding ROC and CMC curves are related and the

CMC curve can be estimated from the genuine and impostor score densities fgen(s)

and fimp(s) [12,75].

1.4 Challenges in Biometrics

Though biometric systems have been successfully deployed in a number of real-world
applications, biometrics is not yet a fully solved problem. The three main factors
that contribute to the complexity of biometric system design are accuracy (FAR,
GAR and rank-1 identiﬁcation rate), scalability (size of the database) and usability
(ease of use, security and privacy). Jain et al. [92] state that the grand challenge
in biometrics is to design a system that operates in the extremes of all these three
factors. In other words, the challenge is to deve10p a biometric system that is highly
accurate and secure, convenient to use and easily scalable to a large population. We
now discuss the major obstacles that hinder the design of such an “ideal” biometric

system.

1.4. 1 Accuracy

An ideal biometric system should always provide the correct identity decision when
a biometric sample is presented. However, a biometric system seldom encounters a

16

 

(O
01

(O
O

85-

 

Rank—m Identiﬁcation Rate (%)

 

 

 

1 10 20 30 40 50

Rank (m)
Figure 1.5: Cumulative match characteristic (CMC) curve for the Face-G matcher
in the NIST BSSRl database which plots the rank—m identiﬁcation rate for various
values of m. In this example, the rank-1 identiﬁcation rate is a: 78% which means
that for z 78% of the queries, the true identity of the query user is selected as the
best matching identity.

17

sample of a user’s biometric trait that is exactly the same as the template. This
results in a number of errors as discussed in section 1.3 and thereby limits the system

accuracy. The main factors affecting the accuracy of a biometric system [97] are:

 

(a) (b)

Figure 1.6: Examples of noisy biometric data; (a) A noisy ﬁngerprint image due to
smearing, residual deposits, etc.; (b) A blurred iris image due to loss of focus.

 

Figure 1.7: Non-universality of a biometric trait. This ﬁgure shows three impressions
of a user’s ﬁnger in which the ridge details are worn-out.

e Noisy sensor data: Noise can be present in the acquired biometric data mainly
due to defective or improperly maintained sensors. For example, accumulation

18

of dirt or the residual remains on a ﬁngerprint sensor can result in a noisy
ﬁngerprint image as shown in Figure 1.6(a). Failure to focus the camera appro-
priately can lead to blurring in face and iris images (see Figure 1.6(b)). The
recognition accuracy of a biometric system is highly sensitive to the quality of
the biometric input and noisy data can result in a significant reduction in the

GAR of a biometric system [72,204].

Non-universality: If every individual in the target pOpulation is able to present
the biometric trait for recognition, then the trait is said to be universal. Uni-
versality is one of the basic requirements for a biometric identiﬁer. However,
not all biometric traits are truly universal. The National Institute of Standards
and Technology (NIST) has reported that it is not possible to obtain a good
quality ﬁngerprint from approximately two percent of the population (people
with hand-related disabilities, manual workers with many cuts and bruises on
their ﬁngertips, and people with very oily or dry ﬁngers) [189] (see Figure 1.7).
Hence, such people cannot be enrolled in a ﬁngerprint veriﬁcation system. Simi-
larly, persons having long eye-lashes and those suffering from eye abnormalities
or diseases like glaucoma, cataract, aniridia, and nystagmus cannot provide
good quality iris images for automatic recognition [147]. Non-universality leads

to high FTER and FTCR in a biometric system.

Inter-user similarity: Inter-user similarity refers to the overlap of the biomet-
ric samples from two different individuals in the feature Space. The lack of
uniqueness in the biometric feature set restricts the discriminative ability of the

19

biometric system and leads to an increase in the FMR. In the case of a bio-
metric identiﬁcation system, the inherent information constraint in the feature
set results in an upper bound on the number of unique individuals that can be

accommodated.

0 Lack of invariant representation: Biometric samples of an individual usually
exhibit large intra-user variations (see Figure 1.3). The variations may be due
to improper interaction of the user with the sensor (e.g., changes due to ro-
tation, translation and applied pressure when the user places his ﬁnger on a
ﬁngerprint sensor, changes in pose and expression when the user stands in front
of a camera, etc.), use of different sensors during enrollment and veriﬁcation,
changes in the ambient environmental conditions (e.g., illumination changes in
a face recognition system) and inherent changes in the biometric trait (e.g.,
appearance of wrinkles due to aging or presence of facial hair in face images,
presence of scars in a ﬁngerprint, etc.). Ideally, the features extracted from the
biometric data must be relatively invariant to these changes. However, in most
practical biometric systems the features are not invariant and therefore complex
matching algorithms are required to take these variations into account. Large

intra—user variations usually decrease the GAR of a biometric system.

Due to the above factors, the error rates associated with biometric systems are
higher than what is required in many applications. Table 1.1 summarizes the error
rates of ﬁngerprint, face, iris and voice biometric systems obtained through various
technology evaluation tests. Although the error rates presented in Table 1.1 are

20

dependent on a number of test conditions such as the sensor used, the acquisition
protocol, the number and demographic proﬁle of the subjects involved and the time
lapse between successive biometric acquisitions, they provide a good estimate of the
accuracy of state-of—the-art unibiometric systems because these results are obtained
by independent third-party testing of competing algorithms on common databases.
The results of these evaluations clearly indicate that biometric systems have non-zero

error rates and there is scope for improving the accuracy of biometric systems.

Table 1.1: False reject and false accept rates associated with state-of—the—art ﬁnger-
print, face, voice and iris veriﬁcation systems. Note that the accuracy estimate of a
biometric system depends on a number of test conditions.

 

 

Biometric Test Test Conditions False False
Trait Reject Accept

Rate Rate

Fingerprint FVC 2006 [148] Heterogeneous 2.2% 2.2%

population including _
manual workers
and elderly people

 

 

 

 

F pVTE 2003 [204] US. government 0.1% 1%
operational data
Face FRVT 2006 [153] Controlled illumination, 0.8—1.6% 0.1%
high resolution
Voice N IST 2004 [156] Text independent, 5-10% 2-5%
multi-lingual
Iris ICE 2006 [153] Controlled illumination, 1.1-1.4% 0.1%

 

 

 

 

 

broad quality range

 

 

1.4.2 Scalability

In the case of a biometric veriﬁcation system, the size of the database (number of
enrolled users in the system) is not an issue because each authentication attempt

21

basically involves matching the query with a single template. In the case of large
scale identification systems where N identities are enrolled in the system, sequentially
comparing the query with all the N templates is not an effective solution due to two
reasons. Firstly, the throughput.2 of the system would be greatly reduced if the value
of N is quite large. For example, if the size of the database is 1 million and if each
match requires an average of 100 microseconds, then the throughput of the system
will be less than 1 per minute. Furthermore, the large number of identities also affects
the false match rate of the system adversely. Hence, there is a need for efﬁciently
scaling the system. This is usually achieved by a process known as ﬁltering or indexing
where the database is pruned based on extrinsic (e.g., gender, ethnicity, age, etc.) or
intrinsic (e.g., ﬁngerprint pattern class) factors and the search is restricted to a smaller
fraction of the database that is likely to contain the true identity of the user. There
are very few published studies on efficiently indexing biometric databases [9, 52, 73]

and this is still an active area of research in the biometrics community.

1.4.3 Security and Privacy

Although it is difﬁcult to steal someone’s biometric traits, it is still possible for an
impostor to circumvent a biometric system in a number of ways [160]. For example,
it is possible to construct fake or spoof ﬁngers using lifted ﬁngerprint impressions
(e.g., from the sensor surface) and utilize them to circumvent a ﬁngerprint recogni-

tion system [133,134]. Behavioral traits like signature [78] and voice [58] are more

 

2Throughput of a biometric system is defined as the number of queries (authentication attempts)
that can be processed per unit time.

22

susceptible to such attacks than anatomical traits.

The most straightforward way to secure a biometric system is to put all the system
modules and the interfaces between them on a smart card (or more generally a secure
processor). In such systems, known as match-on-card or system-on—card technology,
sensor, feature extractor, matcher and template reside on the card [91]. The advantage
of this technology is that the user’s biometric data never leaves the card which is in
the user’s possession. However, system-on-card solutions are not appropriate for most
large-scale veriﬁcation applications because they are still expensive and users must
carry the card with them at all times. Moreover, system-on—card solutions cannot be
used in identiﬁcation applications.

One of the critical issues in biometric systems is protecting the template of a user
which is typically stored in a database or a smart card. Stolen biometric templates can
be used to compromise the security of the system in the following two ways. (i) The
stolen template can be replayed to the matcher to gain unauthorized access, and (ii) a
physical spoof can be created from the template (see [2,21,171]) to gain unauthorized
access to the system (as well as other systems which use the same biometric trait).
Note that an adversary can covertly acquire the biometric information of a genuine
user (e.g., lift the ﬁngerprint from a surface touched by the user). Hence, spoof
attacks are possible even when the adversary does not have access to the biometric
template. However, the adversary needs to be in the physical proximity of the person
he is attempting to impersonate in order to covertly acquire his biometric trait. On
the other hand, even a remote adversary can create a physical spoof if he gets access

to the biometric template information.

23

Unlike passwords, when biometric templates are compromised, it is not possible
for a legitimate user to revoke his biometric identiﬁers and switch to another set
of uncompromised identiﬁers. Due to this irrevocable nature of biometric data, an
attack against the stored templates constitutes a major security and privacy threat

in a biometric system.

Since a biometric trait is a permanent link between a person and his identity, it can
be easily prone to abuse in such a way that a person’s right to privacy and anonymity
is compromised. A common type of abuse of biometric identiﬁers is function creep [84]
where the acquired biometric identiﬁers are later used for purposes other than the
intended purpose. For example, Disney World in Orlando collects ﬁngerprints from
park visitors in order to prevent customers from sharing the tickets with others [77].
However, it is possible that the same ﬁngerprints may be used later for searching
against a criminal ﬁngerprint database or cross-link it to a person’s health records.
Hence, strategies to prevent function creep and to ensure an individual’s privacy are

urgently needed.

1.5 Summary

Biometric recognition is the process of establishing the identity of a person based on
his anatomical or behavioral characteristics. Since biometric traits provide irrefutable
evidence linking a person to his identity, biometric authentication is a natural and
reliable solution to the problem of establishing the identity of an individual in any
identity management system. While biometric systems offer a number of functional-

24

ities such as veriﬁcation, positive identiﬁcation and screening, these systems are not
perfect. Due to factors like intra—user variations and inter-user similarity, the error
rates associated with biometric systems is non-zero. Besides the accuracy, the high
failure rates (F TER and FTCR), scalability and various vulnerabilities also limit
the deployment of biometric systems in many applications. While rapid progress
has been made in the development and deployment of biometric systems in the past

few decades, a number of core research issues in biometrics have not yet been fully

addressed.

Solutions to advance the state of the art in biometrics include the design of new
sensors that can acquire the biometric traits of an individual in a more reliable, con-
venient and secure manner, the development of invariant representation schemes and
robust and efﬁcient matching algorithms, combining evidence from multiple biometric
sources to compensate for the limitations of the individual sources and the develop-
ment of techniques for liveness detection, template security and privacy enhancement
of biometric systems. In this thesis, we focus on biometric systems that integrate cues
obtained from multiple biometric sources and these systems are commonly referred to
as multibiometric systems. Multibiometric systems offer a number of advantages that
can alleviate the problems associated with traditional (uni)biometric systems. This
thesis addresses two critical issues in the design of a multibiometric system, namely,

fusion methodology and template security.

25

1.6 Thesis contributions

The ﬁrst part of this dissertation addresses the problem of fusion in a multibiomet-
ric system and the second part deals with the problem of multibiometric template

security. The major contributions of this dissertation are as follows.

0 We propose a principled approach based on the likelihood ratio test for fusion of
match scores from multiple biometric matchers in the veriﬁcation scenario. The
proposed fusion framework is based on the Neyman-Pearson theorem, which
guarantees that at any speciﬁed FAR, the likelihood ratio test maximizes the
GAR, provided the genuine and impostor match score densities are known.
We use a semi-parametric density estimation approach, namely, ﬁnite Gaussian
mixture models (GMM) to estimate the joint densities of match scores. We
demonstrate that fusion based on these density estimates achieves consistently
high performance on different multibiometric databases involving face, ﬁnger-
print, iris, and speech modalities. We also extend the likelihood ratio based
fusion scheme to incorporate the quality of the biometric samples and deﬁne
new quality metrics known as pairwise quality indices for ﬁngerprint and iris
images. We also propose a technique based on decision trees to design cascade

multibiometric systems within the likelihood ratio framework.

0 We investigate rank and score level fusion schemes in a multibiometric identi-
ﬁcation system and show that the genuine and impostor likelihood ratios used
in the veriﬁcation scenario can also be applied in the case of identiﬁcation if
we assume that the match scores of the individual users are independent and

26

identically distributed.

We propose a feature level fusion scheme for securing multibiometric templates
using the fuzzy vault framework. The proposed framework can handle multiple
samples (e.g., two impressions from the same ﬁnger), multiple instances (e.g.,
impressions from left and right index ﬁngers of a person) and multiple biomet-
ric traits (e.g., ﬁngerprint and iris). Towards this end, we have developed a
fully automatic implementation of a ﬁngerprint-based fuzzy vault where helper
data derived from the ﬁngerprint orientation ﬁeld is used to align the template
and query minutiae. We have also developed an iris-based fuzzy vault for se-
curing iriscode templates. Finally, we show that a multibiometric vault that
utilizes multiple ﬁngerprint impressions or multiple ﬁngers or ﬁngerprint and

iris achieves better accuracy and security compared to a unibiometric vault.

27

Chapter 2

Multibiometric Systems

Systems that consolidate evidence from multiple sources of biometric information in
order to reliably determine the identity of an individual are known as multibiomet-
ric systems [169]. Multibiometric systems can alleviate many of the limitations of
unibiometric systems because the different biometric sources usually compensate for
the inherent limitations of the other sources [81]. Multibiometric systems offer the

following advantages over unibiometric systems.

1. Combining the evidence obtained from different sources using an effective fusion
scheme can signiﬁcantly improve the overall accuracy of the biometric system.
The presence of multiple sources also effectively increases the dimensionality of
the feature space and reduces the overlap between the feature spaces of different

individuals.

2. Multibiometric systems can address the non-universality problem and reduce
the FTER and FTCR. For example, if a person cannot be enrolled in a ﬁnger-

28

print system due to worn-out ridge details, he can still be identiﬁed using other

biometric traits like face or iris.

. Multibiometric systems can also provide a certain degree of flexibility in user
authentication. Suppose a user enrolls into the system using several different
traits. Later, at the time of authentication, only a subset of these traits may
be acquired based on the nature of the application under consideration and the
convenience of the user. For example, consider a banking application where the
user enrolls into the system using face, voice and ﬁngerprint. During authenti-
cation, the user can select which trait to present depending on his convenience.
While the user can choose face or voice modality when he is attempting to ac-
cess the application from his mobile phone equipped with a digital camera (see
Figure 2.1), he can choose the ﬁngerprint modality when accessing the same

application from a public ATM or a network computer.

. The availability of multiple sources of information considerably reduces the
effect of noisy data. If the biometric sample obtained from one of the sources is
not of sufﬁcient quality during a particular acquisition, the samples from other
sources may still provide sufﬁcient discriminatory information to enable reliable

decision-making.

. Multibiometric systems can provide the capability to search a large database
in a computationally efﬁcient manner. This can be achieved by ﬁrst using a
relatively simple but less accurate modality to prune the database before using
the more complex and accurate modality on the remaining data to perform

29

the ﬁnal identiﬁcation task. This will improve the throughput of a biometric

identiﬁcation system.

6. Multibiometric systems are more resistant to spoof attacks because it is difﬁcult
to simultaneously spoof multiple biometric sources. Further, a multibiometric
system can easily incorporate a challenge-response mechanism during biometric
acquisition by acquiring a subset of the traits in some random order (e.g, left
index ﬁnger followed by face and then right index ﬁnger). Such a mechanism
will ensure that the system is interacting with a live user. Further, it is also
possible to improve the template security by combining the feature sets from

different biometric sources using an appropriate fusion scheme.

Multibiometric systems also have a few disadvantages when compared to unibio-
metric systems. They are more expensive and require more resources for computation
and storage than unibiometric systems. Multibiometric systems generally require ad—
ditional time for user enrollment, causing some inconvenience to the user. Finally, the
accuracy of a multibiometric system can actually be lower than that of the unibio—
metric system if an appropriate technique is not followed for combining the evidence
provided by the different sources. Still, multibiometric systems offer features that are
attractive and as a result, such systems are being increasingly deployed in security-
critical applications (e.g., FBI-IAFIS [150], US-VISIT IDENT program [149], etc).

30

Camera

Van ily mama,

A
“th0 to cuum
H

flu/HI SQCUHW

 

Microphone

    

Fingerprint
Sensor

 

Figure 2.1: A hypothetical mobile banking application where the user has the ﬂex-
ibility to choose all or a subset of available biometric traits (e.g., face, voice and
ﬁngerprint) for authentication depending on his convenience. Research is under way
to perform iris recognition based on images captured using the camera on the mobile
phone [100].

31

2.1 Design Issues in Multibiometrics

The design of a multibiometric system is dependent on the requirements of the appli-
cation. The major issues that need to be considered in the design of a multibiometric

system are described below.

1. Sources of biometric information include multiple sensors, multiple representa-
tions and matching algorithms, multiple samples of the same biometric trait,
multiple instances of a biometric trait and multiple biometric traits. For a given
application, the system designer needs to decide which of these sources should

be used in designing the multibiometric system.

2. The sequence in which the multiple sources of information are acquired and
processed could be serial (cascade or sequential), parallel or hierarchical (tree-
like). Depending on the application scenario, an appropriate acquisition and

processing architecture must be selected.

3. The process of integrating evidence provided by different biometric sources is
known as biometric fusion. Four types of information can be obtained from the
biometric sources, namely, raw biometric samples, feature sets, match scores and
decision labels. Depending on the type of information that is fused, the fusion
scheme can be classiﬁed as sensor level, feature level, score level and decision
level fusion. The choice of the fusion level is the most important design issue
in a multibiometric system and it has a substantial impact on the performance

of the system.

32

4. Given the type of information to be fused, a number of techniques are available
for fusion of information provided by the multiple sources. Many of these fusion
schemes may be admissible in an application and the challenge is to ﬁnd the

Optimal one.

It must be mentioned that a majority of the design decisions are based on a cost-
beneﬁt analysis. Typically, there is a tradeoff between the additional cost and the
improvement in performance of a multibiometric system. The cost could be a function
of the number of sensors deployed, the time required for acquisition and processing
(throughput), performance gain (reduction in FAR/FRR), storage and computational

requirements and perceived (in)convenience to the user.

2.2 Sources of Multiple Evidence

Sources of information in a multibiometric system (see Figure 2.2) may include (i)
multiple sensors to capture the same biometric trait (e.g., face captured using optical
and range sensors), (ii) multiple representations or multiple algorithms for the same
biometric trait (e.g., texture and minutiae-based ﬁngerprint matchers), (iii) multiple
instances of the same biometric trait (e.g., left and right iris), (iv) multiple samples
of the same biometric trait (e.g., two impressions of a person’s right index ﬁnger),
and (v) multiple biometric traits (e.g., face and iris).

In the ﬁrst four scenarios, multiple sources of information are derived from the
same biometric trait. In the ﬁfth scenario, information is derived from different bio-
metric traits and these systems are known as multimodal biometric systems. In fact,

33

biometric fusion can also be carried out on any arbitrary combination of the above
ﬁve sources and such systems can be referred to as hybrid multibiometric systems [26].
An example of a hybrid multibiometric system is the system proposed by Brunelli
et a1. [15] where the results of two speaker recognition algorithms are combined with
three face recognition algorithms at the match score and rank levels using a HyperBF

network. Hence, this system is multi-algorithmic as well as multimodal in its design.

 

i\.
v ,

 

  

Minutiae

  
       

)" ‘ "‘

Right Eye Left Eye

Figure 2.2: Various sources of information that can be fused in a multibiometric
system. In four of the ﬁve scenarios (multiple sensors, representations, instances and
samples), multiple sources of information are derived from the same biometric trait.
In the ﬁfth scenario, information is derived from different biometric traits and such
systems are known as multimodal biometric systems.

34

2.3 Acquisition and Processing Sequence

The order or sequence in which biometric samples are acquired and processed can have
a signiﬁcant impact on the time required for enrollment and authentication, failure to
enroll rate (FTER) and user convenience. Typically, the acquisition and processing
architecture of a multibiometric system is either serial or parallel (see Figure 2.3). In
the serial or cascade or sequential architecture, the acquisition and processing of the
different sources take place sequentially and the outcome of one matcher may affect
the processing of the subsequent sources. In the parallel design, different sources are
processed independently and their results are combined using an appropriate fusion

scheme. Both these architectures have their own advantages and limitations.

In the case of biometric acquisition, both serial and parallel architectures are
quite common. It is usually convenient and cost-effective to acquire physically related
biometric traits simultaneously. For example, face, voice and lip movement can be
simultaneously acquired using a video camera [69]. Similarly, palmprint and hand-
geometry information can be acquired in parallel using a single camera [112]. On the
other hand, when multiple instances of the same trait (e. g., iris images from both the
eyes) or physically unrelated biometric traits (e.g., ﬁngerprint and face) need to be

acquired, the acquisition is usually done sequentially.

Most of the multibiometric systems proposed in the literature follow a parallel
architecture for processing the biometric information. This is because the primary
goal of system designers has been a reduction in the error rate of biometric systems
and the parallel mode of processing generally has a higher accuracy because it utilizes

35

         
   
 

Additional __No—_, _ '
Biometric? DeCISIon

Additional
Biometric?

  

Decision

Decision

 

s #1!

Fusion
‘ FTP + Decision
[ Matching
T

 

(b)

Figure 2.3: Acquisition and processing architecture of a multibiometric system; (a)
Serial (Cascade or Sequential) and (b) Parallel.

36

more evidence about the user for recognition [167,180]. However, a cascading archi-
tecture may have other advantages such as increased user convenience and higher
throughput, which may be useful in large scale identiﬁcation tasks. For example,
when a cascaded multibiometric system has sufﬁcient confidence on the identity of
the user after processing the ﬁrst biometric source, the user may not be required
to provide the other sources of information. The system can also allow the user to
decide which information source he/she would present ﬁrst. Finally, if the system
is faced with the task of identifying the user from a large database, it can utilize
the outcome of each matcher to successively prune the database, thereby making the
search faster and more efﬁcient. Thus, a cascaded system can be more convenient to
the user and generally requires less recognition time when compared to its parallel
counterpart. An example of a cascaded multibiometric system is the one proposed
by Hong and Jain [80]. In this system, face recognition is used to retrieve the top m
matching identities and ﬁngerprint recognition is used to verify these identities and
make a ﬁnal identiﬁcation decision.

The choice of the system architecture depends on the application requirements.
User-friendly and low security applications like bank ATMs can use a cascaded multi-
biometric system. On the other hand, parallel multibiometric systems are more suited
for applications where security is of paramount importance (e.g., access to military
installations). It is also possible to design a hierarchical (tree-like) architecture to
combine the advantages of both cascade and parallel architectures. This hierarchical
architecture can be made dynamic so that it is robust and can handle problems like
missing and noisy biometric samples that often arise in biometric systems [129]. How-

37

ever, the design of a hierarchical multibiometric system has not yet received adequate

attention from researchers.

2.4 Levels of Fusion

One of the fundamental issues in the design of a multibiometric system is to determine
the type of information that should be fused. Depending on the type of information
that is fused, the fusion scheme can be classiﬁed as sensor level, feature level, score
level and decision level fusion. Typically, the amount of information available to the
system decreases as one proceeds from the sensor module to the decision module (see
Figure 2.4). The raw biometric data (e.g., face image in the case of face biometric) has
the highest information content, which gets reduced by subsequent processing (e.g.,
after extraction of PCA features). In the veriﬁcation mode, the ﬁnal decision label
contains only a single bit of information (match or non-match). However, the different
stages of biometric data processing are expected to decrease the intra—user variability
I and the amount of noise that is contained in the available information. Further, in
many practical multibiometric systems, higher levels of information such as the raw
images or feature sets are either not available (e.g., proprietary feature sets used in
commercial-off—the—shelf systems) or the information available from different sources
is not compatible (e.g., ﬁngerprint minutiae and eigenface coefﬁcients). On the other
hand, in most of the multibiometric systems, it is relatively easy to access and combine
the match scores generated by different biometric matchers. Therefore, information

fusion at the match score level offers the best tradeoff in terms of information content

38

and ease in fusion. Consequently, score level fusion is the most commonly used
approach in multibiometric systems.

Figure 2.5 shows examples of fusion at the various levels in a multibiometric
system. The four levels of fusion can be broadly categorized as (i) fusion prior to
matching and (ii) fusion after matching [173]. This distinction is made because once
the biometric matcher is applied, the amount of information available to the system

drastically decreases.

2.4.1 Fusion Prior to Matching

Prior to matching, integration of information from multiple biometric sources can

take place either at the sensor level or at the feature level.

Sensor Level Fusion

The raw data from the sensor(s) are combined in sensor level fusion [83]. Sensor level
fusion can be performed only if the sources are either samples of the same biometric
trait obtained from multiple compatible sensors or multiple instances of the same
biometric trait obtained using a single sensor. For example, multiple 2D face images
obtained from different viewpoints can be stitched together to form a 3D model of
the face [123] or a panaromic face mosaic [207]. Another example of sensor level
fusion is the mosaicing of multiple ﬁngerprint impressions to form a more complete
ﬁngerprint image [40,95,140, 159,212]. In sensor level fusion, the multiple cues must
be compatible and the correspondences between points in the raw data must be either
known in advance (e.g., calibrated camera systems) or reliably estimated.

39

Raw Data Extracted Features Match Score Final decision

94 6,) Genuine/lmpostor

 

 

 

 

 

 

 

 

 

 

 

L / \ J

1.2 MB 22 Bytes 1 Byte 1 Bit

 

 

Figure 2.4: The amount of information available for fusion decreases progressively af-
ter each layer of processing in a biometric system. The raw data represents the richest
source of information, while the final decision (in a veriﬁcation scenario) contains just
a single bit of information. However, the raw data is corrupted by noise and may
have large intra-class variability, which is expected to be reduced in the subsequent
modules of the system. (Reproduced from [169])

Feature Level Fusion

Feature level fusion refers to combining different feature sets that are extracted from
multiple biometric sources. When the feature sets are homogeneous (e.g., multiple
ﬁngerprint impressions of a user’s ﬁnger), a single resultant feature set can be calcu-
lated as a weighted average of the individual feature sets (e. g., mosaicing of ﬁngerprint
minutiae [170]). When the feature sets are non-homogeneous (e. g., feature sets of dif-
ferent biometric modalities like face and hand geometry), we can concatenate them to
form a single feature set. Feature selection schemes can then be applied to reduce the
dimensionality of the resultant feature set [166]. Concatenation is not possible when
the feature sets are incompatible (e. g., ﬁngerprint minutiae and eigenface coefﬁcients).
When the multiple feature sets correspond to different samples of the same biometric
trait that are processed using the same feature extraction algorithm, then feature
level fusion can be considered as template update or template improvement [101].

40

  

Sensor
Level
Fuﬂon

 
    
    

 

Decision
Level
Fusion Right Eye

       
   
 

Feature
Level
Fuﬂon

 
 
    
    
 

Score
Level
Fuﬂon

  
  

Figure 2.5: Fusion can be accomplished at various levels in a biometric system. Most
multibiometric systems fuse information at the match score level or the decision level.
FE: feature extraction module; MM: matching module; DM: decision-making module;
FM: fusion module.

41

Integration at the feature level is difﬁcult to achieve in practice due to the following

reasons:

0 The relationship between the feature spaces of different biometric sources may
not be known. In the case where the relationship is known in advance, care
needs to be taken to discard those features that are highly correlated. This

requires the application of feature selection algorithms prior to classiﬁcation.

0 The feature sets may be incompatible. For example, the minutiae set of ﬁnger-
prints and eigenface coefﬁcients cannot be directly combined because the former
is a variable length feature set whose individual values represent the attributes
of a minutia point while the latter is a ﬁxed length feature set whose individual

values are scalar entities.

o Concatenating two feature vectors results in a feature vector with larger dimen-
sionality which may lead to the ‘curse of dimensionality’ problem [85] where
the classiﬁcation accuracy actually degrades with the addition of new features
due to the limited number of training samples. Although this is a well-known
problem in most pattern recognition applications, it is more severe in biomet-
ric applications because of the time, effort and cost involved in collecting large

amounts of biometric (training) data.

0 Most commercial biometric systems do not provide access to the feature sets

used in their products due to proprietary reasons.

Examples of feature level fusion schemes proposed in the literature can be found in

42

Chibelushi et a1. [37] (voice and lip shape), Son and Lee [182] (face and iris), Kumar
et al. [113] (hand geometry and palmprint) and Ross and Govindarajan [166] (face
and hand geometry). Due to the constraints mentioned above, most of the attempts
at feature level fusion have met with only limited success. Hence, very few researchers
have studied integration at the feature level in a multibiometric system and fusion

schemes at the match score and decision levels are generally preferred.

2.4.2 Fusion After Matching

Schemes for integration of information after the classiﬁcation/matcher stage can be
divided into four categories: dynamic classiﬁer selection, fusion at the decision level,
fusion at the rank level and fusion at the match score level. A dynamic classiﬁer
selection scheme chooses the biometric source that is most likely to give the correct
decision for the speciﬁc input pattern [205]. This is also known as the winner-take-
all approach and the module that performs this selection is known as an associative

switch [30].

Score Level Fusion

Match score is a measure of the similarity between the input and template biometric
feature vectors. When match scores output by different biometric matchers are con-
solidated in order to arrive at a ﬁnal recognition decision, fusion is said to be done
at the match score level. This is also known as fusion at the measurement level or
conﬁdence level. The general ﬂow of information in a match score level fusion scheme
is shown in Figure 2.6. It must be noted that the match scores generated by the indi-

43

vidual matchers may not be homogeneous. For example, one matcher may output a
distance or dissimilarity measure (a smaller distance indicates a better match) while
another may output a similarity measure (a larger similarity value indicates a better
match). Furthermore, the outputs of the individual matchers need not be on the same
numerical scale (range). Finally, the match scores may follow different probability
distributions and may be correlated. These factors make match score level fusion a

challenging problem.

Rank Level Fusion

When the output of each biometric system is a subset of possible matches (i.e., iden-
tities) sorted in decreasing order of conﬁdence, the fusion can be done at the rank
level. This is relevant in an identiﬁcation system where a rank may be assigned to the
top matching identities. Ho et a1. [79] describe three methods to combine the ranks
assigned by different matchers. In the highest rank method, each possible identity
is assigned the best (minimum) of all ranks computed by different systems. Ties are
broken randomly to arrive at a strict ranking order and the ﬁnal decision is made
based on the consolidated ranks. The Borda count method uses the sum of the ranks
assigned by the individual systems to a particular identity in order to calculate the
fused rank. The logistic regression method is a generalization of the Borda count
method where a weighted sum of the individual ranks is used. The weights are deter-
mined using logistic regression. Another technique for rank level fusion is the mixed
group ranks approach [135], which attempts to ﬁnd a tradeoff between the general

44

    
 

   
     

   
 

Face
Matcher

Fingerprint
Matcher

    

      
 
 

    

   
    
     
     
   
  

  

User ; Match User [Match
Identity [ Score Identity 1 Score
screws

Bob

    

-O.4

Score Fusion
Module

Fused

    

Alice
Bob
Chariie

1.47
1.80

0.92
1.00

     
   
  
   

      
   

Figure 2.6: Flow of information in a match score level fusion scheme. In this example,
the match scores have been combined using the sum of scores fusion rule after min—
max normalization of each matcher’s output. Note that the match scores generated
by the face and ﬁngerprint matchers are similarity measures. The range of match
scores is assumed to be [—1, +1] and [0,100] for the face and ﬁngerprint matchers,
respectively.

45

preference for speciﬁc matchers and the conﬁdence in speciﬁc results (as indicated by

the ranks).

Decision Level Fusion

In a multibiometric system, fusion is carried out at the abstract or decision level when
only the decisions output by the individual biometric matchers are available. Many
commercial off-the—shelf (COTS) biometric matchers provide access only to the ﬁnal
recognition decision. When such COTS matchers are used to build a multibiometric
system, only decision level fusion is feasible. Methods proposed in the literature
for decision level fusion include “AND” and “OR” rules [49], majority voting [116],
weighted majority voting [114], Bayesian decision fusion [206], the Dempster-Shafer

theory of evidence [206] and behavior knowledge space [82].

2.5 Challenges in Multibiometric System Design

While multibiometric systems offer several advantages such as better recognition ac-
curacy, increased population coverage, greater security and ﬂexibility, the design of
a multibiometric system is not an easy task. Multibiometric system design is a chal-
lenging problem because it is very difﬁcult to predict the optimal sources of biometric
information and the optimal fusion strategy for a particular application. This difﬁ-

culty arises due to the following factors.

1. Heterogeneity of information sources: Integration at an early stage of
processing is believed to be more effective because the amount of information

46

available to the fusion module decreases as we move from the sensor level to
the decision level. However, fusion at the sensor or feature level is not always
possible due to the heterogeneity or incompatibility of the information content.
For example, in a multibiometric system that uses face and ﬁngerprint, it may
not be possible to fuse either the raw images or the features extracted from

them (e.g., ﬁngerprint minutiae and eigenface coefficients).

. Fusion complexity: Even when the sources of information are compatible
(e.g., two impressions of the same ﬁnger, minutiae sets from two different ﬁn-
gers of an individual, etc.), the complexity of the fusion algorithm may nullify
the advantages of fusion. For instance, fusion at the sensor or feature levels in-
volves additional processing complexities such as registration and design of new
algorithms to match the fused data. Further, the raw data from the sensor and
the extracted feature sets are usually corrupted by various types of noise (e.g.,
background clutter in a face image, spurious minutiae in a ﬁngerprint minutiae
set, etc.) Hence, fusion at the sensor and feature level may not lead to any

performance improvement.

. Varied discriminative ability: The amount of discriminatory information
provided by each biometric source can be quite different. Consider a multi-
biometric system with two matchers A and B, where the matcher A has very
high accuracy compared to matcher B. If a simple fusion rule that assigns equal
weights to the information from the two matchers is employed, the accuracy of
the multibiometric system is likely to be lower than the accuracy of the individ-

47

ual matcher A. Furthermore, some multibiometric systems utilize soft biometric
traits like gender, ethnicity, height, etc., which have signiﬁcantly lower discrim-
inatory information content compared to traditional biometric identiﬁers such
as ﬁngerprint, face and iris. Hence, it is essential to estimate the amount of dis-
criminatory information in each source and assign appropriate weights to the

different sources based on their information content.

. Correlation between sources: In many multibiometric systems, the different
biometric sources may not be statistically independent. Examples of multibio-
metric systems in which different information sources are correlated include
(i) systems using physically related traits (e.g., speech and lip movement of a
user), (ii) multiple matchers operating on the same biometric data or feature
representation (e.g., two different face matchers that operate on the same raw
face image) and (iii) multiple samples of the same biometric trait (e.g., two
impressions of a person’s right index ﬁnger). In general, fusion of independent
evidences can be expected to provide a larger improvement in accuracy com-
pared to fusion of correlated sources. But the impact of correlation among the

biometric sources on the fusion performance is not completely known.

Apart from the above four factors, the conﬂicting performance requirements of an

application also contribute to the difﬁculty of the fusion problem. A typical example

is an identiﬁcation system where both the accuracy and throughput requirements

need to be satisﬁed. While utilizing more sources of evidence increases the accuracy,

it may reduce the throughput of the system and it is hard to ﬁnd the optimal tradeoff

48

between the two. Due to these reasons, information fusion in biometrics is still an
active area of research despite the fact that information fusion has been well studied

in the wider pattern recognition context.

2.6 Summary

Multibiometric system design depends on various factors such as sources of informa-
tion, acquisition and processing architecture, level of information fusion and fusion
methodology. There has been a proliferation of work exploring the fusion of a variety
of biometric sources and discussing different fusion techniques. Tables 2.1, 2.2, 2.3,
and 2.4 summarize some of the representative work in the multibiometrics literature

and these tables have been categorized based on the sources of information used.

From these tables, it is quite apparent that fusion at the match score level has
received the maximum attention from the biometrics community. However, most
of the proposed score level fusion schemes involve ad-hoc techniques for normaliz-
ing the match scores and assigning optimal weights to different matchers. Hence,
one of the goals of this dissertation is to develop a principled statistical framework
for match score fusion in multibiometric systems. Score fusion in a multibiometric
veriﬁcation system can be formulated as a two-class classiﬁcation problem and a sig-
niﬁcant number of training samples are usually available for both the genuine and
impostor classes. On the other hand, fusion in multibiometric identiﬁcation systems
is typically characterized by (i) a large number of classes (identities), (ii) frequent
change in the number of classes during system operation due to addition/deletion

49

of users and (iii) insufﬁcient number of training samples for the individual classes
(often, only one score per matcher is available available for each user). Due to these
reasons, we consider the fusion strategies for veriﬁcation and identiﬁcation systems
separately in this dissertation. In chapter 3, we present a likelihood ratio based fu-
sion framework for multibiometric veriﬁcation systems. The fusion framework for
multibiometric identiﬁcation is presented in chapter 4. Furthermore, while template
security has been receiving substantial attention, the issue of multibiometric template
security has not been adequately addressed in the literature. Therefore, in chapter 5

we develop techniques that can protect multibiometric templates as a single entity.

50

Table 2.1: Examples of multi-sensor systems.

 

 

 

 

 

 

 

 

 

 

Sensors Fused Authors Level of Fusion Methodology
Fusion
Optical and [130] Match Sum and product rules; logistic
capacitive score regression
ﬁngerprint sensors
2D camera and [26] Match Weighted sum and product rules
range scanner for score
face
[124] Match Weighted sum rule; hierarchical
score matching
2D camera and IR [181] Match Weighted sum rule
camera for face score
[31] Match Sum rule; logistic regression
score;
rank
2D camera, range [27] Match Weighted sum rule
scanner and IR score
camera for face
Red, Green, Blue [109] Match Sum and min rules
channels for face score
[166] Feature; Feature selection and
match concatenation; sum rule
score

 

 

 

 

51

 

Table 2.2: Examples of multi-algorithm systems.

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

texture, fuzzy
“interest” line)

 

 

 

 

Representations Authors Level of Fusion Methodology
and/ or Matchers Fusion
Fused
Fingerprint [132, Match Likelihood ratio, weighted sum
(minutiae and 155,168] score rule, sum and product rules,
texture features) perceptron
Face (PCA, LDA, [125, Feature, Sum and max rules, nearest
ICA) 131,166] match neighbor, RBF network, feature
score selection and concatenation
Face (LDA, PM, [45] Match Sum, product, min, max and
HST) score median rules; quadratic Bayes;
Parzen; weighted sum rule
Face (global and [5m Feature ANFIS (Adaptive Neuro—Fuzzy
local features) Inference System); SVM
Face (two different [208] Feature Feature concatenation; two sets of
sets of PCA-based features form the real and
features) imaginary parts of the
concatenated feature vector in the
complex plane
_Signature (global and [64,71] Match Sum and max rules, SVM
local features) score
Hand (geometry and [112] Feature; Feature concatenation; sum rule
texture features) match
score
Voice (SVM and [20] Match Weighted sum rule; perceptron
GMM) score
Voice (multi-level [162] Match Perceptron
features) score
Voice (spectral [165] Match Sum, product, min, max and
features, utterance score median rules; neural network
veriﬁcation)
Voice (LPCC, [107] Feature; Feature concatenation; sum rule;
MFCC, ARCSIN, match majority voting
FMT features) score;
decision
Voice (MFCC, CMS, [172] Feature; Feature concatenation; weighted
MACV features) match sum rule
score
Palmprint (Gabor, [113] Match Sum rule (for Gabor and line
line, score; features) followed by product rule;
appearance-based) decision SVM; neural network; AND rule
Palmprint (geometry, [211] Decision Hierarchical (serial) matching

 

52

 

Table 2.3: Examples of multi-sample and multi-instance systems.

 

 

 

 

 

 

 

 

 

 

 

 

 

Modality Authors Level of Fusion Methodology
Fusion
Fingerprint (10 [204] Match No details are available
ﬁngers) score
Fingerprint (2 [72] Match Sum rule
ﬁngers) score
Fingerprint (2 [155] Match Likelihood ratio computed from
impressions, 2 score non-parametric joint density
ﬁngers) estimates
Fingerprint (2 [95] Sensor; Mosaicing of templates at the
impressions) feature image level; mosaicing of minutiae
sets
.140, Feature Mosaicing of minutiae sets
Face (sequence of 213 Match Temporal integration
images from video) score
[121] Match Temporal integration through
score construction of identity surfaces
Voice (multiple [36] Match Zero sum fusion after sorting of
utterances) score scores

 

 

 

53

 

Table 2.4: Examples of multimodal systems.

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Modalities Fused Authors Level of Fusion Methodology
Fusion
Face and voice [15] Match Geometric weighted average;
score; HyperBF
rank
[108] Match Sum, product, min, max and
score median rules
[6] Match SVM; multilayer perceptron; C4.5
score decision tree; Fisher’s linear
discriminant; Bayesian classiﬁer
[10] Match Statistical model based on
score Bayesian theory
Face, voice and lip [69] Match Weighted sum rule; majority
movement score; voting
decision
Face and ﬁngerprint [80] Match Product rule
score
[180] Match - Sum rule, Weighted sum rule
score
Face, ﬁngerprint and [167] Match Sum rule; decision trees; linear
hand geometry score discriminant function
Face, ﬁngerprint and [88] Match Likelihood ratio
voice score
Face and iris [203] Match Sum rule; weighted sum rule;
score Fisher’s linear discriminant; neural
network
Face and gait [178] Match Sum rule
score
[104] Match Sum and product rules
score
Face and ear 25‘ Sensor Concatenation of raw images
Face and palmprint _60. Feature Feature concatenation
Fingerprint, hand [190] Match Weighted sum rule
geometry and voice score
Fingerprint and [191] Match Reduced multivariate polynomial
hand geometry score model
Fingerprint and 7192] Match Functional link network
voice score
Fingerprint and [65] Match SVM in which quality measures
signature score are incorporated
Voice and signature [111] Match Weighted sum rule
score

 

 

 

 

54

 

Chapter 3

Multibiometric Veriﬁcation

While fusion in a multibiometric veriﬁcation system can be performed at the sensor,
feature, match score and decision levels, score level fusion is generally preferred be—
cause it offers the best trade-off in terms of the information content and the ease in
fusion. One of the challenges in combining match scores is that scores from differ-
ent matchers are typically not homogeneous. Consider the scores provided by the
two face matchers in the NIST-Face database [151]. The scores from the ﬁrst face
matcher are in the range [—1, 1], whereas scores from the second face matcher are in
the range [0, 100] (see Figure 3.1). The match scores of different matchers (i) can be
either distance or similarity measures, (ii) may follow different probability distribu-
tions and (iii) matcher accuracies may be quite different. For example, in the case of
the MSU-Multimodal database [90], the ﬁngerprint matcher outputs similarity scores
whereas the face matcher outputs distance scores; the score distributions for these
two modalities are quite different (see Figure 3.3) and the ﬁngerprint matcher is more
accurate than the face matcher. Biometric matchers may also be correlated as shown

55

in Figure 3.1; the correlation coefficient1 for the genuine and impostor scores of the

two face matchers in Figure 3.1 are 0.7 and 0.3, respectively.

 

 

 

 

%
280
0
§
m
:70 J
8
a
u.
E60‘
2
cf) 50 ,g', e O lmpostor Scores
6' O O 1* Genuine Scores

 

”b4 a5 a6 07 as as 1
Score from Face Matcher 1

Figure 3.1: N on-homogeneity in the match scores provided by the two face matchers

in the NIST-Face database. Note that about 0.2% of the scores output by matcher 1
are discrete scores with value -1, which are not shown in this plot.

Score fusion techniques can be divided into the following three categories.

0 Dunsformation-based score fusion: The match scores are ﬁrst normalized
(transformed) to a common domain and then combined using product, sum, max
or min rules [108]. Choice of the normalization scheme and combination weights

is data-dependent and requires extensive empirical evaluation [90,167,180,190].

o Classiﬁer—based score fusion: Scores from multiple matchers are treated as a fea-

ture vector and a classiﬁer is constructed to discriminate genuine and impostor

 

1In this dissertation, we estimate correlation using the Pearson’s product-moment correlation
coefﬁcient, which measures the strength and direction of linear relationship between two random
variables [164]. The correlation between two matchers is defined as the correlation between the
scores of the two matchers.

56

scores [15,66,127]. When biometric score fusion is considered as a classiﬁcation
problem, the following issues pose challenges. (i) Unbalanced training set: The
number of genuine match scores available for training is 0(N), but the number
of impostor scores is 0(N2), where N is the number of users in the database.
(ii) Cost of misclassification: Depending on the biometric application, the cost
of accepting an impostor may be very different from the cost of rejecting a
genuine user. For example, a biometric system deployed in a security applica-
tion typically is required to have a false accept rate (FAR) of less than 0.1%.
Therefore, the fusion strategy needs to minimize the false reject rate (FRR) at
the speciﬁed FAR values rather than minimizing the total error rate (sum of
FAR and FRR) [155]. (iii) Choice of classiﬁer: Given a variety of admissible
classiﬁers, selecting and training a classiﬁer that gives the optimal performance

(minimum FRR at a speciﬁed FAR) on a given data set is not easy.

Density-based score fusion: This approach is based on the likelihood ratio test
and it requires explicit estimation of genuine and impostor match score densities
[74,155]. The density based approach has the advantage that it directly achieves
optimal performance at any desired operating point (FAR), provided the score
densities can be estimated accurately. In fact, a comparison of eight biometric
fusion techniques conducted by NIST [195] with data from 187,000 subjects
concluded that “Product of Likelihood Ratios was consistently most accurate,
but most complex to implement” and “complexity in this implementation is
in the modeling of distributions, rather than fusion per se”. The statement

57

in [195] about the complexity of density estimation was based on the use of
kernel density estimator (KDE). The selection of kernel bandwidth and density
estimation at the tails proved to be the most complex steps in estimating the

score densities using KDE in [195].

Among the three approaches, density based fusion is a more principled approach
because it achieves optimal fusion performance if the score densities are estimated
accurately. Hence, we follow the density-based score fusion approach in this thesis.
We investigate two different techniques for accurately estimating the genuine and im-
postor match score densities, namely, the Gaussian mixture model (GMM) and the
non-parametric kernel density estimator (KDE). We show that (i) GMM is quite effec-
tive in modeling the genuine and impostor score densities and is simpler to implement
than KDE, (ii) fusion based on the resulting density estimates achieves consistently
high performance on three multibiometric databases involving face, ﬁngerprint, iris,
and speech modalities and (iii) biometric sample quality can be easily incorporated

in the likelihood ratio based fusion framework.

3.1 Likelihood Ratio Test

Let S be a random variable denoting the match score provided by a matcher.
Let the distribution function for the genuine scores be denoted as Fgen(s) (i.e.,
P(S S SIS is genuine) = Fgen(s)) with the corresponding density function fgen(s).
Similarly, let the distribution function for the impostor scores be denoted as Fimp(3)
with the corresponding density function fimp(3)- Suppose we need to decide between

58

the genuine and impostor classes (to verify a claimed identity) based on the observed
match score 3. Let \I' be a statistical test for testing the null hypothesis H0: score
S corresponds to an impostor against the alternative hypothesis H1: score S corre-
sponds to a genuine user. Let \Il(s) = i imply that we decide in favor of Hi, where
i = 0, 1. The probability of rejecting H0 when H0 is true is known as the false accept
rate (also referred to as the size or level of the test). The probability of correctly
rejecting H0 when H1 is true is known as the genuine accept rate (also referred to as

the power of the test). The Neyman-Pearson theorem [118] states that

1. For testing H0 against H1, there exists a test ‘1! and a constant T) such that

POI/(S) = 1|H0) = a (3.1)

and

f 811(3)
1, when j—T > 1),
NS) = f‘m” S) (3.2)

0, when %37:—7;((:—)) < 77.

When fgen(s)/fimp(s) is equal to n, \Il(s) is zero with probability 7 and one
with probability 1— '7. Here, 7 is chosen such that the level of the test is exactly

equal to a.

2. If a test satisﬁes equations (3.1) and (3.2) for some 77, then it is the most powerful

test for testing H0 against H1 at level a.

59

According to the N eyman—Pearson theorem, given the false accept rate (FAR) a, the
optimal test for deciding whether a match score S corresponds to a genuine user or
an impostor is the likelihood ratio test given by equation (3.2). For a ﬁxed FAR,
we can select a threshold 17 such that the likelihood ratio test maximizes the genuine
accept rate (GAR) and there does not exist any other decision rule with a higher
GAR. However, this optimality of the likelihood ratio test is guaranteed only when
the underlying densities are known. In practice, we only have a ﬁnite set of genuine
and impostor match scores, so we need to reliably estimate the densities fgen(s) and

fimp(s) before applying the likelihood ratio test.

3.2 Estimation of Match Score Densities

Density estimation techniques can be classiﬁed as parametric or non-parametric [179].
In parametric density estimation, the form of the density function (e.g., Gaussian) is
assumed to be known and only the parameters of this density function (e.g., mean and
standard deviation) are estimated from the training data. Non-parametric techniques
(e.g., density histogram and kernel density estimator) do not assume any standard
form for the density function and are essentially data-driven. A mixture of densities
whose functional forms are known (e.g., mixture of Gaussians) can also be used for
density estimation. This mixture method can be categorized as either parametric or
semi-parametric depending on whether the number of mixture components is ﬁxed a
priori or is allowed to vary based on the observed data [67].

In the context of biometric systems, it is very difﬁcult to choose a speciﬁc para-

60

metric form for the density of genuine and impostor match scores. It is well known
that the Gaussian density is usually not appropriate for genuine and impostor match
scores because the score distributions generally have a large tail and may have more
than one mode (see Figure 3.2). The simplest non-parametric density estimator is
the histogram method, which has the following limitations [202]: (i) it is sensitive to
the placement of the bin-edges, (ii) it estimates the density by a step function and
(iii) the asymptotic rate of convergence2 of the histogram is lower than that of other
density estimators. Due to the above reasons, we do not use histograms for estimating

the score densities.

Grifﬁn [74] used the following non-parametric approach to estimate the match
score densities. The distribution functions Fgen(s) and Fimp(s) are approximated
using polynomials whose coefﬁcients are obtained empirically from the receiver oper-
ating characteristic (ROC) curve of the biometric matcher. The marginal densities
fgen(s) and fimp(s) are then obtained by differentiating the corresponding distri-
bution functions. Although this method is relatively simple, the main limitation is
that the choice of polynomial degree to be used for approximating the distribution
functions is arbitrary. Further, there is no guarantee that the estimated densities
will converge to the true underlying densities. To overcome these limitations, Prab-
hakar and Jain [155] used kernel density estimators (also known as the Parzen window

method [57]) for estimating the score densities.

 

2The asymptotic rate of convergence of a density estimator is deﬁned as the rate at which the
integrated mean squared error between the true and estimated densities approaches zero as the
number of samples available for density estimation tends to inﬁnity.

61

Frequency

 

0.08 *
0.07 >

 

 

 

65 70 i so

75
Match Score
(a)

 

0.16-
0.14-
0.12-

 

 

 

n "iii-‘1 .;.-=. ‘

55 60

 

65 70 I 75
Match Score

(b)

Figure 3.2: Histograms of match scores and the corresponding Gaussian density es—
timates for the Face-G matcher in the NIST BSSRI database. (a) Genuine and (b)
Impostor. Note that the Gaussian density does not account well for the tail in the
genuine score distribution and the multiple modes in the impostor score distribution.

62

3.2.1 Kernel Density Estimation

In practice, many biometric matchers apply thresholds at various stages in the match-
ing process. When the required threshold conditions are not met, pre—speciﬁed match
scores are output by the matcher. For example, a ﬁngerprint matcher may output
a speciﬁc score value (say 31) if the orientation ﬁeld of the input ﬁngerprint does
not match well with the template; the same matcher may provide a different score
value (say 32) if the number of minutia points in the input ﬁngerprint is less than
a threshold. This leads to discrete components in the match score distribution that
cannot be modeled accurately using a continuous density function. Hence, we propose
a modiﬁed kernel density estimator [48] in which the marginal density is modeled as
a mixture of continuous and discrete components (referred to as generalized density)

and the joint density is estimated using copula functions.

Generalized Marginal Density

A generic score value so is said to be discrete if P(S = so) > 0. In such a situation,
F cannot be represented by a density function in the neighborhood of so (since this
would imply that P(S = so) = 0). Hence, our approach consists of ﬁrst detect-
ing discrete components in the genuine and impostor match score distributions, and
then modeling the observed distribution of match scores as a mixture of discrete and

continuous components.

Given a set of match scores, 8, we ﬁrst identity if there are any discrete compo—
nents in it, namely, score values so with P(S = so) 2 T, where T is a threshold;

63

0 S T _<_ 1. The value of T can be determined using the algorithm described in the
Appendix 8.1. We estimate the probability P(S = so) by #91, where N (so) is the
number of observations in S that equal so and N is the total number of observations.

The collection of all discrete components for a match score distribution is denoted by

D: {so : IVES“) 2 T}. (3.3)

 

The discrete components constitute a proportion PD E 23063 £35,9-) of the
complete set of match scores, 8. We obtain the subset C, C Q S, by removing all
the discrete components from S, C = S — ’D. The scores in C constitute a proportion
p0 _=_- (1 — p D) of 8, and they are used to estimate the continuous component of
the density (fC(s)). The continuous component of match score density is estimated

using a kernel density estimate of fC(s), which is given by

 

foe) = @- : 1c ( g “3). (3.4)

mEC

where [C is a function satisfying ffooo IC(s)ds = 1, called the kernel, h is a positive
number, called the bandwidth of the kernel and NC E N pC. Usually IC is chosen
to be a unimodal probability density function symmetric about zero. We use the
Gaussian kernel (lC(s) = (NS), where (15(5) is the standard normal density) for density
estimation.

The choice of kernel bandwidth is a critical factor in kernel density estimation.
In [155], a simple heuristic was used to estimate the bandwidth of the kernel (set to

0.0167, where (“7 is the standard deviation of the observed match scores). However, the

64

above heuristic is not always optimal and does not provide accurate density estimates
on a variety of multibiometric databases. Hence, we use an automatic bandwidth es-
timator known as “solve-the—equation” bandwidth selector [202] to obtain the optimal
bandwidth. The “solve-the—equation” bandwidth estimator has been shown to give
very good density estimates for a large class of underlying functions. This band-
width estimator minimizes a mean square error criterion asymptotically. In other
words, the density estimate obtained from the “solve-the-equation” bandwidth esti-
mator preserves most of the characteristics (e.g., peaks and tails) of the distribution
of match scores without over-smoothing, thus, achieving a good compromise between
the bias and the variance of the density estimate (see Figure 3.3).

The generalized density (a mixture of discrete and continuous components) is

deﬁned as

- . N s

f(s) =PC fc(s) + Z —]V—°) - I{s = so}. (36)
806D

where I {.L‘ = so} = 1 if s = so, and 0, otherwise. The distribution function corre-

sponding to the generalized density estimate is deﬁned as

 

P(s) =pc [_Soofcww Z ”[30]. (3.6)

306113033
The above approach for estimating the generalized density can be applied to the
genuine and impostor match scores from different matchers. For a multibiometric
system with K matchers, we denote the kth generalized marginal density estimated
from the genuine scores as fgen,k(3)v k = 1,2, . . . , K. The corresponding estimates

65

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

0.04»
°-°35 0.008
0.03 «
§ 0.025 . I: 0.006-
0.02 J
g 0.004
0.015 ]
0'01 0.002
0.005
0 0
20 40 60 00 100
Match Score
_3 (a)
‘ X 10 a:
q r w r .‘u r ‘
3.5
0.2
3
2.5 1 .
E 0. 5
2 2
8 o 1
1.5 -
1
0.05
0.5 ‘ J
”0 200 400 600 000 0 1o 20 30 40 50
Match Scone Match Score
_3 (d)
c x 10
5 .
4 .
E
1 g 3-
2 g '
. sj': ;
1 .
"0 50 100 150 200 250 " 200 400 500 000
Match Scone Match Score
(6) (f )

Figure 3.3: Histograms of match scores and the corresponding generalized density
estimates for MSU-Multimodal database. (a) and (b) Genuine and impostor match
scores for face modality. (c) and (d) Genuine and impostor match scores for ﬁngerprint
modality. (e) and (f) Genuine and impostor match scores for hand geometry modality.
The solid line above the histogram bins is the density estimated using the kernel
density estimator, and the spikes in ((1) correspond to the discrete components.

66

based on the impostor scores are denoted by fimp,k(8)v k = 1,2,...,K. Figure
3.3 gives the plots of fgen,k(5) and fimp,k(5)v k. = 1,2,3 for the distribution of
observed genuine and impostor match scores in the lVISU-lV’IllltlIIlOClal database (see
Appendix for a description of this database). Figure 3.3 also gives the histograms
of the genuine and impostor match scores for the three modalities, namely, face,
ﬁngerprint and hand-geometry. Discrete components were detected only in the case
of impostor match scores of the ﬁngerprint modality; see the “spikes” in Figure 3.3(d)
that represent the detected discrete components for T = 0.008 in equation (3.3).

A comparison between the continuous and generalized density estimates for im-
postor match scores provided by the ﬁrst face matcher in the NIST-Face database is
shown in Figure 3.4. This matcher can output a discrete match score with value —1.
Figure 3.4(a) shows the continuous density estimate over the entire range of scores
([—1,1]) and the same estimate only in the range [04,07] that covers a majority
of the scores. The scores with value —1 affect the kernel bandwidth signiﬁcantly
(h = 0.00001 when the scores with value —1 are present, while h = 0.0027 when they
are removed). As a result, the continuous density estimates of the impostor scores
are not accurate in the range [0.4, 0.7]. On the other hand, the generalized density

estimates shown in Figure 3.4(b) are very accurate in modeling the match scores.

Generalized Multivariate Density Using Copula Models

The methodology described in section 3.2.1 provides only the marginal genuine and
impostor score densities for each of the K matchers. When the matchers are assumed
to be mutually independent, the joint (multivariate) density of the K match scores can

67

    

 

 

 

a} ‘ l
8] ]
i
g 6* l '5 ]
S S 5‘.
o i o
4, . i
i l 4: ]
1
2l 2‘ l
0‘ . 0 ”mm”, “a, d", _m-“ ,. ..
-1 5 0 0.5 0.45 0.5 0.55 0.6 0.65 0.7
MatchScore ‘ , MatchScore
k J
(a)
_17 _i .7 ,v _. , W , 1 1
10 ‘ l
i
‘ 1o~ ]
8 i l i
a] 3
a? s ’5 .
s C
o 6*
o , o
4 . i
i 4’

 

0.15 ”0.5"I0.55A‘0Emo.65 0T7

0 ' . ' i
Web Score \_T_J \ Match Score J

Figure 3.4: Comparison of continuous and generalized density estimates for impostor
match scores provided by the ﬁrst face matcher in the NIST-Face database. (a)
Continuous density estimates in the entire score. range [—1, 1] and only in the range
[04,07]. (b) Generalized density estimates (T = 0.002) in the entire score range
[—1,1] and only in the range [0.4,0.7].

 

68

be estimated as the product of the marginal densities. However, if the matchers are
correlated, it may be important to model the dependence between them. When the
marginal distributions are continuous, the joint density can be directly estimated us-
ing multidimensional kernels. Since the marginal distribution of match scores contains
discrete components, we use copula functions [146] to estimate the multivariate dis-
tribution. The copula-based joint density estimation is semi-parametric because the
marginals are non-parametric and the copula function that combines the marginals
to get the joint density is parametric.

Let H1,H2,...,H K be K continuous distribution functions and H be a K-
dimensional distribution function with the kth marginal given by H k, k = 1,2, . . . , K.
According to Sklar’s theorem [146], there exists a unique function C(u1,u2, . . . ,uK)

from [0, 1]K to [0,1] satisfying

H(81,82, - - - aSK) = C(H1(81),H2(82), - - -,HK(SK)), (3-7)

where 31,...,s K are K real numbers. The function C is known as a K -copu1a
function that “couples” the univariate distributions H1,H2 . . .,H K to obtain the
K -variate distribution H.

We use the family of Gaussian copula functions [34] to model the joint distributions
of match scores3. These functions incorporate the second—order dependence among
the K matchers using a K x K correlation matrix R. The K -dimensional Gaussian

copula function is given by

 

3The Gaussian copula function does not assume that the joint or marginal match score distribu-
tions are Gaussian.

69

C§(u1,u2, . . . ,uK) = <1>§(<1>-1(u1),0-1(u2),. .. ,<I>—1(uK)), (3.8)

where each uk 6 [0,1] for k = 1,2, . . . , K, R is the correlation matrix, <I>(-) is the
distribution function of the standard normal, <I>_1(-) is its inverse, and (Pg is the K -
dimensional distribution function of a random vector Z = (21, Z2, . . . , ZK)T with
component means and variances given by 0 and 1, respectively. The density of 0%,

denoted by 0%, is deﬁned as

 

 

oc§(u1,u2,...,uK) : ¢II§(¢-1(U1),‘I’—1(U2),---,‘I’_1(UK))
01116112 . . . 311K 115:1 ¢((I>-1(uk))

Ill

K
cR(u1,u2,...,uK)

‘)

(3.9)

where (pg (81, 32, . . . , 3K) is the density function of the K -variate normal distribution
with mean 0 and covariance matrix R (since the variance of each component of Z is
1, the covariance matrix is the same as the correlation matrix R), and 05(33) is the
standard normal density.

The (m,n)-th entry of R, pmn, measures the degree of correlation between the

th and nth matchers for m, n = 1, 2, . . . , K. Since the K x K correlation matrix R

m
is unknown, we estimate it using the Pearson’s product-moment correlation of normal
quantiles [164] corresponding to the given match scores from the K matchers. This
method assumes that the K match scores come from the multivariate distribution H
with continuous marginals, H1, H2, . . . , H K- However, the marginals associated with

the genuine and impostor distributions of the K matchers may have discrete compo-

70

nents. Therefore, the generalized distributions are ﬁrst “converted” into continuous
distributions. This is achieved by perturbing each discrete component of ﬁgen,k(3)
and pimp/0(3) through the addition of a Gaussian noise process with mean 0 and stan-
dard deviation 0 = 0.0001. Note that the discrete scores are perturbed only when
estimating R, and not during the estimation of the marginal distributions Fgen,k(3)
and Fimp,k(5)° Hence, the multivariate density obtained by using the copula function

is still a generalized (mixture of discrete and continuous) density.

We model the joint distribution function of genuine match scores for K matchers,
F913,, as shown in equations (3.7) and (3.8) for some correlation matrix Rgen. For
the genuine case, the kth marginal will be estimated by Fgen,k(3) for k = 1, 2, . . . , K.
The joint distribution function of the impostor match scores, Filfnp’ is of the same
form as Fggn, but with a correlation matrix Rimp' In the impostor case, the kth
marginal is estimated by Fimp,k(s) for k = 1,2, . . . , K. Figure 3.5 shows the joint
density estimates of the genuine match scores output by the two matchers in the
NIST-Face database when they are estimated using (i) product of the marginals
(under the assumption of statistical independence) and (ii) copula functions. We can
observe that the joint density estimated using copula functions is able to capture the
correlation between the two face matchers (see Figure 3.5(b)) and hence, is a better

estimate of the underlying genuine match score density.

71

   

0.7 '
85
Match Score 1 0.6

   
 

 

75
0.5 65 70 Match Score2

(a)

0.7
Match Score 1 0.6

    
   
 

80
75

0'5 65 70 Match Score 2

(b)

Figure 3.5: Joint density of the genuine match scores output by the two matchers in
the NIST-Face database estimated using (a) product of marginal densities and (b)
copula functions. The density estimate in (b) captures the correlation between the
matchers.

72

3.2.2 GMM-based Density Estimation

Although the modiﬁed kernel density estimation approach resulted in good fusion
performance [48], it is not clear whether our heuristic used for detecting the discrete
components and the use of a parametric copula function to estimate the joint density
are optimal. To avoid these issues, we employ a well-known technique based on
Gaussian mixture models (GMM) for density estimation [142]. Note that Gaussian
mixture models can be used to estimate arbitrary densities and the theoretical results
in [119,157] show that the density estimates obtained using ﬁnite mixture models

indeed converge to the true density.

Let S = [S 1, $2, - - - , S Kl be the random vector corresponding to the match scores
of K different biometric matchers, where S k is the random variable representing the
match score provided by the kth matcher, k = 1, 2, - - - ,K. Let fgen(s) and fimp(s)
be the conditional joint density of the K match scores given the genuine and impostor
classes, respectively, where s = [31,32, - -- ,sK]. Let ¢K (s; “,2) be the K-variate

Gaussian density with mean vector p and covariance E, i.e.,

¢K(8;M,E) =(2w1—K/2121—1/2 exp (gt — “FE-Rs —— m). (3.10)

The estimates of fgen(s) and fimp(s) are obtained as a mixture of Gaussians as

follows.

73

Algcn

fgenfS) :2 pgenaj¢ [{(8; ”9671.,j’ 2987173.) , (311)
M imp
fimpfs 2; pi'mrj‘lb K(3i“imp.jv 2mm) , (3'12)

where .Mgen (Mimp) is the number of mixture components used to model the density

of the genuine (impostor) scores, ngng‘ (#imp,j) and Egen’j (Zimpj) are the mean

vector and covariance matrix corresponding to the jth mixture component in fgen(s)

(fimp(s)) and Pgen,j (pimpg') is the weight assigned to the jth mixture component in

fgen(s) (fimp(s)l' In equations (3.11) and (3.12), the sum of the component weights
Afgen

isl, i..e ’3': _1 Pgenj =1 ande-wz _1 ppimp,j= 1.

We use the algorithm proposed by Figueiredo and Jain [67] to estimate the param-
eters of the mixture densities in equations (3.11) and (3.12). Selecting the appropriate
number of components is one of the most challenging issues in mixture density estima-
tion; while a mixture with too many components may result in over-ﬁtting, a mixture
with too few components may not approximate the true density well. The GMM ﬁt-
ting algorithm proposed in [67] 4 automatically estimates the number of components
and the component parameters using an EM algorithm and the minimum message
length (MML) criterion. This algorithm is also robust to initialization of parameter

values (mean vectors and covariance matrices) and can handle discrete components in

the match score distribution by modeling the discrete scores as a mixture component

 

4The MATLAB code for this algorithm is available at http://www.1x.it.pt/~mtf/
mixturecode.zip

74

with very small variance. This is achieved by adding a small value (regularization
factor) to the diagonal of the covariance matrices. The actual value of this variance
does not affect the performance as long as it is insigniﬁcant compared to the vari-
ance of the continuous components in the match score distribution. For example, the
lowest value of variance in the match score data used in our experiments is of the
order of 10’3. Hence, we used the value of 10‘5 as the lower bound for the variance.
Our experiments indicate that a value smaller than 10-5 (say, 10‘7 or 10‘9) does
not change the performance of GMM. Since we do not place any restrictions on the
component covariance matrices Egenj and Simp’j, the estimates of the joint densi-
ties fgen(:1:) and fimp(a:) also take into account the correlation between the match
scores. Figures 3.6 and 3.7 show that Gaussian mixture model reliably estimates
the 2-D genuine and impostor densities of the two face matchers in the NIST-Face

database.

3.3 Incorporating Image Quality in Fusion

The quality of acquired biometric data directly affects the ability of a biometric
matcher to perform the matching process effectively. Noise can be present in the
biometric data due to defective or improperly maintained sensors, incorrect user in~
teraction or adverse ambient conditions. For example, when noisy ﬁngerprint images
are processed by a minutiae based ﬁngerprint recognition algorithm, a number of
false (spurious) minutia points will be detected. Figures 3.8(c) and 3.8(d) show the
minutiae extracted from good quality (Figure 3.8(a)) and noisy ﬁngerprint (Figure

75

 

O
O

‘l
O

 

Match Score 2
0
9’

0|
0

 

 

&
O

l
=

 

-1 0:5 0:6 0:7 0:8 0:9 1

        

0.7
Match Score 1 0.6

85

 
  
   

80
70 75

0-5 60 65 Match $50152

 

(b)

Figure 3.6: Density estimation based on Gaussian mixture models for the genuine
scores in the NIST—Face database. (a) Scatter plot of the genuine scores along with
the ﬁtted mixture components and (b) density estimates of the genuine scores. In
this case, 12 mixture components were found.

76

 

 

 

 

 

75-
70-
N :
ﬁes]
a)
L
£60
2
55] i
50* o/#—— -.\ o 4
5‘ ‘~ __ ,,
45— It 045 0.5 0.55 08 065 07
MuchScore1
(a)
4

  
     

75
Match Score 1 0-5 65 70

0.4 55 6° Match ScoreZ

(b)

Figure 3.7: Density estimation based on Gaussian mixture models for the impostor
scores in the NIST—Face database. (a) Scatter plot of the impostor scores along with
the ﬁtted mixture components and (b) density estimates of the impostor scores. In
this example, 19 mixture components were found.

77

3.8(b)) images, respectively, using the minutiae extraction algorithm proposed in [86].
We observe that no false minutia is detected in the good quality ﬁngerprint image
shown in Figure 3.8(0). On the other hand, Figure 3.8(d) shows that several spurious
minutiae are detected in the noisy image. In practice, some true minutiae may not be
detected in poor quality images. These spurious and missing minutiae will eventually
lead to errors in ﬁngerprint matching [32].

Estimating the quality of a biometric sample and predicting the performance of
a biometric matcher based on the estimated quality can be very useful in building
robust multibiometric systems. This will allow us to dynamically assign weights to
the individual biometric matchers based on the quality of the input sample to be
veriﬁed. For example, consider a bimodal biometric system with iris and ﬁngerprint
as the two modalities. Let us assume that during a particular access attempt by the
user, the iris image is of poor quality but the ﬁngerprint image quality is sufﬁciently
good. In this case, we can assign a higher weight to the ﬁngerprint match score and a
lower weight to the iris match score. With this motivation in mind, we now describe
methods for automatically determining the quality of iris and ﬁngerprint images and
incorporating them into the fusion process.

To incorporate sample quality in the likelihood ratio framework, we ﬁrst make
the following observation. Since a poor quality sample will be difﬁcult to classify as
genuine or impostor (see Figure 3.9), the likelihood ratio for such a sample will be
close to 1. On the other hand, for good quality samples, the likelihood ratio will be
greater than 1 for genuine users and less than 1 for impostors. Hence, if we estimate
the joint density of the match score and the associated quality, the resulting likelihood

78

 

(C) ((0

Figure 3.8: Minutiae extraction results for ﬁngerprint images of varying quality. (a)
A good quality ﬁngerprint image. (b) A noisy ﬁngerprint image. (c) Minutia points
detected in the good quality ﬁngerprint image by an automatic minutiae extraction
algorithm. (d) Minutia points detected in the noisy ﬁngerprint image. The circles
represent true minutia points while the squares represent false (spurious) minutiae.
While no spurious minutia is detected in the good quality ﬁngerprint image, several
false minutia points are detected when the ﬁngerprint image quality is poor.

79

ratios will be irnplicity weighted by the respective sample quality. We can still use

the Gaussian mixture based density estimation technique described in section 3.2.2.

To perform quality-based fusion, we need to automatically extract quality in-
formation from the input biometric samples. Since biometric quality estimation is a
challenging task in itself, we demonstrate the advantages of our scheme using only ﬁn-
gerprint and iris modalities for which quality estimators are readily available [32,33].
However, the proposed quality-based fusion scheme is generic and can be applied to
any biometric modality or matcher. Note that the match score depends on the quality
of both the template and query samples, so we need to deﬁne a single quality index,
known as pairwise quality [143], that takes into account the quality of both template
and query images. We now describe techniques to compute the pairwise quality index

for ﬁngerprint and iris modalities.

3.3.1 Pairwise Fingerprint Quality

We estimate the local quality in a ﬁngerprint image using the coherence measure
described in [32]. Let Tf and Q f represent the template and the query ﬁngerprint
images, respectively. We partition Tf and Q f into blocks of size 12 x 12 pixels and
estimate the coherence '7 and ’y’ for each block in Tf and Q f, respectively. Let
M1,...,Mm be the m minutiae in Tf, where M,- =f$ivlli10ilai= 1,...,m. Let
M’,...,M[, be the n minutiae in Qf, where M; = {2:9,y3,03}, j = 1,...,n. Let
7(23, y) and 7’ (:13, y) be the quality (coherence) of the block which contains the location
(at, y) in Tf and Q f, respectively. Let t(;1:, y, A) be the rigid transformation function

80

 

Match Score

  

 

 

 

20 ‘
1 L' 0 lmpostor
g (B * Genuine
0 0“" m 0'" V 0.8 1

.4 0.6
Quality Index
Figure 3.9: Variation of match score with quality for ﬁngerprint modality in the

WVU-Multimodal database. We observe that the genuine and impostor match scores
are well-separated only for good quality (with quality index > 0.5) samples.

that transforms a point (1:, y) in Tf to a point (x’, y’) in Q f. Here, A = [Azt, Ay, A0]
represents the translation and rotation parameters which are estimated using the 2—D
dynamic programming based minutiae matcher described in [93]. Let A and A] be the
area of the ﬁngerprint regions in the template and the query. The area of overlap, A0,
between the ﬁngerprint regions of Tf and Q f can be computed using A. The overall
quality of the match between the template and query ﬁngerprint images, q f(Tf, Q f),

is then deﬁned as follows.

 

2A0
qfin’Qf) = (3.3;?) (m), (3-13)

where

81

.3
II
M3

7(I27yi)7 “(xiayiwAll and
i=1

ﬂ
to
II
II Ms”

I,/' I.
(Ij’yj’— A))’f (‘Ejayjh

Here, 0 5 q f (Tf, Q f) S 1. Note that if a minutia point in the template (query) falls
outside the ﬁngerprint region of the query (template) image, then the quality of that

minutia is set to zero. Given good quality template and query ﬁngerprint images with

large overlap, qf(Tf, Qf) a: 1.

3.3.2 Pairwise Iris Quality

We estimate the quality of match between the template and query iris images using a
modiﬁed version of the wavelet-based iris quality assessment scheme proposed in [33].
The template (Ti) and query (Qt) iris images are segmented into iris and non-iris
regions [33]. A 2-D isotropic Mexican hat wavelet ﬁlter is applied to the iris regions
of T, and Q; at three different scales (0.5, 1.0, 2.0) and the product of the responses
at the three scales is obtained. In order to account for the variations in the pupil
dilation, iris size and rotation, the rubber sheet model proposed by Daugman [50]
is used to normalize the wavelet responses. Let wns be the product of the wavelet
responses at the rth radius (r = 1,...,R) and sth angle (3 = 1,. ..,S) in T,- and
let 11.14., 3 be the corresponding wavelet response in Qi- The average wavelet response
at each radius r is computed as wr (= S'ngzl wns) and 111,. :3 128 ___1w,. 3)

82

in T,- and in respectively. The quality of match between the template and query
iris images, ql(Ti1Qi)’ is deﬁned as the correlation coefﬁcient between the vectors

w = [u11,...,wR] and w’ = ['w’1,...,w;2]. Here, —1 g q,,-(T2',Q,;) S 1.

3.4 Likelihood Ratio Based Fusion Rules

Based on the likelihood ratio test described in section 3.1, we consider three fusion
rules: (i) complete likelihood ratio based fusion, (ii) product fusion and (iii) quality-
based product fusion. The complete likelihood ratio based fusion rule does not involve
any assumptions about the match score densities. I11 this case, the joint density is
directly estimated by ﬁtting the Gaussian mixture model as outlined in section 3.2.
Given a vector of match scores 3 = (31,...,sK) generated by K matchers, the

complete likelihood ratio fusion rule can be stated as,

Assign s to the genuine class if

CLR(s) = 1.162(3)— > r, (3.14)

fimp(3) —
where 7' is the decision threshold that is determined based on the speciﬁed FAR.
The product fusion rule can be used when the matchers are assumed to be inde—
pendent. Here, the joint density of the match scores is estimated as the product of
the marginal densities. For a vector of match scores 3 = (.91, . . . ,sK) generated by

K matchers, the product fusion rule is given by

Assign s to the genuine class if

83

K f s.
-——-—-——.98”’k( k) 2 T, (3.15)
k=1 fimp,k(3k)

PLR(s) =
where fgen,k(') and fimp,k(') are the marginal densities of the genuine and impostor
scores of the kth matcher.

The quality-based product fusion rule assumes independence between the K bio-
metric matchers. However, within each biometric matcher the match score and the
quality measure can be correlated. Let ‘Ik be the quality of the match provided by
the kth matcher, for k = 1,. . .,K. Let fgen,k(3k1qk) ((fimp,k(5k:qkll be the joint
density of the match score and the quality estimated from the genuine (impostor)

template-query pairs of the kth matcher. The quality-based product fusion rule is

given by

Assign s to the genuine class if

K A
3 a
QPLR(s,q) = H {9672,14 ’1: (1k) 2 7'.
k=1 fimp,k(3k1Qk)

 

(3.16)

It is also possible to compute the joint density of the K match scores and K
quality values without assuming the independence of the matchers. However, we do
not consider this rule because it requires estimating the joint density of a rather large
number of variables (K x 2), which may not be reliable with limited training data
that is often encountered in practice.

The likelihood ratio based fusion framework can also be used for fusion of soft
biometric information (e.g., gender, ethnicity and height) with the primary biometric
identiﬁers (e.g., ﬁngerprint and face). For instance, Jain et a1. [89] used the product

84

fusion rule proposed here for fusion of soft and primary biometric traits. This requires

computation of soft biometric likelihoods as described in [169].

3.5 Sequential Fusion Using Likelihood Ratio
Framework

The likelihood ratio based fusion rules proposed in section 3.4 can be applied only in
a multibiometric veriﬁcation system operating in the parallel mode where the scores
from all the matchers are available prior to fusion. However, in some applications a
multibiometric system operating in the cascade or sequential mode (see section 2.3)
may be more appropriate because a sequential system has higher throughput and is
more convenient for the user. For example, when a cascaded multibiometric system
has sufﬁcient conﬁdence on the identity of the user after processing the ﬁrst biometric
source, the user may not be required to provide the other sources of information.
One method to extend the likelihood ratio based fusion framework for a sequential
multibiometric system is to employ the sequential probability ratio test (SPRT) [201].
At stage k in a SPRT, the score (311:) output by the kth matcher is used to compute

the marginal likelihood ratio, Lk, where

__ fgen,k(3kl

. . (3.17)
fimp,k(3k)
Here, fgen,k() and fimp,k() are the marginal densities of the genuine and impostor

scores of the kth matcher and k = 1, 2, . -- ,K. The marginal likelihood ratio (Lk,

85

k = 1, 2, - - - K — 1) is compared to two different thresholds Ak and Bk, where Ak >
Bk- When Lk > Ak, we decide in favor of the genuine class. On the other hand,
if Lk < Bk, we decide in favor of the impostor class. Only when Bk 3 Lk g Ak,
the test proceeds to the next stage (k + 1). At stage K, if no decision has been
made, the process can be truncated by setting A K = B K- While the SPRT is a
principled approach to handle fusion in a cascade multibiometric system, it has the
following limitations. Firstly, determining the optimal values of the thresholds Ak’s
and Bk’s is not an easy task, particularly when the score densities do not have a
simple parametric form. Secondly, the SPRT assumes that the sequence in which the
matchers are to be invoked is ﬁxed a priori. Finally, while Devijver and Kittler [53]
have shown that it is possible to incorporate the cost of invoking a matcher when
determining the thresholds in a SPRT, such an approach adds further complexity in
the threshold determination process. Due to these reasons, we use a simple binary
decision tree classiﬁer [57] based on the marginal score densities of the individual
matchers to extend the likelihood ratio framework for the sequential fusion scenario.

During the training phase, the marginal genuine and impostor score densities
are estimated as described in section 3.2 and the marginal likelihood ratios of the
training samples are obtained. The marginal likelihood ratios are treated as features
and are used to train a binary decision tree classiﬁer using the C45 decision tree
learning algorithm [57]. During the authentication phase, the biometric modalities
are acquired and the marginal likelihood ratios are computed in the order in which the
different modalities appear in the decision tree starting from the root node. The main
advantage of the decision tree based approach for sequential fusion is its simplicity in

86

terms of learning and implementation. However, the major limitation of this approach
is that it is not straightforward to control the tree complexity (number of levels in
the tree and positions of the leaf nodes). Since the goal of a cascade multibiometric
system is to increase the throughput and user convenience, the number of levels in
the tree should be small and the leaf nodes should be as close as possible to the top of
the tree (especially for the genuine class), thereby favoring early decisions. Heuristic
pruning approaches are needed to obtain a decision tree that satisﬁes the above two

requirements.

3.6 Experimental Results

The performances of likelihood ratio based fusion rules were evaluated on two public-
domain databases, namely, NIST-BSSRl and XM2VTS-Benchmark databases. The
performance of the quality-based product fusion rule was evaluated only on the WVU-
Multimodal database since the other databases do not contain raw ﬁngerprint and iris
images to enable us to estimate the biometric sample quality. A description of these
multibiometric databases can be found in the Appendix. Density estimates based
on both the modiﬁed kernel density estimator and Gaussian mixture model-based
estimator lead to almost identical fusion results on all the databases. Therefore, we
report only the performance of GMM-based density estimation in the subsequent

sections.

87

3.6.1 Evaluation Procedure

For each experiment, half of the genuine and impostor match scores were randomly
selected to be in the training set for estimating the marginal densities and the corre—
lation matrices5. The remaining genuine and impostor scores were used for analyzing
the effectiveness of the fusion rules. The above training—test partitioning was repeated
m times (m = 20) and the reported ROC curves correspond to the mean GAR values
over the m trials at different FAR values.

The following procedure is used to test if the difference in performances of two
different fusion algorithms is signiﬁcant. Let GA,- and GB,- be the GAR of two
different fusion rules A and B, respectively, at a speciﬁc value of FAR for the ith
trial, i = 1, . -- ,m. Let D,- = (GA,- — GBi) be the difference between the GAR
values of the two rules for the ith trial and let [u D be the expected difference. If we
assume that Di’s are independent and normally distributed with variance 02D, then
hypotheses about a D can be tested using a paired t test [164]. To determine if the
performance of rule A is better than that of rule B, we test the null hypothesis Ho:
a D S 0 against the alternative hypothesis H1: ,u D > 0. Here, rejecting the null
hypothesis indicates that the performance of rule A is better than that of rule B.

The test statistic is given by

D

t: —,
SD/x/TTL

(3.18)

 

5 For experiments on the XM2VTS—Benchmark database, we do not randomly partition the score
data into training and test sets because this partitioning is already deﬁned by the Lausanne Protocol-
1 [154]. Hence, confidence intervals are not estimated for experiments with the XM2VTS-Benchmark
database.

88

where B and s D are the sample mean and standard deviation, respectively, of the
Di’s, i = 1,--- ,m. For an a level test, the null hypothesis must be rejected if
t Z t(

where t( ) is the value such that a fraction 0 of the area under

ohm—1)? a,m—1
the t distribution with m — 1 degrees of freedom lies to the right of ta,m—1- The
100(1 — a)% conﬁdence interval for #D is given by B :l: t(a/2,m-1)SD/\/T7i’ Here, a
100(1 - a)% conﬁdence interval denotes that if the database is randomly partitioned
into training and test sets a large number of times and if the conﬁdence interval is

estimated for these trials, then 95% of these conﬁdence intervals would contain the

true value of #D- The value of a is set to 0.05 in our experiments.

3.6.2 Performance of Likelihood Ratio Based Parallel Fusion

The performance of complete likelihood ratio based fusion rule was evaluated on the
three partitions of the N IST -BSSR1 database and the XM2VTS—Benchmark database.
The receiver operating characteristic (ROC) curves of the individual matchers and
the likelihood ratio based fusion rule for these databases are shown in Figures 3.10,
3.11, 3.12 and 3.13. As expected, likelihood ratio based fusion leads to signiﬁcant
improvement in the performance compared to the best single modality on all the four
databases. At a false accept rate (FAR) of 0.01%, the improvement in the genuine
accept rate (GAR) achieved due to likelihood ratio based fusion is presented in Table
3.1. We observe that the 95% conﬁdence intervals estimated in Table 3.1 are fairly
tight, which indicates that the performance improvement is consistent across different

cross-validation trials.

89

Table 3.1: Performance improvement achieved due to likelihood ratio based fusion.
The GAR values in the table correspond to 0.01% FAR.

 

 

 

 

 

 

 

 

 

 

 

Database Best Single Mean GAR 95% Conﬁdence
Matcher Interval on
Best Likelihood increase in GAR
Single Ratio
Matcher based
Fusion
NIST- Right Index Finger 85.3% 99.1% [13.5%, 14%]
Multimodal
NIST- Right Index Finger 83.5% 91.4% [7.6%, 8.2%]
Fingerprint
NIST-Face Matcher 1 71.2% 77.2% [4.7%, 7.3%]
XM2VTS- DCTb—GMM Face 89.5% 98.7% N/ A
Benchmark Matcher

 

 

3.6.3 Comparison With Other Score Fusion Techniques

The performance of the LR fusion rule is ﬁrst compared to fusion based on Support

Vector Machine (SVM) classiﬁer. While the performance of SVM based fusion is com-

parable to LR fusion on the NIST-Fingerprint and XM2VTS—Benchmark databases

(see Figures 3.11 and 3.13), it is inferior to LR fusion on the NIST-Multimodal and

NIST-Face databases (see Figures 3.10 and 3.12). Moreover, the kernel function and

the associated parameters for SVM must be carefully chosen in order to achieve this

performance. For example, while linear SVM gave good performance on the NIST-

Multimodal and XM2VTS-Benchmark databases, a radial basis function (RBF) kernel

with different parameter values for the NIST-Fingerprint (”y = 0.005) and NIST-Face

(7 = 0.1) databases was used to obtain the results reported here. In our experiments,

90

100 - we

 

--- ......
—---------- ........................
0"

95 _ Likelihood Ratio
Fusion Rule

Right Index

 

   
   

‘
.0
‘0
l
e
0
.I
e

 

 

A 90 _ _ .. , ’ -
s , . , r ‘ l
*3 Left Index Finger
0: 35 ’. _ _ , —
‘61 Face ”.3“, — — "
o c
8 Matcher 2 , :-
< - — ’f
a, 80 L ’ , c ‘I _
C I ‘I
'5 , v .’
c I- ’ I
O ‘l‘
o ,m

75 ~ ‘ ' Face Matcher 1 —

-"I
[I
I
70 0‘ -
65 . A . . . . . . l A L 4 1 . A . . 1 m A 1
10'2 10 ‘ 10° 101
False Accept Rate (%)

Figure 3.10: Performance of complete likelihood ratio based fusion rule and linear

SVM-based fusion on the N IST -Multimodal database.

91

100 . . ..s-s.,

 

    
 
   

 

 

 

SVM
Likelihood Ratio Fusion Rule

95
is"
.03
(U i—
a: 90 Right Index
E. Finger , I
s , . '
< ’ s
.“s’ 85 4 ' _
3
C
a) I
(D , , ’

l r
80 “ ’ I I ‘
755‘-’ . . ...1..1 . A .JLJLAI r 1 txlrg
10‘2 10’1 10° 101
False Accept Rate (%)

Figure 3.11: Performance of complete likelihood ratio based fusion rule and SVM-
based fusion on the NIST-Fingerprint database. A radial basis function kernel with
7 = 0.005 was used for SVM fusion.

92

100 e rsmm

 

I

95

     
  

90 “ Likelihood Ratio
Fusion Rule

85

80

Genuine Accept Rate (%)

75 . ' '
[xi ‘,.-"‘Face Matcher 1
70,! Fa ‘

Matcher 2 L

l

e
n
s
e
I
e
c —
s
e
n
c
0
I
I

 

 

60 t t . . 1 . . . l r r . m ML Lil t 1 ML 1 4 t .
10 10‘1 10° 101
False Accept Rate (%)

 

Figure 3.12: Performance of complete likelihood ratio based fusion rule and SVM-
based fusion on the NIST-Face database. A radial basis function kernel with 'y = 0.1
was used for SVM fusion.

93

 

 

 

 

 

100 . . . - . -"'..'7.77. 71735:.
M h . — . ; . ¢ - o -------
Likelihood Ratio SVM ,~ ‘ “
95 - Fusion Rule _____ ,...~" .
v‘IlI
gs ,,.—. —-' ----
F 90 [- , p ‘ ' l ’3 ¢ “ .4
iii ‘ est Face 1'
tr Matcher 3
‘6. (Dch-GMM); Best Speech
8 85 - Matcher -
2 (LFCC-GMM)
O
.5
3:3, 80 - -
(D
75 - -
70 1 r . .....i- .1 . j . .12.
10-2 10 1 10° 101
False Accept Rate (%)

Figure 3.13: Performance of complete likelihood ratio based fusion rule and linear
SVM-based fusion on the XM2VTS-Benchmark database. Although there are 8 dif-
ferent matchers in the XM2VTS-Benchmark database, only the ROC curves of the
best face matcher (DCTb—GMM) and the best speech matcher (LFCC—GMM) are

shown for clarity.

94

the model selection for SVM (kernel type and kernel parameters) was performed by
trial and error. We manually tried the linear SVM and RBF kernel with different
parameter choices (approximately 5 different values) on each database and report the
best results. It is also possible to set the values of the kernel parameters automatically
using techniques proposed in the literature [29,70].

Next, we compare the performance of complete likelihood ratio based fusion rule
with commonly used transformation-based score fusion techniques, where the scores
are ﬁrst transformed using a normalization scheme and then the normalized scores
are combined using a fusion rule. Among the various possible combinations of nor-
malization schemes and fusion rules [90,180], we selected the min-max normalization
scheme and sum of scores fusion method because our empirical results showed that
this combination gave the best results. The ROC curves for the likelihood ratio
based and sum of scores fusion rules on N IST—Multimodal and XM2VTS-Benchmark
databases are shown in Figure 3.14. In the case of NIST-Multimodal database, we
observe that the complete likelihood ratio based fusion rule does not provide any sig-
niﬁcant improvement over the sum rule (see Figure 3.14(a)). The paired t test rejects
the hypothesis that the performances of the likelihood and sum rules are different.
This is not surprising, because it has been shown in the literature that the sum rule
works quite well in practice due to its robustness to noisy data and errors in density
estimation [108]. However, the performance of the sum rule is inferior to the likeli-
hood ratio based approach in the case of XM2VTS-Benchmark database (see Figure
3.14(b)).

The reason for the sub-optimal performance of sum rule in the case of XM2VTS-

95

 

 

 

 

 

:\°‘
0)
‘tii
(I 96 .
‘5.
o
O
2
g 94 ' ------ Minmax-Sum Rule
is Complete Likelihood
0 Ratio Fusion Rule
(D 92 .

90 ‘ ‘

10-2 -1 0 101

1
False Accept Rate (%)
(a)

 

 

Genuine Accept Rate (%)

 

 

 

; --'-- Minmax—Sum Rule
_i ------- IT-MM—Sum Rule
92 “.t’ __ Complete Likelihood Ratio
Fusion Rule
90 ‘ ' '
10'3 10'2 10'1 10° 101
False Accept Rate (%)

(b)

Figure 3.14: Performance of complete likelihood ratio based fusion rule and sum of
scores fusion rule with min-max normalization on (a) NIST-Multimodal database and
(b) XM2VTS—Benchmark database. In (b), IT-MM denotes that an inverse tangent
function is applied only to the match scores of the MLP classiﬁers prior to normalizing
all the match scores using min-max normalization.

96

Benchmark database is that the match scores are computed based on two types of
classiﬁers. One of them is a multi-layer perceptron (MLP) while the other is a Bayes
classiﬁer using the Gaussian Mixture Model (GMM). While the distribution of match
scores output by the GMM classiﬁer can be approximated by a Gaussian distribution
(see Figure 3.15(b)), the match score distribution of the MLP classiﬁer is peaked
around 1 and —1 due to the tanh function at the output layer of the perceptron
(see Figure 3.15(a)). Hence, the sum rule does not provide a good approximation to
the likelihood ratio based fusion rule because the nature of match score distributions
is very different. However, if we change the distribution of scores at the output of
the MLP classifier by applying an inverse tangent function to these scores, then the
performance of the sum rule improves and becomes comparable to likelihood ratio
based fusion as observed in Figure 3.14(b). These results demonstrate that while it is
possible to achieve good fusion performance for a specific database using the simple
sum rule by carefully choosing the normalization scheme, the proposed likelihood-
ratio based fusion framework is a general approach that provides good performance

consistently on all the databases considered in this thesis.

3.6.4 Comparison of Product and Complete Likelihood Ratio

Fusion

The complete likelihood ratio based fusion rule is based on the joint density of the
genuine and impostor match scores and hence, takes into account the correlation be-
tween the matchers. On the other hand, the product fusion rule, which is simpler

97

.O
\l
1

 

— Genuine Scores
- - -lmpostor Scores .

Frequency
.0 .0 .0 .0 .0
N on A 01 a)

.0
_L

 

 

O

 

 

Match Score

(a)

0.35 r .

 

— Genuine Scores
0.3 ~ - - -|mpostor Scores .

0.25 ~

.0
N

P
_L
01

Frequency

.0
A

0.05 *

 

 

 

 

Match Score

(b)

Figure 3.15: Distribution of genuine and impostor match scores in the XM2VTS-
Benchmark database for (a) MLP classiﬁer and (b) GMM classiﬁer.

98

to implement, ignores the correlation between matchers and approximates the joint
density by the product of the marginal densities. To study the performance differ-
ence between these two rules, we consider two databases for which the correlation
between the various matchers is high. As an example, in the NIST-Face database,
the correlation between the scores of the two matchers is 0.7 for the genuine class
and 0.3 for the impostor class. In the XM2VTS—Benchmark database, we choose the
two speech matchers LFCC—GMM and SSC-GMM because this matcher pair had the
highest correlation value among the different matcher pairs (0.8 for the genuine class

and 0.7 for the impostor class).

The performance of the product and complete likelihood ratio based fusion rules
on the NIST—Face database is shown in Figure 3.16, which indicates that there is no
difference in the performance of the two rules. This is because the difference between
genuine and impostor correlations is not high and the two matchers in this database
are reasonably accurate (the d, value6 is 3.2 for both the matchers). Now, we apply
a linear transformation of the form 3; = (3k — a)/b to the genuine match scores

I
kth matcher and 3k is

from the two matchers, where 8k is the original score of the
the modiﬁed score. The values of the constants a and b are chosen such that the d,
metric of the transformed scores is approximately 2. This linear transformation does
not affect the correlation between the genuine scores of the two matchers. We also

remove the correlation between impostor scores by randomly permuting the impostor

scores from one of the two matchers. Note that this permutation does not change the

 

6The d-prime value ((1) measures the separation between the means of the genuine and impostor
distributions in standard deviation units. A higher (1 value indicates better performance.

99

I'narginal distribution of the impostor scores. As a result of these transformations, the
(I, value for the modiﬁed match scores is approximately 2 and the correlation between
the scores is 0.7 for the genuine class and O for the impostor class. The performance of
the complete likelihood ratio based fusion and the product fusion rules on the modiﬁed
scores is shown in Figure 3.16. Since the separation between the genuine and impostor
distributions was reduced by applying a linear transformation to the genuine scores,
the accuracy of the individual matchers and hence the fusion performance is reduced
substantially. However, in this case we observe that the complete likelihood ratio
based fusion rule clearly outperforms the product fusion rule. For example, at a
FAR of 0.1%, the average improvement in the GAR is 2.7% and the 95% conﬁdence
interval for the difference in the GAR between the two rules is [2.5%,2.9%]. This
result indicates that modeling the correlation between the match scores, and hence
the use of complete likelihood ratio fusion rule is justiﬁed only if the matchers are of
low accuracy and the difference between genuine and impostor correlation is large.
Similar results were also obtained in the case of correlated matcher pairs in the
XMZVTS—Benchmark database. Figure 3.17 shows the ROC curves for the fusion
of LFCC-GMM and SSC—GMM speech matchers in the XM2VTS database. The
d, values for the LFCC-GMM and SSC-GMM matchers are approximately 4 and 3,
respectively. From Figure 3.17, we observe that the complete likelihood ratio based fu-
sion and product fusion rules perform equally well on this pair of matchers. However,
if the d, values of the two matchers are reduced by applying a linear transformation
to the genuine scores and if the impostor correlation is removed, we observe that the
complete likelihood ratio based fusion rule provides better fusion performance than

100

100

 

 

90
§§ 80
0)
iii
a:
‘5.
g 70
<
0
.E
3
C
{3 60
50 _ - - -Complete LR Fusion Rule - Modiﬁed Match Scores j
------- Product Fusion Rule - Modiﬁed Match Scores
’ e --0- - Product Fusion Rule - Original Match Scores
.- — Complete LR Fusion Rule - Original Match Scores
40 J . l i A r . l l 1 i l a L

 

 

 

10'1 10°

False Accept Rate (%)

10

1

Figure 3.16: Performance of product and complete likelihood ratio based fusion rules
for the two face matchers in the N IST-Face database.

101

the product fusion rule (see Figure 3.17).

3.6.5 Performance of Quality-based Fusion

We investigate the performance of the quality-based product fusion rule on the WVU-
Multimodal database. Recall that for the other two databases, raw images are not
available precluding the use of quality-based fusion. Figure 3.18 shows the perfor-
mance of the product7 and the quality—based product fusion rules. Fusion of ﬁnger-
print and iris modalities using the product rule gives a large improvement in the GAR
compared to the best single modality (iris, in this experiment). The quality-based
product fusion rule further improves the GAR. For example, at a FAR of 0.001%, the
mean GAR of the iris modality is 66.7%, while the GAR values of the product and
quality-based product fusion rules are 85.3% and 90%, respectively. The 95% conﬁ-
dence interval for the improvement in GAR obtained by using quality-based product

fusion instead of product fusion is [4.1%, 5.3%].

3.6.6 Performance of Likelihood Ratio Based Sequential Fu-
sion

The performance of the decision tree based approach for likelihood ratio based sequen-
tial fusion was studied using the NIST-BSSR1 database. Since the structure of the
decision tree depends on the set of match scores selected for training, the sequential

fusion rule is not the same across all the cross-validation trials. A typical sequential

 

7Since the correlation between ﬁngerprint and iris modalities is zero, complete likelihood ratio
based fusion and product fusion rules have the same performance on the WVU-Multimodal database.

102

100

 

 

 

 

 

90
80
§
9 70
(U
C!
a
8 60
0
<
0
.E
2 50
d)
O
40 ,
I ’ - - - ' Product Fusion Rule - Original Match Scores
30 _ I ’ -——Comp|ete LR Fusion Rule - Modiﬁed Match Scores
r' ---------- ‘ ------- Product Fusion Rule - Modiﬁed Match Scores
.......... - - -Complete LR Fusion Rule - Modiﬁed Match Scores
20 a A kin—LLL; . 4 1.14444 . . 111.11
10‘3 10'2 10“ 10°
False Accept Rate (%)

Figure 3.17: Performance of product and complete likelihood ratio based fusion rules
for the LFCC-GMM and SSC-GMM speech matchers in the XM2VTS database.

103

100

 

 

 

 

Quality-based ' ' ' ' ' ’ _ _ ‘_ _ _ _ .__.,=f._., 35:53.14. u.
Likelihood Ratio Fusion _ _ __ _ .. .. .. — -:|:.'_'_.". — -------
90" ’.’,—".' ........... ; ."v‘:
"‘ .l ............
’.’ ‘ ‘‘‘‘ ’ ‘ v
A Likelihood Ratio-based "', e r ’
E 80 ~ Score Fusion as; e —
a, v ’0'".
E I ' ’ ' '
ns ’ a 0
ﬂ ' ‘\
g- o ’ ' ' C.“
o 70 L , - ,. 1 -
O r ’ . .
‘0‘) r ' Flngerpnnt
.E
3
C
8 60 r _
50 L _
40 m ...1 . . .LL...l .1
-3 -2 -1
1O 10 1O 10
False Accept Rate (%)

Figure 3.18: Performance of product fusion and quality-based product fusion rules
on the WVU-Multimodal database.

104

fusion rule (decision tree) obtained using the NIST-Fingerprint database is shown in
Figure 3.19. For this database, marginal likelihood ratio corresponding to the right
index ﬁnger was usually selected as the root node because it is more accurate than the
left index ﬁnger. On average, 92.6% of the genuine attempts required only a single
modality (right index ﬁnger). The operating point of the system was modiﬁed by
varying the ratio of genuine and impostor samples in the training phase. The average
GAR of the system was observed to be 94.2% at a FAR of 0.2% and 95.9% at a
FAR of 1.3%. The corresponding GAR values obtained in the parallel fusion scenario
are 94.6% and 96.1%. These results show that while there is a marginal degradation
in the GAR when sequential fusion is used instead of parallel fusion, the sequential
system can lead to a signiﬁcant increase in the user convenience and throughput be-
cause 3 92% of the genuine authentication attempts can be processed using just one
modality.

Similar results were also observed in the case of the NIST-Multimodal database.
Since both the face matchers in this database have roughly the same performance, we
consider the scores from a single face matcher and the two ﬁngers in this experiment.
Figure 3.20 shows a typical sequential fusion rule (decision tree) obtained using the
NIST-Multimodal database. Again in this database, the most accurate modality,
namely, the right index ﬁnger was usually selected as the root node and on average,
91.1% of the genuine attempts required only a single modality (right index ﬁnger).
The average GAR of the system was observed to be 96.9% at a FAR of 0.01% and
97.9% at a FAR of 0.2%. The corresponding GAR values obtained in the parallel
fusion scenario are 97.8% and 98.6%. Thus, sequential fusion signiﬁcantly reduces

105

  
 

Genuine

Impostor Genuine

Figure 3.19: A typical sequential fusion rule (decision tree) obtained using the NIST-
Fingerprint database. Here, L1 and L2 represent the marginal log-likelihood ratios
for the left index ﬁnger and right index ﬁnger, respectively.

the number of modalities to be acquired during authentication without adversely

affecting the GAR.

3.7 Summary

We have proposed a statistical framework for the fusion of match scores in a multibio-
metric veriﬁcation system based on the likelihood ratio test. This approach is optimal
provided the underlying genuine and impostor match score densities are known. In
practice, one needs to estimate these densities from the available training set of match
scores. We have modeled the genuine and impostor match scores using a mixture of
Gaussian densities and used the EM algorithm with the minimum message length cri-
terion for estimating the parameters of the mixture density and the number of mixture
components. We have also developed a quality-based fusion scheme within the likeli-

106

 

Impostor ®

No Yes

Impostor Genuine

Figure 3.20: A typical sequential fusion rule obtained using the NIST-Multimodal
database. Here, L1, L2 and L3 represent the marginal log-likelihood ratios for the
left index ﬁnger, right index ﬁnger and face modalities, respectively.

107

hood ratio framework to fuse multiple biometric sources based on the input biometric
sample quality. Finally, we have shown that sequential fusion rules for a cascade
multibiometric system can be generated by constructing a binary decision tree clas-
siﬁer based on the marginal likelihood ratio of the individual matchers. Experiments

on three different multibiometric databases lead us to the following conclusions.

0 Both the modiﬁed kernel density estimator and Gaussian mixture models pro-
vide reliable density estimates. However, The GMM-based density estimation is
simpler to implement than KDE. The likelihood ratio based fusion rule based on
the density estimates provided by GMM achieves consistently high recognition

rates without any tuning of parameters by the system designer.

o The performance of a simple fusion rule such as the sum rule with min-max
normalization is often comparable to that of the likelihood ratio based fusion
rule. However, the sum rule requires careful selection of normalization scheme
and fusion weights to achieve good performance. Further, this selection of

normalization scheme and fusion weights is data dependent.

o In practice, the assumption of independence between matchers to be used does
not adversely affect the performance of the fusion scheme, especially when the
individuals matchers are quite accurate (equal error rate is less than 5%). In
other words, the complete likelihood ratio fusion rule and the product likelihood

ratio fusion rule give comparable performance.

0 Utilizing biometric sample quality information, when available, in the likeli-

hood ratio based fusion framework leads to a signiﬁcant improvement in the

108

performance of multibiometric systems.

0 The sequential fusion rules signiﬁcantly reduce the number of modalities re-
quired for authentication and hence, increase the throughput and user conve-

nience without degrading the recognition performance signiﬁcantly.

109

Chapter 4

Multibiometric Identiﬁcation

The likelihood ratio based score fusion framework proposed in Chapter 3 was devel-
oped speciﬁcally for the veriﬁcation scenario where the goal is to decide whether an
input sample belongs to the genuine or impostor class. In veriﬁcation, the biometric
query is compared only to the template of the claimed identity, resulting in a single
match score for each matcher. However, in an identiﬁcation system, the biometric
query is compared with all the templates in the database resulting in N match scores
for each matcher, where N is the number of persons enrolled in the database. The
goal is to determine the true identity I of the user based on these N match scores,
where I E {11,12,--- ,IN,IN+1}. Here, 11,12, - -- ,IN correspond to the identities
of the N persons enrolled in the system and I N +1 indicates the “reject” option, which
is output when no suitable identity can be determined for the given query. When the
reject option is available to the system, the problem is known as open set identiﬁca-
tion. On the other hand, if the biometric system is forced to make a decision in favor
of one of the N identities, then the problem is referred to as closed set identiﬁcation.

110

In this chapter, we show that likelihood ratio based score fusion framework developed
for the veriﬁcation scenario is also applicable to multibiometric identiﬁcation under
certain assumptions. We also demonstrate that likelihood ratio based score fusion
achieves good identiﬁcation performance compared to other score level and rank level

fusion approaches.

4.1 Score Level Fusion

Let K denote the number of matchers in the multibiometric system and N be the
number of persons enrolled in the system. Let Sf, denote the random variable corre—
sponding to the match score output by the kth matcher after comparing the query
to the template of the nth person in the database, k = 1, 2, - -- ,K: n = 1, 2, - u ,N.

Let 8 be a N x K matrix deﬁned as

1 k K
51 51 51
8= S}, Si: 55 =l51’52"”’SKl=[51»52,“',5NIT’
1 k K
_SN SN 3N_

 

 

T
where Sk = [Sk,S§,--- ,Sﬁ/v] , for k =1,2,---,K and Sn =[S,1,,S,2,,---,S£{],
forn=1,2,~- ,N.
Suppose for a given query, we observe the N x K score matrix 3 = [9,13] Note

111

that 35, represents the match score output by the kth matcher for the nth template
in the database, k = l,2,--- ,K; n = 1,2, ,N. Our goal is to determine the
true identity I of the given query based on 3. According to the Bayesian decision
theory [57], the query should be assigned to the identity [no that maximizes the

posteriori probability, i.e.,

Assign I “I720 if

P(InOIS) Z P(InlS),V n =1,2,"' ,N. (4.1)

The above decision rule applies only to closed set identiﬁcation. For Open set iden-
tiﬁcation, the query is assigned to identity [no only when equation (4.1) holds and

P(Inols) Z 7', where T is a threshold.

We can estimate the posteriori probabilities P(Inls) in the following manner.

According to the Bayes theorem,

P(slIn)P(In)

Pan's) 2 12(8)

 

, (4-2)

where p(s|In) is the likelihood of observing the score matrix 3 given that the true
identity is In and P(In) is the prior probability of observing the identity In. If we
assume equal prior for all the identities (i.e., P(In) = 1/N,V n = 1,2, - -- ,N), the
posteriori probability P(Inls) is proportional to the likelihood p(s|In). Hence, we
can rewrite the decision rule in equation (4.1) as

112

Assign I——>In0 if

Ideally, we would like to estimate the conditional density of s individually for each
user because it captures the complete information about dependencies between the
scores assigned to the different users and the user-speciﬁc characteristics of the match
scores. However, directly estimating the conditional density of s is not practical due

to the following two reasons.

1. Since 3 is a N x K dimensional matrix and N is usually quite large (can be of the
order of millions), estimating the density of 3 requires a signiﬁcant number of
training samples for each user, which is not generally available in multibiometric

databases. Often, only a single template and query is available for each user.

2. The density of 8 needs to be re—estimated whenever there is a change in the list

of persons enrolled in the biometric system, which may occur frequently.

Two simplifying assumptions are generally used [12,75] to make the density esti-
mation feasible. Firstly, we assume that the match scores for different persons are
independent of one another. In other words, 3,; and sj are assumed to be independent
for allz' 75 j,i = 1,2, - -- ;N,j = 1, 2, - -- ,N. Based on this assumption, the likelihood
p(s|In) can be simpliﬁed as

113

N
p()=s|In ﬁp(sj|1n)=p(snIIn) H p(sj|In). (4.4)

j=1aj7én

Here, p(sn|In) represents the density of genuine match scores corresponding to user
In and p(stIn), j 75 n represents the densities of the impostor scores.

The second assumption made is that the genuine match scores of all users are
identically distributed, i.e., p(sn|In) = p(sn|genuine) = fgen(sn),V n = 1,2, - n ,N
and the impostor match scores of all users are identically distributed, i.e., p(sj|In) =
p(sj|impost0r) = fimp(3j)aV j, n = 1, 2, - -- ,N,n 7é j. Therefore, equation (4.4) can

be further rewritten as

N
P(Slln)=fgen(3n) H fimp(3j)- (4-5)
1:10?”

Multiplying and dividing equation (4.5) by fimp(3n)a we get

p(sl1n)= ff——T::((:")) H fimplsjl. (4.6)

Under the above two simplifying assumptions, the likelihood of observing the score
matrix 3 given that the true identity is In is proportional to the likelihood ratio that

was used in the veriﬁcation scenario. Thus, the decision rule in equation (4.3) can be

restated as

Assign I ——’InO if

114

fgen(3n0) > fgen(3n)

_ ,Vn=l,2,-~,N. 4.7)
fimp(3n0) fimp(3n) (

4.2 Rank Level Fusion

When a biometric system operates in the identiﬁcation mode, for a given query,
the output of the system can be viewed as a ranking of the enrolled identities. In
other words, the output indicates the set of possible matching identities sorted in
a decreasing order of match scores. Although the ranks are derived from the match
scores, the rank information captures the relative ordering of the scores corresponding
to different users. The goal of rank level fusion schemes is to consolidate the ranks
output by the individual biometric subsystems in order to derive a consensus rank
for each identity.

Let K denote the number of matchers in the multibiometric system and N be
the number of persons enrolled in the system. Suppose for a given query, we observe
the N x K rank matrix 1‘ = [r5], where r5, represents the rank output by the kth
matcher for the nth template in the database, k = 1, 2, - -- ,K; n = 1, 2, - -- ,N. The
goal in rank level fusion is to determine the true identity I of the given query based
on 1'. Let 7‘; be a statistic computed for user n such that the user with the lowest
value of r, is assigned the highest consensus (or reordered) rank. For example, in the
highest rank method [79], each user is assigned the highest rank (minimum 7‘ value)
as computed by different matchers, i.e., the statistic for user n is

I K k
Tn = mm 'rn. (4.8)

115

Ties are broken randomly to arrive at a strict ranking order based on the new statistic
7". Ho et al. [79] prOposed other methods such as Borda Count and logistic regression
which compute the statistic r, as a linear combination of ranks provided by the
individual matchers. Melnik et al. [135] proposed the use of non-linear functions to

combine the ranks of the individual matchers.

We now propose a new rank combination statistic based on Bayesian decision
theory. Let Pk(r) be the probability that the identity that is assigned rank 1" by the
kth matcher is the true identity, 7‘ = 1,2,--- ,N; k = 1,2, ,N. Note that the
cumulative distribution function of the discrete rank distribution Pk(r) is nothing
but the Cumulative Match Characteristic (CMC) deﬁned in section 1.3. Grother
and Phillips [75] and Bolle et a1. [12] show that the rank distribution Pk('r) can be
estimated provided the marginal genuine and impostor match score densities fgen,k(')
and fimp,k(') are known. This estimation again requires the same two assumptions
used in section 4.1, namely, (i) scores of the individual users are independent and
(ii) genuine score distributions of different users are identical and the impostor score

distributions of different users are identical.

For a given query, suppose that the identity In is assigned the rank r5 by the kth
matcher. From the deﬁnition of the rank distribution Pk(r), Pk(r[“,) is the posteriori
probability that In is the true identity given r5. Further, if we assume that the
matchers are independent, we can compute the new rank combination statistic as the
product of the posterior probabilities of the individual matchers.

116

K
I
Tn = H Pk('I‘£),forn = 1,2, - -- ,N. (4.9)
k=1
Note that for the rank statistic computed using equation (4.9), the user with the

I
largest value of 1‘ should be assigned the highest consensus rank. The rank posterior

based fusion rule can then be deﬁned as follows.

Assign I ——+In0 if

I

I
T710 _>_rn,Vn=1,2,--- ,N. (4.10)

Note that likelihood ratio based score fusion rule shown in equation (4.7) uti-
lizes only the match scores corresponding to a particular user, when computing the
likelihood ratio for that user. In other words, the relative information between the
scores of different users is ignored when computing the score likelihood ratio. On the
other hand, the rank posterior based fusion rule in equation (4.10) considers only the
relative order information between the scores of different users and the actual score
values are ignored. Therefore, we can treat the score and rank information as two
different pieces of evidence and deﬁne a hybrid fusion scheme that utilizes both the

match scores and the ranks. Let R the combined score and rank statistic, deﬁned as

Rn(s, r) = P(Inlsirg, (4.11)

where the posterior probability based on the match score matrix 8, P(Inls), is com-
puted by substituting equation (4.6) in equation (4.2) and the posterior probability

117

based on the rank matrix 1' is obtained using equation (4.9). The hybrid score-rank

fusion rule can then be deﬁned as

ASSIgn I _* [no if

RnOZRn,Vn=1,2,--- ,N. (4.12)

4.3 Experimental Results

The identiﬁcation performance of various score and rank level fusion strategies was
evaluated on the three partitions of the NIST—BSSRl database. The cumulative
match characteristic (CMC) curves of the individual matchers and the highest rank
and hybrid score-rank fusion rules on the NIST-BSSRI database are shown in Figures
4.1, 4.2 and 4.3. Similar to the veriﬁcation scenario, in each experiment, half the users
were randomly selected to be in the training set for estimating the marginal densities
and the rank distribution. The remaining half of the database was used for evaluating
the fusion performance. The above training-test partitioning was repeated 20 times
and the reported CMC curves correspond to the mean identiﬁcation rates over the

20 trials.

Among the various rank level fusion schemes such as highest rank, Borda count
and logistic regression, we observed that the highest rank method achieves the best
rank-m recognition rate when m 2 K, where K is the number of matchers. Hence,
only the recognition rates of the highest rank method are reported here. It is well-

118

 

r l I I
1001l+—~- 'e- <.>~-:> ~<>~ s3 as)--(,2——~£.;-«era-~94.)—awn---<,->~---:.:>--:.)~-~Q--c:-~<')-us.> d:

(0
01

A

 

 

 

 

 

§

9.2

(U

D:

C

e 90

L3

9.: .l‘

g 85 _,- —— Face Matcher 2 _

E ------ Face Matcher 1

,2 ------- Left Index Finger

g 8 - *- Right Index Finger _
—0— Highest Rank Fusion
—-9—- Hybrid Score-Rank Fusion

75 J 1 L l
1 5 10 15 20 25

Rank (m)

Figure 4.1: Cumulative Match Characteristic (CMC) curve of highest rank fusion and
the hybrid score-rank fusion rules on the NIST-Multimodal database (K = 4, N =
517)

119

 

 

 

 

 

25

$94 i n-o-o--o--o~o'st-‘>'4|>‘°‘°""""b
9 ' oic‘o‘o'o'o‘
g 92—' o--°“ ‘
I o“
C l ‘0"
.g _10‘
8 90 l: -
E. “I .,.._..r-0‘*"'
cc: 88: ,o—O"°".’._'. _
2 l (*I...'
IE 86: ,r‘“ ~
g l I" '-o-' Left lndex Finger
g 84- i" ---0v--Right Index Finger
I! - + - Highest Rank Fusion
8207 —o—Hybrid Score-Rank Fusion“
80 ‘ ‘ ' l
1 5 10 15 20
Rank (m)

Figure 4.2: Cumulative Match Characteristic (CMC) curve of highest rank fusion and
the hybrid score-rank fusion rules on the NIST-Fingerprint database (K = 2, N =

6, 000).

120

known that the highest rank method works well when the number of users is large
compared to the number of matchers [79], which is usually the case in biometric
identiﬁcation systems. This is because the highest rank method utilizes the strength
of each matcher effectively. Even if only one matcher assigns a high rank to the
correct user, it is still very likely that the correct user will receive a high rank after
reordering. However, there can be up to K ties at rank 1 due to conflicting decisions
output by the K matchers. Since the ties are broken randomly without considering
the relative accuracies of the matchers, the identiﬁcation rate of the highest rank
method at ranks 1 to K -— 1 is not very high. In fact, the rank-1 accuracy of the
highest rank method is usually less than the rank-1 accuracy of the best individual
matcher.

The recognition rates of the likelihood ratio based score fusion rule, the rank
posterior fusion rule and the hybrid score-rank fusion rule were observed to be quite
similar on all the three partitions of N IST-BSSRl. While the hybrid score-rank fusion
rule achieves a marginal improvement in the recognition rates over the other two fusion
rules, the differences in the recognition rates of the three fusion rules is less than 1%
at all ranks. Therefore, only the performance of the hybrid score-rank fusion rule is
reported in Figures 4.1, 4.2 and 4.3. In the case of the NIST-Multimodal database,
the hybrid score-rank fusion rule provides 100% rank-1 accuracy, while the rank-1
accuracy of the best single matcher (right index ﬁnger) was only 93.7%. The hybrid
score-rank fusion rule improves the rank-1 accuracy from 88.9% for the best single
matcher (right index ﬁnger) to 94% on the NIST-Fingerprint database. Finally, on
the NIST-Face database the improvement is comparatively lower (81.2% for the best

121

 

(O
O)
i

  
  

 

 

 

94» I
’? 92 " , . —u
i: .9....o-o--o--o-—0‘°". .I‘
‘5 90* of?
a: 0 0.0.0
5 88 .. o--o~° °
“=- 0..o~°“° o
g 86 .. _
5 < ' o J
2 841-? o

:4
_E 82 a". _.~° --°--- Face Matcher 2 _
{5, if 9’ ~0~ Face Matcher1
a: 804: ---+-- Highest Rank Fusion 1
78 —9— Hybrid Score—Rank Fusion
0
761 5 10 20 25

15
Rank (m)

Figure 4.3: Cumulative Match Characteristic (CMC) curve of highest rank fusion and
the hybrid score-rank fusion rules on the NIST-Face database (K = 2, N = 3, 000).

122

face matcher and 84.1% for the score-rank fusion rule) due to the strong correlation
between the two face matchers.

The results also indicate that the performance of the simplest rank level fusion
scheme, namely, the highest rank method, is quite comparable to performance of
the more complex score and rank fusion strategies for ranks greater than or equal
to K, where K is the number of matchers. Therefore, in practical multibiometric
identiﬁcation systems with a large number of users, it may be sufﬁcient to use the
highest rank method if the goal is to retrieve the top few matches. However, if the
best rank-1 accuracy is desired and if the match score information is available, then

the hybrid score-rank fusion rule can be employed.

4.4 Summary

While fusion in a multibiometric identiﬁcation system is a more challenging problem
due to the presence of large number of classes, we have shown that the likelihood
ratio based fusion framework developed for a veriﬁcation system can also be used
for identiﬁcation, provided the match scores of different users are assumed to be
independent and identically distributed. We also proposed a scheme for rank level
fusion in multibiometric identiﬁcation that is based on converting the ranks into
posterior probabilities. Furthermore, the rank posteriors can be directly combined
with the posteriors obtained from the match score distributions to obtain a hybrid
score-rank fusion rule. Finally, we have demonstrated that the proposed hybrid fusion

rule consistently achieves high recognition rates at all ranks.

123

Chapter 5

Multibiometric Template Security

One of the most potentially damaging attacks on a biometric system is against the
biometric templates. Attacks on the template can lead to the following four vulnera-
bilities: (i) A template can be replaced by an impostors’s template to gain unautho-
rized access, (ii) a physical spoof can be created from the template (see [3,21, 171]) to
gain unauthorized access to the system (as well as other systems that use the same
biometric trait), (iii) the stolen template can be replayed to the matcher to gain unau-
thorized access, and (iv) the templates can be used for cross-matching across different
databases to covertly track a person without his/ her consent. Due to these reasons,
biometric templates (or the raw biometric images) should not be stored in plaintext
form and fool-proof techniques are required to securely store the templates such that
both the security of the application and the users’ privacy are not compromised by
adversary attacks. As shown in Chapters 3 and 4, multibiometric systems that fuse
evidence from multiple biometric sources can provide signiﬁcant improvement in the
recognition accuracy. However, a multibiometric system requires storage of multiple

124

templates for the same user corresponding to the different biometric sources. Hence,
template security is even more critical in multibiometric systems where it is essential
to secure multiple templates of a user.

Although a number of approaches such as feature transformation and biometric
cryptosystems have been proposed to secure templates [199], these approaches have
been proposed primarily to secure a single template. While it is possible to apply
these template protection schemes to each individual template separately, such an
approach is not optimal in terms of security. The following simple analogy illustrates
why securing the individual templates separately is not the best approach. Consider
an application that requires the user to enter two separate 4-digit personal identiﬁca-
tion numbers (PIN) that are veriﬁed independently to provide access. An adversary
attempting to break such a system would require at most 104 attempts to guess each
PIN. Since the PINs are veriﬁed independently, the maximum number of attempts
needed to circumvent the system is only 2 x 104. On the other hand, if the applica-
tion employs a single 8-digit PIN, the attacker would now need a maximum of 108
attempts to circumvent the system, which would require more effort than cracking
two 4-digit PINS. Protecting the individual templates separately is equivalent to hav-
ing a scheme requiring multiple smaller PINS, which is less secure than a scheme that
stores the multiple templates as a single entity (analogous to single large PIN).

In this chapter, we propose a uniﬁed scheme to secure multiple templates of a
user in a multibiometric system by (i) transforming features from different biometric
sources (e.g., ﬁngerprint minutiae and iriscodes) into a common representation, (ii)
performing feature-level fusion to derive a single multibiometric template, and (iii)

125

securing the multibiometric template using a single fuzzy vault construct [102]. We
show that the proposed multibiometric template protection scheme has higher secu-
rity and better recognition performance compared to the case where the individual
templates are secured separately. We have developed a fully automatic implemen-
tation of a multibiometric fuzzy vault that can handle the following scenarios (i)
multiple samples (e.g., two impressions from the same ﬁnger), (ii) multiple instances

(e.g., left and right index ﬁngers) and (iii) multiple traits (e.g., ﬁngerprint and iris).

5.1 Review of Template Protection Schemes

Almost all the commercial biometric systems secure the stored templates by encrypt-
ing them using standard cryptographic techniques. Either a public key cryptosystem
like RSA [115] or a symmetric key cipher like ABS [1] is commonly used for template
encryption. Since the above cryptosystems are generic, they can be directly applied
to any biometric template and the encrypted templates are secure as long as the
decryption key is secure. However, encryption is not a good solution for biometric
template protection due to two main reasons. Firstly, encryption is not a smooth
function and a small difference in the values of the feature sets extracted from the
raw biometric data would lead to a very large difference in the resulting encrypted
features. Recall that multiple acquisitions of the same biometric trait do not result in
the same feature set (see Figure 1.3). Due to this reason, one cannot store a biometric
template in an encrypted form and then perform matching in the encrypted domain.
Hence, for every authentication attempt, (i) the template is decrypted, (ii) matching

126

is performed between the query and decrypted template and (iii) the decrypted tem-
plate is then removed from memory. Thus, the template gets exposed during every
authentication attempt. Secondly, the security of the encryption scheme depends on
the decryption key. Hence, the decryption key needs to be securely stored in the
system and if the key is compromised, the template is no longer secure. Because of
these two reasons, standard encryption algorithms alone are not adequate for securing
biometric templates and techniques that are designed to speciﬁcally account for the
intra-user variability in the biometric data are needed.

The template protection schemes proposed in the literature can be broadly clas-
siﬁed into two categories (see Figure 5.1), namely, feature transformation approach
and biometric cryptosystem.

Template
Protection

/

 

 

(1/
Feature . .
. Biometric Cryptosystem
(Helper Data Methods)
/
//
Salting Non-invertible Key Binding Key Generation
(e.g., Biohashing) Transform , (e.g., Fuzzy Vault. (e.g., Secure Sketch-
(9'9-- R°b“5t Hashing) Fuzzy Commitment) Fuzzy Extractor)

 

 

 

 

 

Figure 5.1: Categorization of template protection schemes.

5.1.1 Feature Transformation

In the feature transform approach, a. transformation function (f) is applied to the
biometric template (T) and only the transformed template (7‘ (T; K )) is stored in

127

the database (see Figure 5.2). The parameters of the transformation function are
typically derived from a random key (K) or a password. The same transformation
function is applied to query features (Q) and the transformed query (f (Q; K )) is
directly matched against the transformed template (.7 (T; K )) Depending on the
characteristics of the transformation function f, the feature transform schemes can be
further categorized as salting or non-invertible transfonns. In salting, .7: is invertible,
i.e., if an adversary gains access to the key and the transformed template, she can
recover the original biometric template (or a close approximation of it). Hence, the
security of the salting scheme is based on the secrecy of the key or password. On the
other hand, non—invertible transformation schemes typically apply a one-way function
on the template and it is computationally hard to invert a transformed template even

if the key is known.

 

      

 

 

 

Enrollment Authentication
‘ RQ'K) Transform
F

Matching

. . . Key (K) Transformed l Biometric

Biometnc Template Key (K) Query (Q)
Template (T) RT.K) Match!
Non-match

 

Figure 5.2: Authentication mechanism when the biometric template is protected using
a feature transformation approach.

An example of salting approach is the random multi—space quantization technique
proposed by Teoh et al. [187]. In this technique, the authors ﬁrst extract the most dis—

128

criminative projections of the face template using the Fisher discriminant analysis [5]
and then project the obtained vectors on a randomly selected set of orthogonal direc-
tions. This random projection deﬁnes the salting mechanism for the scheme. Similar
biohashing schemes have been proposed for iris [38] and palmprint [43] modalities. An-
other example of salting is the cancelable face ﬁlter approach proposed in [174] where
user-speciﬁc random kernels are convolved with the face images during enrollment
and authentication. Non-invertible transformation functions have been proposed for

ﬁngerprint [158] and face [188] modalities in the literature.

5.1.2 Biometric Cryptosystems

Biometric cryptosystems [22,198] were originally developed for the purpose of either
securing a cryptographic key using biometric features or directly generating a cryp—
tographic key from biometric features. However, they can also be used as a template
protection mechanism. In a biometric cryptosystem, some public information about
the biometric template is stored. This public information is usually referred to as
helper data and hence, biometric cryptosystems are also known as helper data-based
methods [199]. While the helper data does not (is not supposed to) reveal any signifi-
cant information about the original biometric template, it is needed during matching
to extract a cryptographic key from the query biometric features. Matching is per-
formed indirectly by verifying the validity of the extracted key (see Figure 5.3). Error

correction coding techniques are typically used to handle intra-user variations.

Biometric cryptosystems can be further classified as key binding or key generation

129

systems depending on how the helper data is obtained. When the helper data is
obtained by binding a key (that is independent of the biometric features) with the
biometric template, we refer to it as a key-binding biometric cryptosystem. Note that
given only the helper data, it is computationally hard to recover either the key or the
original template. Matching in a key binding system involves recovery of the key from
the helper data using the query biometric features. If the helper data is derived only
from the biometric template and the cryptographic key is directly generated from the
helper data and the query biometric features, it leads to a key generation biometric

cryptosystem.

Extracted ﬂ Validity Match/
Key (K) Check Non-match

 

  

Helper Data
Extraction

 
   
  

 

- Recovery
Helper Data
Blometrlc H = F (T) B' tri
Template (T) Qlomemc)
uery

 

 

 

 

Enrollment Authentication

 

Figure 5.3: Authentication mechanism when the biometric template is secured using
a key generation biometric cryptosystem. Authentication in a key—binding biometric
cryptosystem is similar except that the helper data is a function of both the template
and the key K, i.e., H = J:(T; K).

A number of template protection techniques like fuzzy commitment [103], fuzzy
vault [102], shielding functions [194] and distributed source coding [56] can be consid-
ered as key binding biometric cryptosystems. Other schemes for securing biometric

130

templates such as the ones proposed in [51,76,105, 137,138] also fall under this cat-
egory. The fuzzy vault scheme proposed by Juels and Sudan [102] has become one
of the most pOpular approaches for biometric template protection and its implemen-
tations for ﬁngerprint [41,42, 141, 196,209], face [62], iris [117] and signature [68]
modalities have been proposed. Recently, multibiometric fuzzy vaults based on mul-
tiple ﬁngers [210] and ﬁngerprint and voice [19] have also been proposed.

Direct cryptographic key generation from biometrics is an attractive proposition,
but it is a difﬁcult problem because of the intra-user variability. Early biometric key
generation schemes such as those by Chang et a1. [28] and Veilhauer et al. [200] em-
ployed user-speciﬁc quantization schemes. Information on quantization boundaries
is stored as helper data, which is used during authentication to account for intra-
user variations. Dodis et a1. [55] introduced the concepts of secure sketch and fuzzy
extractor in the context of key generation from biometrics. The secure sketch can
be considered as helper data that leaks only limited information about the template
(measured in terms of entropy loss), but facilitates exact reconstruction of the tem-
plate when presented with a query that is close to the template. The fuzzy extractor
is a cryptographic primitive that generates a cryptographic key from the biometric
features.

Dodis et a1. [55] proposed secure sketches for three different distance metrics,
namely, Hamming distance, set difference and edit distance. Li and Chang [120]
introduced a two-level quantization based approach for obtaining secure sketches.
Sutcu et al. [185] discussed the practical issues in secure sketch construction and
proposed a secure sketch based on quantization for face biometric. The problem of

131

generating fuzzy extractors from continuous distributions was addressed by Buhan et
al. in [16]. Secure sketch construction for other modalities such as ﬁngerprints [4,23],
3D face [214] and multimodal systems (face and ﬁngerprint) [186] have also been
proposed. Protocols for secure authentication in remote applications [14,17] have

also been proposed based on the fuzzy extractor scheme.

Some template protection techniques make use of more than one basic approach
(e.g., salting followed by key—binding). We refer to such techniques as hybrid schemes.
Template protection schemes proposed in [13,145,183,184] are examples of the hy-
brid approach. A brief summary of the various template protection approaches is
presented in Table 5.1. Apart from salting, none of the other template protection
schemes require any secret information (such as a key) that must be securely stored

or presented during matching.

The template protection schemes described in Table 5.1 have their own advantages
and limitations in terms of template security, computational cost, storage require-
ments, applicability to different kinds of biometric representations and ability to han-
dle intra-class variations in biometric data [198]. In this thesis, we focus on a speciﬁc
biometric cryptosystem known as fuzzy vault and present (i) a fully automatic im-
plementation of a minutiae-based ﬁngerprint fuzzy vault where high curvature points
derived from the orientation ﬁeld are used to align the template and query minutiae,
(ii) an iris cryptosystem based on the fuzzy vault framework to secure iriscode tern-
plates, and (iii) a multibiometric vault framework to secure multiple templates of a
user in a multibiometric system as a single entity.

132

Table 5.1: Summary of different template protection schemes. Here, T represents
the biometric template, Q represents the query and K is the key used to protect the
template. In salting and non-invertible feature transform, .7: represents the trans-
formation function and M represents the matcher that operates in the transformed
domain. In biometric cryptosystems, .7: is the helper data extraction scheme and M
is the error correction scheme that allows reconstruction of the key K.

 

 

 

 

Approach What imparts se- What entities are How are intra-user
curity to the tem- stored? variations handled?
plate?

Salting Secrecy of key K Public domain: Quantization and
Transformed tem— matching in trans-
plate .7: (T; K ) formed domain
Secret: Key K M(.7-'(T; K), .7-"(Q; K))

Non- N on—invertibility of Public domain: Matching in trans-

invertible the transformation Transformed tem- formed domain

transform function .7: plate .’F (T; K ), key M(f (T; K ), .7: (Q; K ))

K

 

 

 

Key-binding Level of security Public domain: Error correction and
biometric depends on the Helper Data user speciﬁc quantiza-
cryptosystem amount of infor- H = .7: (T; K ) tion
mation revealed by l K = M(.7:(T; K), Q)
the helper data H
Key- Level of security Public domain: Error correction and
generating depends on the Helper Data user speciﬁc quantiza-
biometric amount of infor— H = .7: (T) tion
cryptosystem mation revealed by K = M(}' (T), Q)

 

the helper data H

 

 

 

133

 

5.2 Fuzzy Vault

Fuzzy vault is a cryptographic construct that is designed to work with biometric
features represented as an unordered set (e.g., minutiae in ﬁngerprints). The security
of the fuzzy vault scheme is based on the infeasibility of the polynomial reconstruction
problem, which is a special case of the Reed-Solomon list decoding problem [11]. The
fuzzy vault scheme works as follows (see Figure 5.4). Suppose that a user wishes to
protect his biometric template, which is represented as an unordered set X, using
a secret K (e.g., a cryptographic key). Here, unordered set implies that all the
elements in the set are unique and the order in which the elements of the set are
listed is irrelevant. Note that this is true for minutiae representation of ﬁngerprints.
The user selects a polynomial P that encodes the secret K in some way and evaluates
the polynomial on all the elements in X. The user then chooses a large number of
random chaff points that do not: lie on the polynomial P. The entire collection of
points consisting of both points lying on P and those that do not lie on P constitute
the vault V. The purpose of adding the chaff points is to conceal the points lying
on P from an attacker. Since the points lying on P encode the complete information
about the template X and the secret K, concealing these points secures both the

template and the secret simultaneously.

The user authentication based on the vault V proceeds as follows. Let the query
be represented as another unordered set X I. If X I overlaps substantially with X, then
the user can identify many points in V that lie on the polynomial P. If a sufficient
number of points on P can be identiﬁed, an error correction scheme can be applied to

134

exactly reconstruct P and thereby decode the secret K. If a valid secret is decoded,
the authentication is deemed to be successful. If X I does not overlap substantially
with X, then it is infeasible to reconstruct P and the authentication is unsuccessful.
Since the authentication can be successful even when X and X I are not exactly the
same, this scheme is referred to as a fuzzy vault.

The steps involved in creating the vault from the user’s biometric template and
the secret (vault encoding) are presented in Algorithm B.1 (see Appendix). All op-
erations in this algorithm are carried out over a ﬁeld 1:. The algorithm has three
parameters, namely, n, r and 3. Here, r depends on the number of features that
can be extracted from a user’s biometric template (e.g., number of minutia points in
the user’s ﬁngerprint). The parameter 3 represents the number of chaff points that
are added to the vault and this parameter inﬂuences the security of the fuzzy vault
construction. If no chaff points are added, the vault leaks the information about the
template and the secret. As more chaff points are added, the security of the vault
increases. The degree of the polynomial, n, controls the tolerance of the system to
errors in the biometric data during decoding. For example, n determines the mini-
mum number of matching minutiae required for successful vault decoding. A larger
77. requires more number of minutiae matches. The function ENCODESECRET(K)
constructs a polynomial P of degree n in variable x such that P encodes the secret K
uniquely, i.e., given P, we should be able to get back the secret K. A simple method
to construct such a polynomial is to embed the secret in the coefﬁcients of P. The
function PERMUTEU/I) randomly reorders the elements in V, to obtain the vault

V.

135

Polynomial '
Key Evaluation ‘ Vault

[5234] .° . o
o o °°o
P(X)= ‘ 000° 0 0 0°
5x3+2x2+ 3x+ 4 0°

 

 

  
  

' r
9,
f I E
Fingerprint 1‘“ ‘ a - .
Sensor Template Template Generation of
Image Minutiae Charr Points
(8)
Polynomial
Reconstruction
0
0
P(X)= 5x3+ 2x2+ 3x+ 4
~ I Recovered Key
'1 y 5234
9, r 1
2" i \
Fingerprint ' - .- - - ' ‘ . ,-
Sensor Query Query

Image Minutiae
(b)

Figure 5.4: Schematic diagram of the fuzzy vault scheme proposed by Juels and
Sudan [102] based on ﬁngerprint minutiae. (a) Vault encoding and (b) vault decoding.

136

Algorithm 8.3 (see Appendix) presents the steps involved in retrieving the secret
from the vault based on the user’s biometric query (vault decoding). The output of
this algorithm is either the secret K or a value null indicating that the authentication
is unsuccessful. The function RSDECODE(L’) is a (r, n) Reed-Solomon decoding
algorithm [7], which searches for a polynomial P of degree n such that P (a2) = b;
for more than 1321’ values of (a2, b1) 6 L’. The RSDECODE function either outputs
a polynomial P that satisﬁes the above conditions or a value null indicating that
no such polynomial exists. The function DECODESECRET(p) is the inverse of the
ENCODESECRET function and it reconstructs the secret K from the polynomial
P. The vault decoding algorithm successfully retrieves the secret K if the number of
errors (e.g., non-matching minutiae) in the biometric data (IX — X I]) 1 is less than
(153). This ability to deal with intra—class variations in the biometric data, along
with its ability to work with unordered sets, makes the fuzzy vault scheme a promising

solution for biometric cryptosystems, particularly for ﬁngerprints.

5.2.1 Fuzzy Vault Implementation

Since the introduction of the fuzzy vault scheme by Juels and Sudan, several re-
searchers have attempted to implement it in practice for securing biometric tem-
plates. Clancy et a1. [42] proposed a fuzzy vault scheme based on the location of
minutia points (row and column indices in the image) in a fingerprint. They assumed

that the template and query minutiae sets are pre—aligned, which is not a realistic

 

1The notation [A] denotes the number of elements in a set A.

137

assumption in practical fingerprint authentication systems. Further, multiple (four)
fingerprint impressions of a user were used during enrollment for identifying the reli-
able minutia points. The error correction step was simulated without being actually
implemented. The False Reject Rate of their system was approximately 20-30% and
they claimed that retrieving the secret was 269 times more difficult for an attacker

than for a genuine user.

The ﬁngerprint-based fuzzy vault proposed by Yang et al. [209] also used only the
location information about the minutia points. Four impressions were used during
enrollment to identify a reference minutia, and the relative position of the remaining
minutia points with respect to the reference minutia was represented in the polar
coordinate system. This scheme was evaluated on a small database of 10 ﬁngers and
a FRR of 17% was reported. Chung et al. [41] proposed a geometric hashing technique
to perform alignment in a minutiae-based ﬁngerprint fuzzy vault. A modiﬁed fuzzy
vault scheme was used for designing an asymmetric cryptosystem in [141]. Fuzzy
vault implementations based on other biometric modalities such as face [62] and

handwritten signature [68] have also been proposed.

Uludag et al. [197] introduced a modiﬁcation to the fuzzy vault scheme, which
eliminated the need for error correction coding. Uludag and Jain [196] also prOposed
the use of high curvature points derived from the ﬁngerprint orientation ﬁeld to
automatically align the template and query minutiae sets. Our ﬁngerprint-based
fuzzy vault implementation [144] extends the ideas presented in [197] and [196] in
order to achieve better performance on public-domain ﬁngerprint databases.

138

5.3 Proposed Fingerprint-based Fuzzy Vault

We ﬁrst propose a fuzzy vault implementation based on ﬁngerprint minutiae. We
use both the location and orientation attributes of a minutia point in our fuzzy
vault implementation. These attributes are represented as a 3-tuple (u,v,0), where
u indicates the row index in the image (1 S u S U), 1) indicates the column index
(1 S u S V) and 6 represents the orientation of the minutia with respect to the

horizontal axis (1 S 0 S 360). The algorithm presented in [87] is used for minutiae

extraction.

We have implemented a modiﬁed version of the fuzzy vault construction that
was proposed by Uludag et al. [197]. This modiﬁed fuzzy vault scheme does not
require error correction coding. Instead, several candidate sets of size (n + 1) (where
n is the degree of the polynomial which encodes the secret) are generated from the
unlocking set L, and polynomials are reconstructed using Lagrange interpolation.
This method gives rise to several candidate secrets and Cyclic Redundancy Check
(CRC) based error detection technique is used to identify the correct polynomial and
hence decode the correct secret. The main advantage of this scheme is its increased
tolerance to errors. Since only (n + 1) points are required to uniquely determine a
polynomial of degree n, this scheme can retrieve the secret K when the number of
errors (IX — X I] = [L - LII) is less than (r—n), i.e., it can tolerate twice the number
of errors as the original fuzzy vault scheme. However, this method has a higher

computational cost because it requires a large number of polynomial interpolations.

Our ﬁngerprint-based fuzzy vault implementation differs from the implementation

139

in [197] and [196] in the following aspects.

1. In our implementation, we apply a minutiae matcher [87] during decoding to
account for non-linear distortion in fingerprints whereas in [196], the minutia
location information is coarsely quantized to compensate for distortion. Since
deformation of the ﬁngerprint ridges increases as we move away from the center
of the ﬁngerprint area towards the periphery, uniform quantization alone, as
used in [196], is not sufﬁcient to handle distortion. The minutiae matcher used
in our implementation [87] employs an adaptive bounding box that accounts
for distortion more effectively. This is one of the main reasons the proposed

approach leads to a signiﬁcant improvement in the genuine accept rate (CAR).

2. Only the location of minutia points was used for vault encoding in [196]. We use
both minutia location and orientation attributes, which increases the number of
chaff points that can be added because we can now add a chaff point whose
location is close to a true minutia but with a different direction. Chang et
a1. [24] have shown that the number of possible chaff points affects the security
of the vault. Hence, using both minutia location and orientation makes it more
difficult for an attacker to decode the vault. At the same time, when a genuine
user attempts to decode the vault, it is easier to ﬁlter out chaff points from
the vault because it is less probable that a chaff point will match with a query
minutia in both location and direction. This reduces the decoding complexity

by eliminating most of the chaff points from the unlocking set.

3. We use local image quality index estimated from the ﬁngerprint in order to select

140

the most reliable minutiae for vault encoding and decoding. In [197], minutiae
selection was based on the value that is assigned to the minutiae in the ﬁeld
.7, which does not have any relation to the minutiae reliability. Our minutiae
selection method is also more efficient than the one used in [42] where multi-
ple ﬁngerprint impressions were needed to determine reliable minutiae during

encoding.

4. Although our alignment technique is similar to the one proposed in [196], we
have made signiﬁcant changes to the curvature estimation and alignment steps
compared to [196], which results in a more accurate alignment between the

template and query.

5.3. 1 Vault Encoding

Figure 5.5 shows the block diagram of the proposed J S fuzzy vault encoding scheme.
The ﬁeld used for constructing the vault is .77 = GF(216). We use the Galois ﬁeld,
.7: = GF(216), for constructing the vault. The speciﬁc ﬁeld GF(216) was chosen
because it offers a sufﬁciently large universe (number of elements in the ﬁeld) to ensure
vault security [55] and is computationally convenient for the fuzzy vault application.

The vault encoding process consists of the following eight steps.

1. Given the template ﬁngerprint image T, we ﬁrst obtain the template minutiae
set MT = [min]: 1], where NT is the number of minutiae in T. The local
quality index proposed in [32] is used to estimate the quality of each minutia
in T. Let q (mgr) be the quality of the ith minutia and qT = {q (Th?) )1]: 7;

141

, Fingerprint . CM
Chaff Pomt 7
, W) ,
L M-nutiae X, Y _olynomial V = (X P(X)) U ( Y 2)

Minutiae .ncoding _rojection

Extraction & M cl Mi-utiae 7 List
Quali .election

Estimattibn Scrambling

# CRC K' Polynomial
Secret K Codin j ’[P Encoding

 

  

 

 

 

 

 

Vault V= (A.B)

 

      

Helper Data

Template
Extraction

Helper Data H T

Figure 5.5: Proposed implementation of vault encoding.

be the quality set corresponding to minutiae set M T. We also extract the high
curvature points H T from the template image to be used for alignment during
decoding. The details of extraction of high curvature points are presented in

Section 5.3.3.

2. Since only r genuine minutiae points are required to construct the vault, we
apply a minutiae selection algorithm to the template minutiae set M T. This
selection algorithm ﬁrst sorts the minutiae based on their quality and then se-
quentially selects the minutiae starting with the highest quality minutia. More—
over, the algorithm selects only welI-separated minutiae, i.e., the minimum dis-
tance between any two selected minutia points is greater than a threshold 61.

The distance, D M, between two minutia points m,- and mj is deﬁned as

   

DMfmi'ﬂnj) = (Ur r "302 + (W — Uj)2 + ﬁMszﬂj) (5-1)

142

where A(6.,-,6j) = min ([6,- — 63-],360 — [6,- — 6J-I) and 5M is the weight as-
signed to the orientation attribute (set to 0.2 in our experiments2). Selection
of well-separated minutiae ensures that they are assigned unique values when
they are encoded into the ﬁeld .77. Let SM T = {minim denote the selected
minutiae set. Note that if the number of minutia points in T is less than r, or
if the selection algorithm fails to ﬁnd r well-separated minutiae, we consider it

as a failure to capture (FTC) error and no further processing takes place.

. The chaff point set CM = {mghsml is generated iteratively as follows. A
chaff point m = (u,v,6) is randomly chosen such that u E {1, 2, . -- ,U}, u 6
{1,2, - -- ,V} and 6 6 {1,2, - -- ,360}. The new chaff point is added to CM if
its minimum distance (as deﬁned in equation (5.1)) to all the points in the set

SMT U CM is greater than 61.

. The minutia attributes u, u, and 6 are quantized and represented as bit strings of
length Bu, EU and By, respectively. If Bu, BU and 139 are chosen such that they
add up to 16, we can obtain a 16—bit number by concatenating the bit strings
corresponding to u, v, and 6. Using this method, minutia points are encoded as
elements in the ﬁeld .7: = CF(216). Let X = {xj};=1 and Y = {yk}z=1 be
the encoded values of selected template minutiae and chaff points, respectively,

in the ﬁeld .7.

 

2Since the variation in the orientation attribute of a minutia point is usually much larger compared
to the variation in its location attribute, the orientation difference is assigned a smaller weight
than the Euclidean distance between the minutiae locations. The speciﬁc value of 0.2 for [3M was
determined empirically as a tradeoff between eliminating as many chaff points as possible from the
unlocking set while retaining as many genuine points as possible. The above tradeoff also determines
the value of the threshold 62 used in decoding.

143

5. Our scheme is designed to work with a secret key K of length 16n bits, where
n is the degree of the encoding polynomial. We append a 16—bit CRC code to
secret K to obtain a new secret K I containing 16(n + 1) bits. The generator
polynomial C(w) = w16 + 1015 + w2 + 1, which is commonly known as IBM

CRC-16, is used for generating the CRC bits.

I
6. The secret K is encoded into a polynomial P of degree n in .7 by partitioning
it into (n + 1) 16—bit values c0, c1, . -- , on and considering them as coefﬁcients

of P, i.e., P(x) = our" + - - - + CO-

7. The polynomial P is evaluated at all the points in the selected minutiae set X
to obtain the set P(X) = {P(zj)};:1. The corresponding elements of the sets
X and ’P(X) form the locking set L = {(3.-Trap) §=,. A set 2 = {2k};=,
is obtained by randomly selecting values zk E .77 such that the points (yk, zk)
do not lie on the polynomial P, i.e, Zk 75 P(yk), V ,k = 1,2, - u ,s. The chaff
set is deﬁned as C = {(yk,zk)}i=1. The union of locking and chaff sets is

denoted as V’.

8. The elements of V, are randomly reordered to obtain the vault V, which is
represented as V = {(ai, b,)}§=1, where t = r + 3. Only the vault V and the

high curvature points HT are stored in the system.

5.3.2 Vault Decoding

The process of decoding the vault consists of the following steps (see Figure 5.6).

144

Fingerprint

 

 

 

 

query (0) Vault v= (A,B)
i q°
Minutiae *i 7 T7"
Quality Alignment ’ Interpolation Decoding
Estimation

 

 

 

   

Helper Data H T

Helper Data _>Query Helper
Extractlon Data H°

[ Template

 

 

 

 

 

 

(a)
Vault V= (A,B)
‘v A
Minutiae MV Coarse SMV Remove Minutiae .
Decoding Filter C Without we» L
A Correspondences

 

 

 

 

 

 

 

Selected Query
Minutiae SM 0

(b)

Figure 5.6: Proposed implementation of vault decoding. (a) Block diagram of the
complete decoding process and (b) details of the ﬁlter used to eliminate the chaff
points.

145

. Given the query ﬁngerprint image Q, we obtain the query minutiae set M Q =

{rn-Q}NQ1 and the high curvature points H Q The quality of each minutia in
Q is estimated and the quality set qQ — {q (m? )}NQ1 corresponding to M Q

is obtained.

. The alignment algorithm described in Section 5.3.3 is applied and the aligned

query minutiae set M AQ = {m ZAQHEQ _1 is obtained.

. A minutiae selection algorithm is applied to select r minutiae from the set
M AQ based on their quality. The selected minutiae SM Q —{miQ}; ___1 are
well-separated in the sense that the minimum distance (as deﬁned in equation
(5.1)) between any two selected minutiae is greater than 61. If N Q < r or if
the number of well-separated query minutiae is less than r, it is considered as

failure to capture (FTC) and no further processing takes place.

. The selected query minutiae are used to ﬁlter the chaff points in the vault
as follows (see Figure 5.6(b)). The abscissa values of the points in the vault,
i.e., A = {Gilt-:1: are ﬁrst represented as 16—bit strings. The 16—bit strings
are partitioned into three strings of lengths Bu, By and 80 which are then
converted into quantized minutia attribute values u, u and 6. Thus, we obtain

the set MV = {Trill-f = (ui,vi,6,-)}‘z?=l.

. The ith element of the set M V is marked as a chaff point if the minimum

distance between the point my

9

m J E S M Q is greater than a threshold 62. We refer to this process as a coarse

E M V and all the selected minutiae in the query

146

ﬁlter and it ﬁlters out a signiﬁcant proportion of the chaff points (approximately
80%). Let S A! V = {mg} 113/:1 be a subset of M V containing only those elements
that are not marked as chaff. Here, N V is the number of points in M V that
are not marked as chaff and N V << 8. At this stage, a minutiae matcher
[87] is applied to determine the corresponding pairs of minutiae in the sets
S M V and S M Q. Let VIQ denote the set of correspondences and let r, be the
number of correspondences. Since the size of the selected query minutiae set
is r, we have 0 g r, S r because each query minutiae can have no more than
one corresponding minutia in Shiv. Note that it is also possible to directly
apply the minutiae matcher to ﬁnd correspondences between M V and SM Q
without any coarse ﬁltering. However, such a method is not effective because
the presence of a large number of chaff points in the vault leads to a number
of false correspondences. Hence, the coarse ﬁlter step is essential before the

minutiae matcher is applied.

. Only those elements of V that are contained in SM V and which have a corre-
I
sponding minutia in SM Q are added to the unlocking set L . The unlocking

I I

set is represented as L, = {(a;,bi)}:___1, where (al- bl.) = (aj,bj) if aj has a

i’i

corresponding minutia in S M Q.

. To ﬁnd the coefﬁcients of a polynomial of degree n, (n + 1) unique projections
are necessary. If r, < (n + 1), it results in authentication failure. Otherwise,
we consider all possible subsets L” of size (n + 1) of the unlocking set L, and,
for each subset, we construct a polynomial P* by Lagrange interpolation. If

147

II I I
L = {(ai’ bi) ”1:11 is a speciﬁc candidate set, P*(:r) is obtained as

I I

P*(a:) = (Ix—a;)(a:—a )---(;r—a,n+1)

I I I I I
(“1 ’ “2)(“1 — “3) ’ ' ‘ (“1 ‘ “n+1)

 

I
b1+...

(x-a’1)<z—a;)---(x—a§.>

I
I I I I I bn+1 (5'2)
(“n+1 — “1)(an+1 — “2) ' ' ' (“n+1 ‘ an)

 

The above operations result in a polynomial P* (:13) = Caz" + c;_1xn_1 + - - - +
c6.

8. The coefﬁcients c3, ci‘, - . - ,c; of the polynomial P* are 16-bit values which are
concatenated to obtain a 16(n + 1)-bit string K * and CRC error detection is
applied to K *. If an error is detected, it indicates that an incorrect secret has
been decoded and we repeat the same procedure for the next candidate set L”.
If no error is detected, it indicates that K * = K I with very high probability.

In this case, the 16—bit CRC code is removed from K * and the system outputs

the secret K, which indicates a successful match.

5.3.3 Alignment based on High Curvature Points

The ﬁrst step in matching two ﬁngerprint images is to apply an alignment (regis—
tration) algorithm that can remove translation, rotation and possibly any non-linear
distortion between the two images and determine the area of overlap. Although align-
ing two ﬁngerprints is a difﬁcult problem in any ﬁngerprint authentication system,
it is particularly more difﬁcult in a biometric cryptosystem like fuzzy vault. This is

148

because the original ﬁngerprint template is not available during authentication and
only a transformed version of template is available in the vault.

Previous implementations of ﬁngerprint-based fuzzy vault either assumed that
the template and query ﬁngerprint images are pre-aligned [42] or used a reference
point (e.g., core point [161] or a reference minutia point [209]) for alignment. Though
alignment based on a reference point is simple and computationally efficient, it is
difﬁcult to determine the reference point reliably. Even a small error in locating the
reference point could lead to a false reject. To avoid this problem, Uludag and Jain
[196] proposed the use of additional information derived from the ﬁngerprint image to
assist in alignment. While this additional data should carry sufficient information to
accurately align the template and query images, it should not reveal any information
about the template minutiae used for constructing the vault because any such leakage
would compromise the security of the vault. Uludag and Jain derived the alignment
data from the ﬁngerprint orientation ﬁeld. In particular, points of high curvature were
used as the alignment data in [196] and an Iterative Closest Point (ICP) algorithm
was used to determine the alignment between the template and the query based on
this alignment data. Our proposed alignment scheme is similar to the one presented

in [196] with some modiﬁcations.

Extraction of High Curvature Points

An orientation ﬁeld flow curve [47] is a set of piecewise linear segments whose tan-
gent direction at each point is parallel to the orientation ﬁeld direction at that point.
Although flow curves are similar to ﬁngerprint ridges, extraction of ﬂow curves is

149

not affected by breaks and discontinuities, which are commonly encountered in ridge
extraction. Points of maximum curvature in the ﬂow curves along with their cor-
responding curvature values constitute the alignment data in our implementation.
Therefore, the algorithm for extraction of high curvature points (see Figure 5.7) con-
sists of four steps: (i) orientation ﬁeld estimation, (ii) extraction of ﬂow curves, (iii)
determination of maximum curvature points and (iv) clustering of high curvature

points.

Let I be a ﬁngerprint image with U rows and V columns. A robust estimate of
the orientation ﬁeld for the given ﬁngerprint image is obtained using the algorithm
described in [46]. Let 6 = (A,u) be a point in I, where 1 S /\ S U and 1 S a S V.
Let 453 be the orientation of the ridge ﬂow with respect to the horizontal axis in the
neighborhood of 6. Let 03 = (cos (basin (by) be the unit orientation vector at 6. A

ﬂow curve with starting point [0 E I can be deﬁned iteratively as

é’j =(j-1 +P'7‘0€j_1: (5-3)

for j = 1,2, - -- ,J. Here, ,0 = {—1,+1} deﬁnes the flow direction from €j_1 to 63-, 7
is the length of the line segment from [j—l to £3- and Ogj._1 is the unit orientation
vector at the point €j_1. The process of tracing a flow curve is terminated when
(i) the boundaries of the image are reached or (ii) J exceeds a certain pre—deﬁned
threshold Jmax- The parameter 7 determines the sampling interval of the flow curve

and is set to 5 pixels in our experiments. Each starting point 60 generates two curve

+

J
segments {63‘ }

i=1

J—
and {67—} 1 in opposite directions corresponding to p = +1
J:

150

228 155 1.57
228 157 1.55
226 159 1.46

318 40 0.77
316 37 0.76
317 43 0.75

 

Orientation Field Flow Curves High Curvature Points Helper Data

Figure 5.7: Algorithm for extraction of high curvature points.

and p = —1, respectively. The maximum number of samples in each curve segment,
Jmam, is set to 150. The two curve segments are then merged to get the complete
ﬂow curve, which is represented as a set of points {63- }:,:1, where J, = J+ + J _.
By repeating this procedure with different starting points (0 E I , we obtain a set
of ﬂow curves. Midpoints of the ridges in the thinned ﬁngerprint image and points
in whose neighborhood the orientation ﬁeld changes signiﬁcantly are chosen as the

starting points.

The curvature (w) of a point €3- in a flow curve is deﬁned as we], = 1 — cos agj,
where are]. is the angle between the vectors that are tangent to the ﬂow curve at the
points €j_T and €j+T, for all r S j S J, — r. The parameter r is related to the
sampling interval of the ﬂow curve ('7) and is set to 5. The value of cos agj can be
easily computed from the orientation ﬁeld as cos (13]. = (pj_TOgj_T) =0: (pj+TOgj+T),
where pj_.,. is the ﬂow direction from €j_7. to (j, Pj+r is the flow direction from

151

l’ j to 63-.” and * indicates dot product. The value of tag]. is minimum (zero) when
there is no change in direction as we go from gj—r to €j+r through E]- and it attains
its maximum value of 2 when the change in direction is It. For each flow curve, the
curvature values for the points in the curve are estimated and local maxima in the
curvature are detected. If the value of the local maximum is greater than a threshold
0 (set to 0.3), then the point is marked as a high curvature point and the 3—tuple
h = (A, raw), where (A, u) is the location and w is the curvature value, is added to
the alignment data set H. Figure 5.8 shows the procedure for curvature estimation
at a point and a trace of the curvature values for a sample flow curve. The process
of determining the maximum curvature points is repeated for all the ﬂow curves, and
the ﬁnal alignment data set for the image 1' is obtained as HI = {hﬁff 1, where R1
is the number of high curvature points in I. High curvature points usually tend to
occur near the singular points (core and delta) in a ﬁngerprint image. If the image has
more than one singular point, the points in the alignment data set may have many
clusters. Hence, a single-link clustering algorithm is applied to cluster the elements
of the alignment data set based on the location of the points.

The proposed alignment data extraction scheme differs from the one proposed
in [196] mainly in the deﬁnitions of curvature and local maxima in the curvature.
The proposed deﬁnition of curvature leads to a smooth estimate of curvature with
distinct local maxima. Further, unlike [196] where a single point having the maximum
curvature is selected as the high curvature point, we apply a robust local maxima
detection algorithm and utilize all the locally maximum points. This leads to better
alignment data extraction for some types of ﬁngerprint images such as whorls because

152

 

(a)

1.6
1.4 '
1.2 '

0.8 -
0.6

0.4 .
0.2 .

Curvature

0 1o 20 so 40 so so 70
Point Index

 

A Sample Flow
Curve

Curvature Trace along the
Flow Curve

(b)
Figure 5.8: Determination of maximum curvature points. (a) Curvature estimation

at point 6]- and (b) trace of curvature for a sample flow curve along with the local
maximum.

153

the ﬂow curves near the core region of whorls generally tend to have more than one

high curvature point (one above the core and one below the core).

Alignment using ICP

Let T and Q be the template and query ﬁngerprint images, respectively. Let H T =
{hi-Thfiq; and H Q = {hgf2}f__c_21 be the alignment data sets obtained from T and Q,
respectively. Let M Q = {m§?}§V=Ql be the query minutiae set, where N Q is the
number of minutia points in Q. The goal of the alignment scheme is to ﬁnd a rigid
transformation F that closely aligns M Q with the template minutiae set M T based
on the alignment data sets H T and H Q. Note that the template minutiae set M T is
not available during alignment and only H T is known. We use the Iterative Closest

Point (ICP) algorithm proposed by Besl and McKay [8] to align H T and H Q and

estimate the rigid transformation F.

The ICP algorithm to align the template and query alignment data sets
is shown in the appendix as Algorithm B1 In this algorithm, the function
INITTRANS (HT,HQ) estimates an initial transformation between H T and H Q
by aligning the center of mass of the points in H T and H Q. The weighted distance,

D H, between two high curvature points h,- and hj is deﬁned as

 

DHUI’i’ hj) = \/()‘i — A392 + (M — #j)2 + ﬁlez‘ — wt (54)

where [3 H weights the relative contribution of the Euclidean distance between the
points (ﬁrst term) and the difference in curvature (second term). The parameter

154

6 H is set to 100 in our experiments. The function TRANS (H TlQ, H Q) computes
the transformation F I that minimizes the mean squared Euclidean distance between
the locations of the corresponding points in H TlQ and H Q. Algorithm B1 is run
until convergence or until a maximum number of iterations (kmax) is reached. The
algorithm is said to converge if the change in the mean weighted distance (M WD)
between the paired points is less than a threshold (Dstop)- The values of kmam and

Dstop are set to 200 and 0.01, respectively.

When the template and query images overlap only partially, it is possible that the
overlap between the template and query alignment data sets is also partial. In such
cases, all the high curvature points in the query may not have a corresponding point
in the template. Algorithm B.1 strictly assigns a correspondence between every high
curvature point in the query and the template, and this may lead to alignment errors
when the overlap between the two sets is partial. To overcome this problem, we use
the trimmed ICP algorithm [35], which basically ignores a proportion of the points
in the query alignment data set whose distance to the corresponding points in the
template alignment data set is large, i.e., we ignore the query points with large values
of DH (hle, h?) The proportion of points to be ignored is found by minimizing
an objective function (see [35] for details). The trimmed ICP algorithm is also robust

to outliers in the alignment data sets.

Based on the rigid transformation F output by the ICP algorithm, we align the
query minutiae set M Q with the template. Let 1% AQ = F (ll/IQ) = {meg-Vle
represent the query minutiae set after alignment. Figure 5.9 shows an example of

155

successful minutiae alignment based on high curvature points and trimmed ICP al-
gorithm. In Algorithm 8.1, it is assumed that both the alignment data sets HT
and H Q have only a single cluster. If the number of clusters in HT and/or H Q is
more than one, then the algorithm is repeated for all possible cluster pairs. In this
scenario, there will be multiple aligned query minutiae sets. We select the aligned

I
query minutiae set that gives the largest unlocking set L .

5.4 Proposed Iris Cryptosystem

The most common representation scheme used for matching iris images is the iriscode
representation developed by Daugman [50]. The iriscode features are obtained by
dernodulating the iris pattern using quadrature 2D Gabor wavelets. In order to
account for the variations in the pupil dilation, iris size and rotation, the rubber
sheet model [50] is used to normalize the Gabor responses. The phase information
in the resulting Gabor responses is then quantized into one of the four quadrants
to produce a two—bit code for each local region. When the iris pattern is sampled
at R different radii and 3 different angles, a N-bit iriscode sequence is generated,
where N = (2 x R x S) We use the algorithms described in [177] for pre-processing,
segmentation and extraction of iriscodes from the iris images.

We now propose an iris cryptosystem to secure iriscode templates. Since the
iriscode is a ﬁxed length binary vector in which the relative order information between
the bits is essential for matching, we cannot secure the iriscode directly using the fuzzy
vault framework. To overcome this problem, we construct the iris cryptosystem in

156

 

Figure 5.9: An example of successful minutiae alignment based on high curvature
points and ICP algorithm. (a) Template image with minutiae and high curvature
points, (b) query image with minutiae and high curvature points (c) template and
overlaid query minutiae prior to alignment and ((1) template and overlaid query minu-
tiae after alignment. In this ﬁgure, the template minutiae are represented as squares
(tails indicate the minutia direction) and the query minutiae are represented as cir—
cles. The template and query high curvature points are represented as asterisks and
diamonds, respectively.

157

two steps (see Figure 5.10). In the ﬁrst step, we apply a salting (invertible) transform
to the iriscode template based on a randomly generated transformation key. Since the
transformation is invertible, the security of the transformed iriscode template relies
on the security of the transformation key. Hence, in the second step, we represent the
transformation key as an unordered set and secure it using the fuzzy vault construct.
Both the transformed iriscode template and the vault that embeds the transformation

key constitute the helper data in this iris cryptosystem.

The proposed iris cryptosystem has two main advantages. Firstly, the salting step
can be considered as a feature transformation function that converts a ﬁxed length
binary vector into an unordered set. This enables us to secure diverse biometric tem-
plates such as ﬁngerprint minutiae and iriscode as a single multibiometric fuzzy vault.
Moreover, both the salting and fuzzy vault steps can account for intra-user variations
in the iriscode template. Due to the presence of two layers of error correction, the
proposed iris cryptosystem allows larger intra—user variations in the iriscode template

and hence, provides a high genuine accept rate.

5.4.1 Helper Data Extraction

The schematic diagram of helper data extraction scheme in the proposed iris cryp-
tosystem is shown in Figure 5.10(a). The salting transform consists of two operations,
namely, BCH encoding [122] and an exclusive-or operation. Let H be a (M I, M K)
BCH encoding function, which takes a message K of length Ill/I K (1M K < llfl) and
appends (ll/I I — ll/IK) error correcting symbols to it in order to generate a codeword

158

Template Image

Helper Data Extraction

 
    
 

         
     
     
 

 

[ TransformatIon Unordered Fuzzy Vault
] Key (K,) t Encoder (F) i
I I
I Va It I
I I Transformation key
: BCH 50606” (H) Key (K2) ] embedded In vault
l ] V-F2(K11K2)
fl“‘.‘1‘.7‘?f"~ .1“ a"; "I -'-' .‘~-' [ w [4
Template Irlsoode (tr) I l Transformed
: Salting (Invertlble) ] Irlsoode Template
\_T'_"1"_°'_"‘_'E°ﬂ {F9 ______________ I (1' =Ft(1r:'<t))
(a)
Recovery
Inverse

Transformation (F

 

Transformed

Irlscode Template
(1- -F1(IVK,)) Match]
Non-match

 

 

Transformation key
embedded In vault
V- F2(K,,K2)

(b)

Figure 5.10: Schematic diagram of the iris cryptosystem based on iriscode features.
(a) Enrollment or helper data extraction and (b) authentication or key recovery.

159

I = H (K) of length M I- In particular, we employ a primitive binary BCH encoding
scheme, where M1 is chosen to be (2m — 1) and m is an integer greater than or equal
to 3. The values of M I and M K determine the number of errors that can be corrected
by the BCH coding scheme.

Let IT be a iriscode template of length NI bits that is to be secured using the
fuzzy vault framework. First, we partition the template IT into 7‘ non-overlapping
components [1%,12 , - -- ,Ign] such that each component 1% (j = 1, 2, - -- ,1") contains
exactly MI bits. Here, 1" is selected such that TM I 2 N1. When N I < TM],
appropriate number (i.e., (TM I — N1)) of zero bits are appended to the iriscode
template IT to obtain the components [1%, 1%, - - - ,151]. Next, we randomly generate
1* binary vectors K 1, K 2, - -- ,K" each of length MK bits. These 7' random binary
vectors together constitute the transformation key K 1 of length TM K bits, i.e., K1 2
[K1, K2, - -- , K r] . The BCH encoder H is applied individually to the binary vectors
K1,K2,--- ,K’" to obtain the codewords H(K1),H(K2),--- ,H(KT). Note that
H (Kj ), j = 1,2, - -- ,r is a binary vector of length M I- Finally, an exclusive-or
operation is performed between the r codewords generated by the BCH encoder and
the corresponding components of the iriscode template to obtain the components of
the transformed iriscode. The transformed iriscode template 1* can be represented
as [Il,IE,--- ,II], where the jth component 1;: is given by Ij = 1% EB H(Kj) , EB
denotes the exclusive-or operation and j = 1, 2, - .. ,7". Hence, the complete salting
transformation can be represented as a function F1 that takes the iriscode template
IT and the transformation key K1 as inputs and generates the transformed iriscode
1* such that 1* = F1(IT,K1).

160

The transformation key K1 is secured using the fuzzy vault construct as follows.
Since the value of .M K is set to 16 in our implementation, we can directly represent
the 1‘ components of the transformation key as elements in the Galois ﬁeld GF(216).
Our authentication (or key recovery) scheme has been designed in such a way that
it does not require the relative order information between the components of key
K1. Hence, the components of the transformation key K1 can be directly repre—
sented as an unordered set X = {xj };=1, where :Itj is the representation of the
component K j in GF(216). Let Y = {yk}i=1 be the set of chaff points such that
yk E GF(216),yk 7Q xj,‘v’j =1,2,--- ,r and k = 1,2,--~ ,3. Based on these two sets
X and Y and a different key K2 (referred to as the vault key with size 1672 bits), we
can construct a fuzzy vault V = {(ai, bi)}:____1,t = r + s by following steps 5 through
8 in the vault encoding algorithm presented in section 5.3.1. As pointed out earlier,
the transformed iriscode I... and the vault V together constitute the helper data in

the iris cryptosystem.

5.4.2 Authentication

The steps involved in authentication based on the proposed iris cryptosystem are
shown in Figure 5.10(b). Authentication or key recovery consists of two main stages.
First, the inverse salting transform is applied to the transformed iris code template
1* using the query iriscode IQ. This facilitates the recovery of the transformation key
used in vault encoding. Since the template and query iriscodes will not be identical
due to intra—user variations, the recovered transformation key K 1 may have some

161

I

errors. In the second step, the transformation key K1 is used to decode the vault V.
I

If the template and query iriscodes are sufficiently similar, the recovered key K1 will

be sufficiently similar to K1 and hence, the vault can be successfully decoded.

The inverse salting transform again consists of two operations, an exclusive-or
followed by BCH decoding. Let 1Q be the query iriscode of length N1 bits. Similar
to the encoding stage, we partition the query 1Q into 1“ non-overlapping components
[165,132, - - - , 15] such that each component 132 (j = 1, 2, - - - , 1") contains exactly MI
bits. An exclusive-or operation is performed between the 1' components of the query
iriscode and the corresponding components of the transformed iriscode to obtain the
corrupted codewords. The jth corrupted codeword, H ’(Kj ), is given by H’(Kj) =
1;: EB Ij = 122 619 1% EB H(Kj) = ej EB H(Kj), where ej is error vector indicating the
differences between 122 and 1:31.. forj = 1, 2, - -- , 1'. Let H‘1 be a (M1, MK) primitive
binary BCH decoding function that takes a corrupted codeword H ’(K ) of length MI
and decodes it into a message K I of length M K- If the Hamming distance between
the corrupted codeword H ’(K ) and the original codeword H (K ) is less than the error

I
correcting capability of the BCH coding scheme, then the decoded message K would

be the same as the original message K.

The corrupted codewords H,(Kj), j = 1,2, - -- ,r are decoded using the BCH
decoder to recover the components of the transformation key K [j . If there are lim-
ited number of bit differences between the template and query iriscode components,
the BCH decoder can account for those variations and the corresponding compo-
nents of the transformation key can be recovered without any errors. However, due

162

to problems such as occlusion, there may be large differences between some of the
template and query iriscode components and the corresponding components of the

transformation key cannot be recovered correctly. The components of the recovered

7‘

I I I
transformation key are represented as an unordered set X = {27]- }j=1’ where :1: j is

I - I
the representation of the component K J in GF(216). The unlocking set L can be ob-
. I 7" I .
tamed as L = {(ai,bz-)}i=1, where (ai,bz-) E V and a,- = :rj, for some J E 1, 2, - ~ - ,r
I
and r S 7‘. Steps 7 and 8 of the vault decoding algorithm presented in section 5.3.2

are applied to recover the vault key K 2. Successful recovery of the vault key indicates

a match between the template and query iriscodes.

5.5 Multibiometric Fuzzy Vault

In a multibiometric system, there are multiple templates for each user corresponding
to the different biometric sources. We propose a feature-level fusion to derive a single
multibiometric template from the individual templates and secure the multibiomet-
ric template using a single fuzzy vault construct. In particular, we Show how the
multibiometric template can be derived in the following three scenarios, (i) multi-
ple impressions of the same ﬁnger, (ii) multiple instances (e.g., left and right index
fingers) and (iii) multiple traits (e.g., ﬁngerprint and iris).

When multiple ﬁngerprint impressions of the same ﬁnger are available for vault
encoding, we can apply a mosaicing technique [170] to combine the minutiae and
high curvature points from the individual images into a single mosaiced template and
alignment data set. When multiple impressions are available for decoding, we use

163

them sequentially to unlock the vault. The decoding is successful if at least one of
the two queries succeeds in unlocking the vault.

When multiple instances of the same biometric trait are available for a user, we
can obtain the multibiometric template by concatenating the different feature sets.
For example, if Mil-:1 and M}; are the template minutiae sets derived from the right
and left index ﬁngers of a user, respectively, the combined minutiae set Mg: can be
obtained as the union of the sets Mg and Mg. The fuzzy vault for the combined
minutiae set M}: can be constructed using the same procedure described in section
5.3.1. The high curvature points from both the ﬁngers are stored separately along
with the single multibiometric vault. During authentication, the query and template
minutiae sets of the two ﬁngers are aligned independently. The aligned query minutiae
sets of the right and left index ﬁngers are used to ﬁlter the chaff points from the
vault to generate two unlocking sets L353 and LIF2. Either the union or the largest
unlocking set can be considered as the ﬁnal unlocking set that is used for polynomial
reconstruction.

Figure 5.11 shows the encoding phase of a multimodal fuzzy vault with ﬁngerprint
and iris modalities. In this scenario, a feature transformation function is applied to the
iriscode template to convert it into an unordered set with the help of a transformation
key. The salting transform described in section 5.4.1 can be used for this purpose.
Let X F and X1 be the set of feature points generated by the ﬁngerprint and iris
modalities, respectively. Note that all elements of the sets X F and X I are in Galois
Field GF(216). The union, X, of the two sets X F and X 1 is formed such that
the Hamming distance between any two elements in the union is greater than or

164

Polynomial Chaff Points

Evaluation
Secret

[5234]

l

P(x) =
5x3+ 2x2+ 3x+ 4

 

   

  
    
    

Feature
Level
Fusion

  

Minutiae Iriscode Template

Minutiae
Template

 

Figure 5.11: Schematic diagram of a multimodal (ﬁngerprint and iris) fuzzy vault.

165

equal to 2. Here, the Hamming distance between any two elements in GF(216) is
deﬁned as the number of bit differences in the 16-bit binary representation of the
elements. Steps 5 through 8 of the vault encoding algorithm presented in section
5.3.1 are then used for constructing the multimodal fuzzy vault. The high curvature
points from the ﬁngerprint and the transformed iriscode template are stored along
with the vault as helper data. During authentication, the query iriscode is used to
recover the transformation key from the transformed iriscode template. The aligned
query minutiae set and the recovered iris transformation key are used to ﬁlter the
chaff points from the vault and two unlocking sets LIF and LII are generated. The
union of the two unlocking sets is considered as the ﬁnal unlocking set that is used

for polynomial reconstruction.

5.6 Experimental Results

5.6.1 Fingerprint-based Vault

The performance of the proposed ﬁngerprint-based fuzzy vault implementation has
been evaluated on FVC2002-DB2 [128] and MSU-DBI [94] ﬁngerprint databases (see

Appendix A.2). We consider the following three scenarios for vault implementation.
1. One impression is used for encoding and one impression is used for decoding.
2. Two impressions are used for encoding and one impression is used for decoding.

3. Two impressions are used for encoding and two impressions are used for decod-
ing.

166

The parameters used in our implementation for the two databases are listed in
Table 5.2. The choice of polynomial degree (n) is related to the size of the secret
to be secured. For example, if n = 8, we can secure a key of size 128-bits. Since
the vault decoding is successful if (n + 1) query minutiae match with the template
minutiae, the parameter It also affects the error rates. Since the number of minutiae
varies for different users, using a ﬁxed value of 7‘ (the number of genuine minutiae
points in the vault) across all users leads to a large failure to capture (FTC) rate. To
overcome this problem, we ﬁx the range of r and determine its value individually for
each user. The number of chaff points in the vault (s) is chosen to be approximately
10 times the number of genuine points in the vault, which is a reasonable tradeoff
between the complexity of a brute force attack and storage requirements of the vault.
The number of bits used for encoding the minutia attributes u, v and 6 into the ﬁeld
.7 = GF(216) are Bu = 6, By = 5 and 89 = 5, respectively. The allocation of bits
determines the quantization step size for u, v and 6 and it depends on the image size.
For the databases used here, the above parameter values for Bu, 13v and 139 did not

change the distribution of number of matching minutiae after quantization.

Table 5.2: Parameters used for fuzzy vault implementation.

 

 

 

 

 

 

 

 

 

 

 

Parameter FVC2002-DB2 MSU-DB1
No. of genuine points in the vault, 7' 18-24 24-36
Degree of encoding polynomial, n 7—10 10—12
Total no. of points in the vault, t 224 336
No. of chaff points in the vault, s 200—206 300-312
Minimum distance between selected minutiae, 61 25 25
Maximum distance between a query minutia and 30 40
points selected by the coarse ﬁlter, 62

 

167

An example of successful vault operation for a user from FVC2002—DB2 when
n = 8 is shown in Figure 5.12. Figure 5.12(f) shows that the ICP algorithm leads
to correct alignment of query minutiae with the template minutiae concealed in the
vault. The coarse ﬁlter and minutiae matcher eliminate most of the chaff points
from the vault. The unlocking set mainly consists of genuine points from the vault.
For example, in Figure 5.12(g) we observe that there is only one chaff point in the
unlocking set. Since the number of genuine points in the unlocking set is more than
9, the decoding is successful in this example.

The criteria used for evaluating the performance of the vault are failure to cap-
ture rate (FTCR), genuine accept rate (GAR) and false accept rate (FAR). When the
number of well-separated minutiae in the template and/or query ﬁngerprint is less
than r, it results in failure to capture. The genuine accept rate is deﬁned as the per-
centage of attempts made by genuine users that resulted in successful authentication.
Since a vault is constructed for each ﬁnger, the number of genuine attempts is 100
and 160 for the FVC and MSU databases, respectively. The false accept rate is the
percentage of attempts made by impostors that resulted in successful decoding of a
vault corresponding to a legitimate user. Impostor attempts were simulated by trying
to decode a user’s vault using impressions from all the other users. The number of
impostor attempts is 9, 900 and 25, 440 for the PVC and MSU databases, respectively.

The ﬁrst row of Table 5.3 shows the performance of the proposed vault implemen-
tation on the FVC2002-DBZ database for different key sizes when a single impression
is used for encoding and decoding (impression I is used for encoding and impression 2
for decoding). For example, when the key size is 128 bits (71. = 8), 91 out of 100 gen-

168

 

(d) (e) (f) (s)

Figure 5.12: An example of successful operation of the fuzzy vault. (a) Template
ﬁngerprint image with minutiae, (b) selected template minutiae and high curvature
points, (c) vault in which the selected template minutiae are hidden among chaff
points (for clarity, minutiae directions are not shown), ((1) query ﬁngerprint image
with minutiae, (e) selected query minutiae and high curvature points, (f) ICP align-
ment of template and query high curvature points and coarse ﬁltering of chaff points,
and (g) unlocking set obtained by applying a minutiae matcher that eliminates almost
all the chaff points. The two points shown in ﬁlled squares in (g) are the only chaff
points that remain in the unlocking set. Here, ﬁgures (a)-(c) represent vault encoding
and (d)-(g) represent vault decoding.

169

uine attempts were successful. Among the 9 failed attempts, 2 were due to the lack of
a sufﬁcient number of minutiae in the template (FTC error). So, only 7 false rejects
were actually encountered. For the same experiment, the fuzzy vault implemented
in [196] was successful only in 61 out of 100 attempts with a FTCR of 16%. The
high FTCR in [196] is due to errors in the extraction of high curvature points. If the
alignment stage in the implementation of [196] is replaced with the one proposed in
this thesis, the FTCR reduces to 2% and the GAR improves to 74%. This shows that
the proposed alignment data extraction and alignment algorithms are more robust
compared to those presented in [196]. The selection of reliable minutiae based on
image quality and use of a minutiae matcher to account for non-linear distortion con-
tribute to further improvement in the GAR from 74% to 91%. The net improvement
in the GAR achieved by the proposed implementation over [196] is 30%.

In the case of MSU-DBI database, using single impressions for encoding and de-
coding results in a FTCR of 5.6% and a GAR of 82.5% for n = 11 (see the ﬁrst
row of Table 5.4). This decrease in performance compared to FVC2002-DB2 is due
to the lower quality of images in the MSU database. However, the average number
of matching minutiae in the MSU database is higher than in FVC2002—DB2, which

allows us to accommodate a larger key size.

The proposed alignment technique based on high curvature points also performs

better than registration based on core point. Since it is difficult to determine the core

170

Table 5.3: Performance of the proposed ﬁngerprint-based fuzzy vault implementation
on FVC2002-DB2 database. Here, n denotes the degree of the encoding polynomial.
The maximum key size that can be secured is 1612. bits. The Failure to Capture Rate
(FTCR), Genuine Accept Rate (GAR) and False Accept Rate (FAR) are expressed
as percentages.

 

 

 

 

 

. n = 7 n = 8 n = 10
scenam FTCR GAR FAR GAR FAR GAR FAR
1 Template, 1 2 91 0.13 91 0.01 86 0

Query
Mosaiced 1 95 0.12 94 0.02 88 0
Template, 1
Query
Mosaiced 1 97 0.24 96 0.04 90 0
Template, 2
Queries

 

 

 

 

 

 

 

 

 

 

Table 5.4: Performance of the proposed ﬁngerprint-based fuzzy vault implementation
on MSU-DBI database. The Failure to Capture Rate (FTCR), Genuine Accept Rate
(GAR) and False Accept Rate (FAR) are expressed as percentages.

 

 

 

 

 

 

. n: 10 n: 11 n: 12
scenam FTCR GAR FAR GAR FAR GAR FAR
1Template,1 5.6 85 0.08 82.5 0.02 78.8 0

Query
Mosaiced 2.5 88.1 0.09 83.1 0.02 81.2 0
Template,1
Query
Mosaiced 0 96.9 0.16 92.5 0.03 87.5 0
Template, 2
Queries

 

 

 

 

 

 

 

 

171

 

point reliably, alignment based on core points leads to larger false rejects and failure to
capture errors. For example, when core point based alignment3 was used (instead of
high curvature points) in the vault implementation, the FTCR increased from 2% to
6% in the PVC database and from 5.6% to 15.6% in the MSU database. The reasons
for increase in FTCR are (i) no core point is present in some of the images (e.g., arch
ﬁngerprints) and (ii) the algorithm fails to ﬁnd the core point in some images (e.g.,
images where the loops are not very prominent). These are well-known problems in
core point detection. Furthermore, errors in ﬁnding the exact location and direction
of the core point lead to a reduction in the GAR. The GAR decreases from 91% to
81% (n = 8) and from 82.5% to 77.5% (n = 11) for the PVC and MSU databases,
respectively. These results clearly demonstrate the merits of using alignment based

on high curvature points compared to core-based alignment.

One way to improve the performance of the vault is to use multiple impressions
(templates) from the same ﬁnger during enrollment. However, we cannot create a
vault for each enrolled image because an attacker can compare the multiple vaults
and identify the chaff points. Therefore, we obtain a single mosaiced template from
two impressions and use the mosaiced minutiae to construct the vault. From row 2
of Table 5.3 we observe that mosaicing reduces the FTCR from 2% to 1% and also
increases the GAR of the system for all values of n. The performance can be further
improved by using multiple queries during authentication. In case of 128-bit key size

(n = 8) for FVC2002-DB2 database, mosaiced template leads to a GAR of 94% and

 

3The core point was detected using the commercial Neurotechnologija Veriﬁnger software, which
was downloaded from http://www.neurotechnologija. com.

172

using two queries instead of one query increases the GAR to 96%. The use of multiple
impressions also leads to a signiﬁcant reduction in FTCR and increase in GAR for
the MSU-DBI database (see rows 2 and 3 of Table 5.4).

The false rejects in our experiments were either due to errors in alignment data
extraction or due to insufficient number of matching minutiae in the overlapping
region between the template and query. Figure 5.13 shows an example where the
false reject is due to incorrect alignment data extraction. In this case, the high
curvature points for template ﬁngerprint are inaccurate because the region of high
curvature (core region) is close to the image boundary (see Figure 5.13(a)). An
example of failure due to insufficient number of overlapping minutiae is presented in
Figure 5.14. While the alignment between the template and query images in Figure
5.14 is accurate, there are only 5 matching minutiae. This leads to a false reject
because at least 9 genuine minutiae must be identiﬁed in the vault for successful
decoding.

The FAR of the proposed fuzzy vault implementation is non-zero for smaller values
of n. In the single impression scenario for F VC2002-DB2, when n = 8, we observed
one false accept in 9, 900 impostor attempts. The template and query ﬁngerprint pair
that gives rise to a false accept is shown in Figure 5.15. Analysis of this false accept
example indicates that there is indeed a set of 9 minutiae in the query that matches
with the template minutiae in both location and direction (see Figure 5.15(c)). Since
the vault decoding is successful if (n + 1) points in the query minutiae set (of size
7‘) match with the template minutiae, the genuine accept and false accept rates vary
with 12. when r is ﬁxed. Reducing It increases both GAR and FAR and increasing n

173

 

Figure 5.13: Failure due to incorrect extraction of high curvature points. (a) Template
ﬁngerprint image with minutiae and high curvature points, (b) query ﬁngerprint image
with minutiae and high curvature points, and (c) ICP alignment of template and
query high curvature points along with aligned template and query minutiae. High
curvature points were incorrectly detected in the template because the high curvature
region is near the boundary.

174

 

Figure 5.14: Failure due to partial overlap. (a) Template ﬁngerprint image with
minutiae and high curvature points, (b) query ﬁngerprint image with minutiae and
high curvature points, and (c) ICP alignment of template and query high curvature
points along with aligned template and query minutiae. Though the alignment is
accurate, there are only few matching minutiae in these two images.

175

lowers both GAR and FAR. As observed from Table 5.3, FAR is high when n = 7
and is zero when n = 10. We also observe a marginal decrease in the GAR when n
is increased from 7 to 10. The FAR for the MSU-DBI database also shows a similar

behavior.

As pointed out earlier, a drawback of the modiﬁed fuzzy vault scheme in [197] com-
pared to the original scheme in [102] is the need to verify multiple candidate secrets.
In [197] it was reported that an average of 201 candidate secrets were evaluated cor-
responding to 52 seconds of computation in Matlab with a 3.4 GHz processor system.
In our implementation, the use of minutiae orientation in addition to the minutiae
location eliminates almost all the chaff points from the unlocking set. Therefore, the
median number of candidate secrets that need to be evaluated is only 2 (mean is 33)

and the median decoding time is 3 seconds (mean is 8 seconds) on a similar processor.

5.6.2 Iris Cryptosystem

The performance of the proposed iris cryptosystem has been evaluated on the CASIA
iris database (see Appendix for details). In our implementation, the Gabor phase
responses are sampled at R(= 48) different radii and S (= 360) angles to generate a
(48 x 360 x 2)-bit iriscode. Further, we partition the iriscode into r(= 48) components
with each partition containing M I(= 1023) hits. We use a (1023,16) BCH coding
scheme, which can correct up to 247 errors in a 1023-bit codeword. Thus, the BCH
codes are capable of correcting approximately 25% of the errors in the query iriscode.
The size of the transformation key K1 used to secure the iriscode template is (48 X 16)

176

  
 

 

.. can» a? 71:3?” :95, "39.,

. '3
v

    

(a) (b) (C)

Figure 5.15: An example of false accept when n = 8. (a) Template ﬁngerprint
image with minutiae and high curvature points, (b) query ﬁngerprint image with
minutiae and high curvature points, and (c) ICP alignment of template and query
high curvature points along with aligned template and query minutiae. In (c), we
observe that there are 9 matching minutiae between the query and the template
(represented as dotted ellipses).

177

bits. The transformation key itself is secured using the fuzzy vault framework by using
a vault key K2 of size 16'". bits, where n is the degree of the polynomial used in vault
encoding. We evaluate the performance of the iris cryptosystem at two different
values of n (10 and 11), which provide a false accept rate of less than 0.02%. The
number of chaff points (3) used in the vault is set to 500.

Ideally, the bits in a query iriscode should directly correspond to the bits at the
same location in the iriscode template. However, due to relative rotation of the iris
pattern in the template and query iris images, the bits in a query iriscode may be
shifted by a few locations with respect to the template iriscode. To account for this
rotation offset, we cyclically shift the bits in the query iriscode by up to 3 locations
both to the left and the right and repeat the authentication steps for each shifted
query iriscode. A non—match decision is output only when none of the seven query
iriscode patterns (one original and six shifted versions) are unable to recover the vault
key.

The performance of the iris cryptosystem is shown in the ﬁrst row of Table 5.6.
The genuine accept rate of the iris cryptosystem is 88% at a false accept rate of less
than 0.02%. The GAR of the Hamming distance-based iris matcher [50] that uses the
original template and query iriscodes is approximately 94% at a FAR of 0.02%. Thus,
there is a slight degradation in the GAR of the iris modality due to the application
of the proposed template protection scheme. The reason for this degradation is that
the BCH coding scheme has a strict threshold on the number of errors that can
be corrected. When the number of bit differences between the template and query
iriscode components is greater than 247, then the corresponding components of the

178

transformation key cannot be recovered. In some cases, features could not be reliably
extracted from a relatively large region in the iris pattern due to factors like occlusion.
The Hamming distance-based iris matcher accounts for this problem by determining
the occluded regions (also known as the mask information) and ignoring the iriscode
bits in those regions when computing the Hamming distance. However, the proposed

cryptosystem cannot effectively handle this problem which leads to more false rejects.

5.6.3 Multibiometric Vault

The MSU-DBI ﬁngerprint database [94] is used to evaluate the performance of the
multiﬁnger vault because it contains impressions from four different ﬁngers (index and
middle ﬁngers) acquired from the same user. We use only the right and left index
ﬁngers in our experiments. The same parameters presented in the third column of
Table 5.2 are used for constructing the vaults for the individual ﬁngers. In the case
of the multiﬁnger vault, 48 to 72 genuine points are used in the vault and the total
number of points in the vault (t) is set to 672. Thus, the number of chaff points
in the vault is between 600 and 624. The performance of the multiﬁnger vault is
summarized in Table 5.5. When the largest of the two unlocking sets LIF1 and L’F2
is selected as the ﬁnal unlocking set L’F, the GAR improves signiﬁcantly to 90% at a
FAR of 0.02% compared to the single ﬁnger case. However, in this scenario there is
no change in the size of the vault key (K2) that determines the security of the vault.
On the other hand, using the union of the two unlocking sets leads to a signiﬁcant

improvement in the security but leads to only a marginal improvement in the GAR.

179

Table 5.5: Performance of the multiﬁnger (right and left index ﬁngers) fuzzy vault on
the MSU-DBI ﬁngerprint database. The Failure to Capture Rate (FT CR), Genuine
Accept Rate (GAR) and False Accept Rate (FAR) are expressed as percentages and
the key size is expressed in bits.

 

 

 

 

 

 

 

. FAR = 0.02 FAR :2 0
scenam FTCR GAR Vault Key GAR Vault Key
Size Size
Right Index Finger 5.6 82.5 176 78.8 192
Left Index Finger 8.8 75.6 176 69.4 192
Both Fingers 0 90 176 87.5 192
(Largest of the two
unlocking sets)
Both Fingers (Union 0 84.4 304 78.8 336
of the two unlocking
sets)

 

 

 

 

 

 

 

Finally, a virtual multimodal database derived from the MSU-DBI ﬁngerprint
and CASIA iris databases is used to evaluate the performance of a multimodal fuzzy
vault that simultaneously secures the minutiae template from the right index ﬁnger
and the iriscode template. The multimodal (right index ﬁnger and iris) database
consists of 108 users obtained by randomly pairing the ﬁrst 108 users in the MSU-
DBI database with the users in the CASIA database. The number of genuine points in
the multimodal Vault is between 72 and 84 and the total number of points in the vault
after adding the chaff points is 884. The third row in Table 5.6 shows the performance
of the multimodal vault. The multimodal vault offers a signiﬁcant improvement in
the GAR compared to the individual modalities and also leads to higher security due

to the larger key size.

180

Table 5.6: Performance of the multimodal (right index ﬁnger and iris) fuzzy vault on
the virtual multimodal database derived from the MSU-DB1 ﬁngerprint and CASIA
iris databases. The Failure to Capture Rate (FTCR), Genuine Accept Rate (GAR)
and False Accept Rate (FAR) are expressed as percentage and the key size is expressed
in bits.

 

 

 

 

 

 

 

 

 

 

. FAR = 0.02 FAR = 0
Scenario FTCR GAR Vault Key GAR Vault Key

Size Size

Iris 0 88 160 88 176

Right Index Finger 5.6 82.5 176 78.8 192

Right Index Finger 0 98.2 208 98.2 224
+ Iris (Union of the
two unlocking sets)

 

 

 

5.7 Security Analysis

Dodis et a1. [55] deﬁned the security of biometric cryptosystems in terms of the min-

entropy of the helper data. Min-entropy of a random variable A is deﬁned as

HOO(A) = — log (maxaP(A = a)). (5.5)

Note that all the logarithms in this section are of base 2. Suppose the security of a
system relies on the difﬁculty in guessing A. The best strategy for an adversary to
circumvent this system is to start with the most likely value of A and the min-entropy
measures the security of the system in this scenario. Now consider a pair of random

variables A and B. Dodis et a1. [55] deﬁned the min-entropy of A given B as,

HOO(A|B) = — log (maxaP(A = aIB = b)) (5.6)

and the average min-entropy of A given B as

181

Hod/113) = — log (EbHB [TnaxaP(/l = aIB = on) = — log (Eb,_B [2*HooMlBlj).
(5.7)
We can analyze the security of the fuzzy vault framework by measuring the average

min-entropy of the biometric template given the vault V.

5.7.1 Fingerprint-based Vault

Recall that the ﬁngerprint-based vault V = {(ai,bi)}$=1 is an unordered set of t
points consisting of 7‘ points that lie on a polynomial ’P deﬁned by the vault key K
and s chaff points that do not lie on ’P. Alternatively, if X and Y are the sets of

genuine and chaff points, respectively, then az- E X or Y, Vi = 1, 2, - -- ,t. The vault

n+1
j=1’

can be decoded only if we can ﬁnd a candidate set L” = {(a .,bj)} which is a
subset of V such that a j E X, V(aj, bj) E L”, where n is the degree of the polynomial
’P. If no other additional information is available, an adversary would have to decode
the polynomial by randomly selecting subsets of (n + 1) points from V and we refer
to this case a brute-force attack.

Suppose that the adversary has knowledge of the ﬁngerprint minutiae distri-
bution model [215] and selects the candidate set L” based on this model. Let
L* = {(aj,bj)};l:11 be the candidate set that is most likely to be selected based
on the minutiae distribution model. Let p,- be deﬁned as the probability that a, cor-
responds to a genuine minutiae point, i.e., Pi = P(ai E X), for i = 1,2,--- ,t and

ZE=1Pi = 1. If we know the distribution of location and orientation of minutiae in

182

a ﬁngerprint, we can estimate p,- for all the points in a given ﬁngerprint-based vault

V. Let us reorder the points in V such that p,- 2 1),-+1, Vi = 1, 2, - - - ,t —- 1. If we se-

quentially select points from V to form the candidate set based on the estimated pi’s,

then the probability of selecting the most likely genuine point is p1, the probability

of selectin the second most likel enuine oint is p and so on. Therefore, the
g y g P (11%,?

II
probability that L takes the value L* is given by

(n. + 1)! [[21:11 pi

2;. (1 — Zt=1pk)

Here, the factorial term is included because the candidate sets are unordered and

 

P(L =L)gr1 (5.8)

the (n + 1) most likely elements from V can be arranged in (n + 1)! ways to obtain

L*. Let P* be the polynomial obtained by Lagrange interpolation of points in L*.
II

Since there are (”11) combinations of candidate sets L derived from V that can

decode the vault, the probability that P* is the correct polynomial P is given by

(nilxn +1)!l—l?—:11Pt.

Ila—.1 (1 "' Zie=1pk)

 

P (79* = P) s (5.9)

When P* is equal to P, the vault is decoded and the minutiae template M T is

revealed. Therefore, the min-entropy of M T given V can be computed as

(11:1)(77’ + 1)!1‘[?:11p,-

112:1 (1 — 21:1 Pk)

If both the minutiae location and minutiae orientation are uniformly distributed,

Hoo(MT|V) 2 —log

 

(5.10)

p,- = l/t, Vi = 1,2, - -- ,t. In this case, the min-entropy of MT given V can be

183

simpliﬁed as

(n:1)(n + 1)! 113:1131;
Uf=1 (1 — 21:17”

(nil—1X7" + 1)!th1471'

HOO(MT|V) = —lo

 

 

= —log

 

 

‘0

Iliz=1 (Lt—‘2
_ (nr1)(n + 1)!
‘ ”0" trial It — a)
= —log (”11) (n + 1t)!!(t — n — 1)!)
(riff-1))
= —log —— . (5.11)
((n-l-l)

For example, if the size of the vault key is 160 bits (which corresponds to n = 10 in our
implementation) and the number of genuine and chaff points in the vault are 30 and
300, respectively, under the assumption of uniform distribution of minutiae, the min-
entropy of the ﬁngerprint—based fuzzy vault is approximately 40 bits. Here, 40 bits of
security implies that the expected number of candidate sets that need to be evaluated
is 240 z 2 x 1012. This roughly corresponds to the same level of difﬁculty in guessing
a 24-character ASCII password [18]. While a security of 40 bits may be considered
as inadequate from the cryptographic point of view (where the key sizes are typically
greater than 128 bits), it must be noted that the fuzzy vault framework eliminates

the key management problem, which is a major issue in practical cryptosystems.

The min-entropy under the uniform assumption also corresponds to the complexity
of the brute force attack. Clancy et a1. [42] prOposed a ﬁngerprint-based fuzzy vault

184

implementation where the complexity of brute force attack was estimated to be 69
bits. The complexity of brute force attack in our implementation is signiﬁcantly
lower compared to that of Clancy et al. [42] due to the two main reasons. Firstly,
recall that we employ CRC-based error detection instead of Reed-Solomon polynomial
reconstruction used in [42]. While CRC-based error detection improves the genuine
accept rate signiﬁcantly, only (12+ 1) genuine points need to be identiﬁed for successful
decoding. On the other hand, more than £52) genuine points need to be identiﬁed for
successfully decoding the vault in [42], which makes it more difﬁcult for an adversary
to decode the vault by a brute force attack. Secondly, in the implementation proposed
by Clancy et al. [42], chaff points are continuously added until it becomes impossible
to add any more chaff points without violating the minimum distance constraint.
In our implementation, we restrict the number of chaff points to approximately 10
times the number of genuine points. While adding more chaff points may increase
the security of the system, it also increases the memory required to store the vault.
Moreover, Chang et al. [24] show that as the number of chaff points is increased,
the amount of free area available for adding new chaff points decreases because of
the minimum distance constraint. As a result, it may be easier for an adversary to
identify some of the chaff points in the vault [24], thereby limiting the security.
Given a database of ﬁngerprints, one can also compute the average min-entropy
of the proposed vault implementation as follows. We estimate the distribution of
minutiae location and minutiae orientation using the mixture models proposed by
Zhu et al. [215]. Based on these estimated distributions, we can compute the min-
entropy for each vault and thereby the average min-entropy for that database using

185

equations (5.10) and (5.7), respectively. For the MSU-DBI database, the average
min-entropy when 7‘ is between 24 and 36, n = 10 and t = 336 is approximately 27
bits. This large entropy loss (from a: 40 bits in the brute force case to z 27 bits)
is mainly because in our implementation, we assume that the spatial distribution of
minutiae in a ﬁngerprint image is uniform and use this property in the generation
of chaff points. Due to this assumption, the chaff points in our implementation
do not follow the true minutiae distribution, which was shown by Zhu et al. [215]
to follow a mixture model. For instance, the minutiae tend to mostly fall around
the center of the ﬁngerprint image. However, the chaff points can fall anywhere in
the ﬁngerprint image including regions close to the image boundaries (see Figure
5.12(c)). Thus, it is easier to separate the chaff points from the genuine points in
our implementation. One way to improve the security of our vault implementation is
to estimate the statistical distribution of minutiae during vault encoding and use the

estimated minutiae distribution for the generation of chaff points.

Our automatic ﬁngerprint vault implementation is based on the assumption that
high curvature points do not reveal any information about the minutiae and it is
not possible to estimate the orientation ﬁeld using only the high curvature points.
However, suppose a smart attacker is able to extract the orientation ﬁeld from the high
curvature points and uses it to identify the chaff points. We can still defend against
such an attack by introducing some additional chaff points that are consistent with
the orientation ﬁeld (i.e., the location of such a chaff point is random, but its direction
is determined by the orientation ﬁeld) to the set of completely random chaff points.

186

5.7 .2 Iris Cryptosystem

In the proposed iris cryptosystem, the helper data consists of two components, namely,
the transformed iriscode template 1* and the vault V that secures the transformation
key K1 used to obtain 1*. Since the transformation key K1 is independent of the
template iriscode, it can be generated from a uniform distribution. Therefore, the
min-entropy of K1 given V (Hoo(K1[V)) can be computed using equation (5.11). In
our implementation of the vault for the iris modality, r = 48, n = 10 and t = 548.

Hence, HOO(K1|V) is approximately 40 bits.

Since we use a single exclusive—OR operation to obtain 1*, the min-entropy of
template iriscode 1T given 1* (Hoo(1T|1*)) depends only on the redundancy added
to the key K1 by the BCH encoder. Hao et al. [76] have estimated that in the worst
case of an adversary having perfect knowledge of the correlation between the iriscode
bits, the inherent uncertainty in a iriscode template is approximately 249 bits. They
also showed that if a coding scheme can correct up to 112 bits in the iriscode template,
the entropy of the iriscode template given the transformed template is approximately
log (2249/ (239)) bits. In our implementation, the BCH coding scheme can correct
up to 25% of the errors, which corresponds to approximately 10 = 62 bits (out of 249).
Therefore, entropy of the IT given 1* (HOO(IT]1*)) is approximately 52 bits. The
overall security of the iris cryptosystem is given by min(Hoo(K1|V),Hoo(1T[1*)) z

min(40, 52) z 40 bits.

It must be emphasized that while the inherent entropy of an iriscode template is
approximately 249 bits, a system that stores the iriscode template in plaintext form

187

is secure only when the adversary does not know the template. Once the template
is gleaned by the adversary, the system effectively offers no security. However, even
when the helper data extracted from the iriscode template is known to the adversary,
the proposed iris cryptosystem provides a security of approximately 40 bits. The
security of a comparable key-binding cryptosystem proposed by Hao et al. [76] is

approximately 44 bits.

5.7 .3 Multimodal Vault

In the case of the multimodal vault, both the minutiae template M T and the transfor-
mation key K1 used in the iris cryptosystem are secured using a single vault V. There-
fore, decoding the vault reveals both the M T and K1 (and consequently 1T). Hence,
the overall security of the system is given by min (HOO(MT, KllV), HOO(IT|1*)). In
the multimodal vault, t = 884, n = 13, and the number of genuine points, 7', is 84 (36
from the ﬁngerprint modality and 48 from the iris modality). If we assume that the
minutiae are uniformly distributed, Hoo(MT, K1 IV) is approximately 49 bits. Hence,

the overall security of the multimodal vault is approximately min(49, 52) = 49 bits.

On the other hand, suppose that we construct two separate vaults VF and V1 for
the ﬁngerprint and iris modalities, respectively. In this scenario, the overall security
of the system is given by min (log (2H°°(MT’IVF) + 2H°°(K1’|V1)) , HOO(ITII*)),
which is approximately 41 bits for the same number of chaff points (300 for ﬁngerprint
and 500 for iris). Thus, the multimodal vault provides a signiﬁcantly higher security

compared to storing the individual templates using separate vaults.

188

Table 5.7: Security of the proposed fuzzy vault implementations. Here, the security
is measured in terms of HOO(T|V), which represents the average min-entropy of the
biometric template T given the vault V. The parameters t, r and n represent the
total number of points in the vault (genuine and chaff), number of genuine points in
the vault and the degree of the polynomial used in the vault, respectively.

 

 

 

 

 

Modality Assumptions Parameters Security
(bits)
t r n
. . Uniform distribution of 330 30 10 40
Fingerprint . .
minutiae
Distribution of minutiae 336 24-26 10 27
follows mixture model [215]
Iris Iriscode has inherent 548 48 10 40

entropy of 249 bits [76];
BCH code corrects up to
25% of the errors
Fingerprint + Uniform distribution of 884 84 13 49

Iris minutiae; iriscode has
inherent entropy of 249
bits [76]; BCH code corrects
up to 25% of the errors

 

 

 

 

 

 

 

 

 

189

The security of the proposed vault implementations is summarized in Table 5.7.
Apart from the attacks that depend on separating the genuine and chaff points in the
vault, there are other speciﬁc attacks that can be staged against a fuzzy vault, e.g.,
attacks via record multiplicity, stolen key inversion attack and blended substitution
attack [175]. If an adversary has access to two different vaults (say from two different
applications) obtained from the same biometric data, he can easily identify the gen-
uine points in the two vaults and decode the vault [106]. Thus, the fuzzy vault scheme
does not provide revocability. An advantage of the fuzzy vault (key binding) scheme
is that instead of providing a “Match/Non-match” decision, the vault decoding out-
puts a key that is embedded in the vault. This key can be used in a variety of ways to
authenticate a person (e.g., digital signature, document encryption/ decryption etc.),
In a stolen key inversion attack, if an adversary somehow recovers the key embed-
ded in the vault, he can decode the vault to obtain the biometric template. Since
the vault contains a large number of chaff points, it is possible for an adversary to
substitute a few points in the vault using his own biometric features. This allows
both the genuine user and the adversary to be successfully authenticated using the
same identity, and such an attack is known as blended substitution. To counter these
attacks, Nandakumar et al. [145] proposed a hybrid approach where (i) biometric
features are ﬁrst “salted” based on a user password, (ii) the vault is constructed us-
ing the salted template and (iii) the vault is encrypted using a key derived from the
password. While salting prevents attacks via record multiplicity and provides revo-

190

cability, encryption provides resistance against blended substitution and stolen key
inversion attacks. Moreover, the distribution of biometric features after salting can
be expected to be more similar to the uniform distribution than the original feature

distribution, which improves the security of the vault.

5.8 Summary

Biometric systems are being widely used to achieve reliable user authentication and
these systems will proliferate into the core information infrastructure of the (near) fu-
ture. When this happens, it is crucial to ensure that biometric authentication will be
secure. Fuzzy vault is one of the most comprehensive mechanisms for secure biometric
authentication. We have implemented a fully automatic and practical multibiometric
fuzzy vault system that can easily secure multiple biometric templates of a user such
as ﬁngerprint minutiae and iriscodes as a single entity. The main challenge in the im-
plementation of a ﬁngerprint-based fuzzy vault is the alignment of the query with the
transformed template stored in the vault. We use high curvature points derived from
the orientation ﬁeld to align the template and query minutiae sets without leaking
any information about the minutiae. We have also developed an iris cryptosystem
that uses both salting and fuzzy vault frameworks to secure the iriscode template.
Finally, we have demonstrated that templates from multiple biometric sources such
as two impressions from the same ﬁnger, left and right index ﬁngers and different
modalities like ﬁngerprint and iris can be secured using a multibiometric vault. Our
experimental evaluation indicates that a multibiometric vault provides both higher

191

genuine accept rate and higher security.

192

Chapter 6

Conclusions and Future Research

6. 1 Conclusions

The design of a multibiometric system is a challenging task due to heterogeneity of the
biometric sources in terms of their type of information, the magnitude of information
content, correlation among the different sources and conﬂicting performance require
ments of the practical applications. In this thesis, we have developed a comprehensive
statistical framework for score fusion in multibiometric systems and a framework for
multibiometric template security.

First, we developed a principled approach for score level fusion in a multibiomet-
ric veriﬁcation system that employs the likelihood ratio test. The likelihood ratio
based approach provides optimal fusion performance when the match score densi-
ties are estimated accurately. We investigated two different techniques for density
estimation, namely, a non-parametric approach based on kernel density estimation
(KDE) and a semi-parametric approach based on ﬁnite Gaussian mixture models

193

(GMM). Both these techniques are quite effective in modeling the genuine and im-
postor score densities and achieve consistently high recognition rates across three
different multibiometric databases without the need for any parameter tuning. But,
we believe that the GMM-based approach is simpler to implement than KDE. We
also observed that modeling the correlation between the matchers did not lead to
any signiﬁcant improvement in the recognition performance. Therefore, assuming
independence between matchers and estimating the joint density as a product of the
marginal densities may be appropriate in scenarios where the individual matchers are
quite accurate (less than 5% equal error rate) and the difference between genuine and
impostor correlations is low.

Further, we have demonstrated that the likelihood ratio based fusion scheme can
easily take into account ancillary information such as biometric image quality to im-
prove the recognition performance. Pairwise quality indices that estimate the quality
of the template and the query images as a single value were developed for the ﬁnger-
print and iris modalities. We have also shown that the marginal likelihood ratios of
the individual matchers can be used as inputs to a binary decision tree classiﬁer to
design a sequential multibiometric system.

When the match scores of individual users are assumed to be independent and
identically distributed, the genuine and impostor densities estimated in the veriﬁca-
tion scenario can also be used for likelihood ratio based fusion in the multibiometric
identiﬁcation scenario. Moreover, we have shown that the likelihood ratios computed
based on the match scores can be combined with the rank-based posterior proba-
bilities and the hybrid rank and score level fusion scheme achieves high recognition

194

performance in multibiometric identiﬁcation systems.

To address the problem of template security in a multibiometric system, we have
developed a framework for securing multiple biometric templates of a user in the
multibiometric system as a single entity. This is achieved by generating a single
multibiometric template from different biometric sources using feature level fusion
and securing the multibiometric template using the fuzzy vault construct. We have
also implemented the fuzzy vault system for securing the ﬁngerprint minutiae and
iriscode templates individually. The problem of alignment in the ﬁngerprint-based
fuzzy vault is handled by storing high curvature points extracted from the orientation
ﬁeld as additional helper data. A salting transformation based on a transformation
key was used to indirectly convert the ﬁxedclength binary vector representation of
iriscode into an unordered set representation that can be secured using the fuzzy
vault. Finally, we have shown that the multibiometric vault can secure templates from
different biometric sources such as multiple ﬁngerprint impressions, multiple ﬁngers
and multiple modalities such as ﬁngerprint and iris. We have also demonstrated
that the multibiometric vault provides better recognition performance and security

compared to the individual vaults.

6.2 Future Research Directions

While we have made signiﬁcant progress in the development of fusion strategies and
template protection schemes that facilitate the design of reliable and secure multibio-
metric systems, we believe that the techniques proposed in this thesis can be further

195

expanded and reﬁned in the following ways.

0 The fusion strategies proposed in this thesis can be considered as global tech-
niques in the sense that no user—speciﬁc information is used in developing these
schemes. This is implicitly based on the assumption that the discriminatory
information provided by the individual biometric sources is identical across
all users. However, it is well-known that there are inherent differences in
the “recognizability” of the different users [54] and user-speciﬁc fusion tech-
niques can further improve the recognition performance of the multibiometric
system [63,96,190]. User-speciﬁc fusion can be achieved within the likelihood
ratio framework by learning user-speciﬁc match score densities when sufﬁcient

training data is available for each user.

a Our experimental results indicate that modeling the correlation between the
match scores of the different matchers does not result in any signiﬁcant im-
provement in the fusion performance. A theoretical model that establishes the
effect of match score correlation on fusion performance is needed to validate

this observation.

0 The density estimation techniques used in this thesis operate in the batch mode
where the genuine and impostor score densities are estimated only once during
the system design phase based on the complete training data. When there
is a signiﬁcant change in the matcher characteristics, the density estimation
process needs to be repeated again starting from scratch with new training
data. Moreover, in practical multibiometric systems, additional training data

196

may become available during the Operation of the system. Therefore, it may
be beneﬁcial to use incremental GMM learning algorithms [216] or Bayesian
adaptation [163] schemes that can update the score densities when additional

training data becomes available without the need for re—training.

Apart from the location and orientation attributes of a minutia point, many
minutiae-based ﬁngerprint matchers use additional attributes like minutia type,
ridge counts, ridge curvature, ridge density and local texture features [61] to
achieve high recognition rates. These attributes could also be incorporated into
the ﬁngerprint-based fuzzy vault framework. Addition of new attributes will
not only increase the number of possible chaff points that can be added to the
vault but also decrease the decoding complexity for genuine users and reduce the
false accept rate. The integration of other common biometric modalities such
as face and voice in the multibiometric vault framework also requires further

investigation.

A well-known limitation of the fuzzy vault framework is its dependence on chaff
points to achieve security. Therefore, other biometric cryptosystems that do not

involve chaff points could be considered for securing the biometric templates.

Finally, a formal model for cost-beneﬁt analysis of a multibiometric system
based on parameters such as performance gain (reduction in F RR/ FAR),
throughput, physical cost of the system and security needs to be developed in
order to enable biometric system developers to rapidly design a multibiometric
system that is most appropriate for the application on hand.

197

APPENDICES

198

A Databases

A.1 Multibiometric Databases

We use two public-domain match score databases, namely, NIST-BSSRl and
XM2VTS-Benchmark databases to benchmark the various fusion strategies consid-
ered in this thesis. The performance of the quality-based product fusion rule was
evaluated only on the WVU-Multimodal database since the other databases do not
contain raw ﬁngerprint and iris images to enable us to estimate the biometric sample
quality. The performance of the proposed fusion rules was also evaluated on the in-
house MSU-Multimodal database and the results of the evaluation on this database
has been reported in [48]. Table 1 presents a summary of the multibiometric databases

used in this thesis.

NIST-BSSRl

The NIST Biometric Scores Set - Release I (N IST-BSSRl) [151] has three partitions.
The ﬁrst partition is the N IST-Multimodal database, which consists of 517 users with
two ﬁngerprint and two face scores. One ﬁngerprint score was obtained by comparing
a pair of impressions of the left index ﬁnger, and the second score was obtained by
comparing impressions of the right index ﬁnger. Two different face matchers were
applied to compute the similarity between frontal face images. The NIST-Multimodal
database is a “true” multimodal database in the sense that the ﬁngerprint and face
images used for computing the genuine match scores were derived from the same
individual. The second partition of NIST-BSSRI is the NIST-Fingerprint database,

199

which is an example of multi-instance(ﬁnger) biometric system. This partition con-
sists of scores from left and right index ﬁngerprint matches of 6, 000 individuals. The
third partition is the NIST-Face database, which consists of scores from two face

matchers applied on three frontal face images from 3, 000 individuals.

XM2VTS-Benchmark

The XM2VTS-Benchmark database [154] consists of ﬁve face matchers and three
speech matchers and was partitioned into training, fusion development and fusion

evaluation sets according to the Lausanne Protocol-1 (see [154] for details).

WVU-Multimodal

The West Virginia University multimodal database (WVU-Multimodal) consists of
320 virtual subjects (subjects created by randomly pairing a user from one unimodal
database (e.g., iris) with a user from another database (e.g., ﬁngerprint)) with ﬁve
samples each of ﬁngerprint and iris modalities. Minutiae-based ﬁngerprint matcher

[93] and Iriscode [50] based iris matcher were used for computing the match scores.

MSU-Multimodal

The MSU-Multimodal database [90] consists of 100 virtual subjects, each providing
ﬁve samples of face, ﬁngerprint (left-index) and hand-geometry modalities. Face im-
ages were represented as eigenfaces [193] and the Euclidean distance between the
eigen-coefﬁcients of the template—query pair was used as the distance metric. Minutia
points were extracted from ﬁngerprint images and the elastic string matching tech-

200

nique [86] was used for computing the similarity between two minutia point patterns.
Fourteen features describing the geometry of the hand shape [98] were extracted from

the hand images and Euclidean distance was computed for each template-query pair.

A.2 Fingerprint Databases

The performance of the ﬁngerprint-based fuzzy vault implementation has been eval-
uated on FVC2002—DB2 [128] and MSU-DBI [94] ﬁngerprint databases, which are

summarized in Table 2.

MSU-DBI

The MSU-DB1 database contains two pairs of impressions for each of the 160 users
and these two pairs were collected six weeks apart. Further, images from four different
ﬁngers (two index and two middle ﬁngers) are available for each user. Hence, this
database is suitable to study the multiple ﬁnger and multiple impression scenarios
in the fuzzy vault implementation. We use only the impressions from right and left

index ﬁngers in our experiments.

FVC2002-DB2

FVC2002—DB2 was one of the benchmark databases used in the Fingerprint Veri-
ﬁcation Competition 2002 [128]. The FVC2002-DB2 consists of 100 ﬁngers with 8
impressions per ﬁnger obtained using an optical ﬁngerprint sensor. This database
was selected because it is a public-domain database and the images are of relatively
good quality. Among the 8 impressions available for each ﬁnger in F VC2002-DB2,

201

Table 1: Summary of multibiometric databases. Note that the NIST-Multimodal,
NIST-Fingerprint and NIST-Face databases are different partitions of the NIST Bio—
metric Score Set Release-1.

 

 

 

 

 

 

 

 

Database Biometric Traits No. of No. of
matchers users
NIST-Multimodal Fmgerprm‘ (TWO ﬁngers) 4 517
Face (Two matchers)
NIST-Fingerprint Fingerprint (Two ﬁngers) 2 6,000
NIST-Face Face (Two matchers) 2 3,000
Face (Five matchers)

XM2VTS-Benchmark Speech (Three matchers) 8 295
WVU-Multimodal Fingerprint, Iris 2 320
MSU-Multimodal Fmgerprmt’ Face 3 100

and Hand-geometry

 

 

 

 

 

we use only four impressions (impressions 1, 2, 7 and 8) in our experiments due to
the following reason. It is quite reasonable to assume that users in a biometric cryp—
tosystem are co—operative and they are willing to provide good quality biometric data
in order to retrieve their cryptographic keys. Impressions 3, 4, 5 and 6 in FVC2002
databases were obtained by requesting the users to provide ﬁngerprints with exagger-
ated displacement and rotation. Hence, these impressions are not representative for

the application under consideration. This explains our choice of impressions 1, 2, 7

and 8.

A.3 CASIA Iris Database

The performance of the iris cryptosystem has been evaluated on the CASIA iris image
database ver 1.0 [39,126]. This database consists of images from 108 different eyes

202

Table 2: Summary of ﬁngerprint databases used in the evaluation of fuzzy vault.

 

 

 

 

 

 

 

FVC2002-DB2 MSU-DB1
No. of users 100 160 (4 ﬁngers per user)
No. of 8 4
impressions / ﬁnger
Sensor Biometrika FX2000 Digital Biometrics, Inc.
(Optical) (Optical)
Image size 560 x 296 at 569 dpi 640 x 480 at 500 dpi
resolution resolution
Image quality Good Medium

 

 

 

with 7 images per eye. These 7 samples were collected over two different sessions
with 4 samples in one session and 3 in the other. We use one image from each session
to evaluate the iris cryptosystem. Recently, Phillips et al. [152] pointed out that the
pupil regions in the iris images of this database have been manually edited, which
makes it easier to segment the iris region. Hence, they discouraged the use of this
database in iris recognition studies. However, we still use the CASIA v1 database in
our experiments because our goal is not to develop reliable segmentation or feature
extraction algorithms. Rather, the main focus of our work is to develop techniques

for securing the given iriscode templates in best possible manner.

B Algorithms

B.1 Determining Discrete Components in a Score Distribu-
tion

Inputs: 3 - Set of match scores, a - Level of signiﬁcance of chi-squared test, B -

Number of bins, 1W - Number of folds for cross-validation.

203

 

Output: T - Threshold to determine discrete components.

1. Initialize T +— 1.

2. Determine the collection C of continuous components as follows:

CE{soz-Ii%/@<T}, (1)

where N (30) is the number of observations in S that equals 30 and N is the
total number of observations in S. The set C is further divided into M equal
and non-overlapping subsets among which one subset is labeled as CV while the
remaining M — 1 subsets are combined to form the set CT. The set CT is used

for density estimation and CV is used for validating the estimated density.

3. Based on the data in set CT, obtain the kernel density estimate of fC(s), fC(s),
using equation (3.4). The corresponding distribution function F‘C(s) is obtained

as follows.

FC(s) = /_:O fC(u)du. (2)

4. Use the chi-squared goodness-of-ﬁt test to test the following hypothesis. The
null hypothesis is H0: F003) is the true distribution of data in CV and the al-
ternative hypothesis is Ha: FC(s) is not the true distribution. The test statistic

is given by

B _ 2
X2 = Z _(ObTbEbL, (3)
b=1

204

where Ob is the observed frequency for bin b and Eb is the expected frequency
for bin b. The bth bin edge is chosen to be [BC—1 (9131) ,13‘51 (%)). Due to
this particular choice of bin edges, it follows that Eb = NV / B, where NV is

the number of observations in CV.

. Repeat steps 3 and 4 M times; each time a different subset of C is chosen as
CV while the remaining subsets form CT. The average test statistic xgvg is

computed.

. Let Xfa,B—d—1) be the value such that a fraction or of the area under the x2
distribution with B — d — 1 degrees of freedom lies to the right of Xfaﬂ—d—l)’
where d is the number of estimated parameters. Since we estimate only the
bandwidth of the kernel from the data, we set the value of d to 1. If xgvg >
Xfa,B—d—1)’ we reject the null hypothesis, set T «— argmaxSOEcN(so)/N and

return to step 2. Else, we output the value of T.

205

 

B.2 J uels—Sudan Vault Encoding

Public Parameters: A ﬁeld .7:
Input: Parameters n, r and s such that 0 < n < 1' << .9; a secret K; a set
X = {xi}i=1 representing the user’s biometric template such that
xi Efandxi 761:]— Viaéj, i,j=1,2,--- ,r
Output° A vault V = {(a- b ) }t where t = r + 3
° 3’ .7 j=1,
P +— ENCODESECRET(K)
L, C, Y +— (b
for j = 1 to 7' do
(aj,bj) <— (xj,P(;cJ-))
L 4— L U (aj, bj)
end for '
forj=r+1totdo
yj E .7: — (X U Y)
Y *— Y U y]-
Zj E f — {P(yjl}
(0W) ‘— (as)
C ‘— C U (aj, bj)
end for
V (— L U C I
V t— PERMUTE(V )
Return V

 

206

 

B.3 J uels—Sudan Vault Decoding

Public Parameters: A ﬁeld .7: I I
Input: Parameters n,r and s such that 0 < n < r < s; a set X 2 {xi £=1

I
representing the user’s biometric query such that xi 6 f and

I I . . . . t
3:,- # xj V i 75], 2,] =1,2,--- ,r; a vault V = {(aj,bj)}j:1
Output: A secret K or null

L, 4— ()5
for i,=,l to r do
(ai, b2.) «— null
for j = 1 to t do
if (2:; = aj) then
I I
(ai,bZ-) (- (aj bj)
break
end if
end for; I I
L +— L U(ai,bz-)
end for I
P «— RSDECODE(L )
if (P = null) then
Return null
else
K «— DECODESECRET (P)
Return K
end if

 

207

 

B.4 Alignment using ICP

T
Input: Parameters kmam and Dstop ; Template helper data H T = {hzT}::1;
Query helper data set H Q = {hJiQ};f£1
Output: A transformation F that best aligns H Q with H T
k <— 0
HOQ «— H Q
MWDOld .— 106
k +— k + 1
if (k = 1) then
I
F t—INITTRANS (HT, HQ)
else,
F t—TRANS (HTlQ, HQ)
end if I
HQ .— F (HQ)
HTIQ +— q)
forj=1toRQdo

i = argmin,I DH (121;,h1Q)
z i J

)2ng = h?
HTlQ ._ HTIQ U ,ng
end for Q
1 R TIQ Q

if ((MWDold — M WDnew) < Dstop) then
break
else
M WDold +— M WDnew
end if
end while
F e—TRANs (HTIQ, Hg?)
Return F

 

208

BIBLIOGRAPHY

209

 

[ll
[2]

[3]

l4]

[6]

[7]
[8]

[9]

[10]

Bibliography

Advanced Encryption Standard, November 2001.

A. Adler. Sample images can be independently restored from face recognition
templates. In Proceedings of Canadian Conference on Electrical and Computer
Engineering, volume 2, pages 1163—1166, Montreal, Canada, May 2003.

Andy Adler. Images can be Regenerated from Quantized Biometric Match
Score Data. In Proceedings Canadian Conference on Electrical and Computer
Engineering, pages 469—472, Niagara Falls, Canada, May 2004.

A. Arakala, J. Jeffers, and K. J. Horadam. Fuzzy Extractors for Minutiae-Based
Fingerprint Authentication. In Proceedings of Second International Conference
on Biometrics, pages 760—769, Seoul, South Korea, August 2007.

P. N. Belhumeur, J. P. Hespanha, and D. J. Kriegman. Eigenfaces versus Fish—
erfaces: Recognition Using Class Speciﬁc Linear Projection. IEEE Transactions
on Pattern Analysis and Machine Intelligence, 9(7):711—720, 1997.

S. Ben-Yacoub, Y. Abdeljaoued, and E. Mayoraz. Fusion of Face and Speech
Data for Person Identity Veriﬁcation. IEEE Transactions on Neural Networks,
10(5):1065—1075, September 1999.

E. R. Berlekamp. Algebraic Coding Theory. McGraw Hill, 1968.

P. Besl and N. McKay. A Method for Registration of 3—D Shapes. IEEE Trans-
actions on Pattern Analysis and Machine Intelligence, 14(2):239—256, February
1992.

B. Bhanu and X. Tan. Fingerprint Indexing Based on Novel Features of Minu-
tiae Triplets. IEEE Transactions on Pattern Analysis and Machine Intelligence,
25(5):616—622, May 2003.

E. S. Bigun, J. Bigun, B. Duc, and S. Fischer. Expert Conciliation for Multi-
modal Person Authentication Systems using Bayesian Statistics. In Proceedings
of First International Conference on Audio- and Video-Based Biometric Person
Authentication (A VBPA), pages 291—300, Crans-Montana, Switzerland, March
1997.

210

[11] D. Bleichenbacher and P. Q. Nguyen. Noisy Polynomial Interpolation and Noisy
Chinese Remaindering. In Proceedings of Nineteenth IACR Eurocrypt, pages
53—69, Bruges, Belgium, May 2000.

[12] R. Bolle, J. Connell, S. Pankanti, N. Ratha, and A. Senior. The Relation-
ship Between the ROC Curve and the CMC. In Proceedings of Fourth IEEE

Workshop on Automatic Identiﬁcation Advanced Technologies (AutoID), pages
15-20, Buffalo, USA, October 2005.

[13] T. E. Boult, W. J. Scheirer, and R. Woodworth. Fingerprint Revocable Bioto—
kens: Accuracy and Security Analysis. In Proceedings of IEEE Computer Soci-

ety Conference on Computer Vision and Pattern Recognition, pages 1—8, June
2007.

[14] X. Boyen, Y. Dodis, J. Katz, R. Ostrovsky, and A. Smith. Secure Remote Au-
thentication Using Biometric Data. In Advances in Cryptology—EUROCRYPT
2005, pages 147—163, Aarhus, Denmark, May 2005.

[15] R. Brunelli and D. F alavigna. Person Identiﬁcation Using Multiple Cues. IEEE
Transactions on Pattern Analysis and Machine Intelligence, 17(10):955—966,
October 1995.

[16] I. R. Buhan, J. M. Doumen, P. H. Harte], and R. N. J. Veldhuis. Fuzzy Ex-
tractors for Continuous Distributions. In Proceedings of ACM Symposium on

Information, Computer and Communications Security, pages 353—355, Singa-
pore, March 2007.

[17] I. R. Buhan, J. M. Doumen, P. H. Harte], and R. N. J. Veldhuis. Secure Ad-hoc
Pairing with Biometrics: SAfE. In Proceedings of First International Workshop

on Security for Spontaneous Interaction, pages 450—456, Innsbruck, Austria,
September 2007.

[18] W. E. Burr, D. F. Dodson, and W. T. Polk. Information Security: Electronic
Authentication Guideline. Technical Report Special Report 800-63, NIST, April
2006.

[19] E. Camlikaya, A. Kholmatov, and B. Yanikoglu. Multimodal Biometric Tem-
plates Using Fingerprint and Voice. In Proceedings of SPIE Conference on

Biometric Technology for Human Identiﬁcation V (To appear), Orlando, USA,
March 2008.

[20] W. M. Campbell, D. A. Reynolds, and J. P. Campbell. Fusing Discriminative
and Generative Methods for Speaker Recognition: Experiments on Switchboard
and NFI/TNO Field Data. In Odyssey: The Speaker and Language Recognition
Workshop, pages 41-44, Toledo, Spain, May 2004.

[21] R. Cappelli, A. Lumini, D. Maio, and D. Maltoni. Fingerprint Image Recon-
struction From Standard Templates. IEEE Transactions on Pattern Analysis
and Machine Intelligence, 29(9):1489—1503, 2007.

211

[2‘2]

[23]

[24]

[25]

[26]

[27]

[28]

[29]

[30]

[31]

[32]

A. Cavoukian and A. Stoianov. Biometric Encryption: A Positive-Sum Tech-
nology that Achieves Strong Authentication, Security and Privacy. Technical
report, Ofﬁce of the Information and Privacy Commissioner of Ontario, March
2007.

E. C. Chang and S. Roy. Robust Extraction of Secret Bits From Minutiae. In
Proceedings of Second International Conference on Biometrics, pages 750-759,
Seoul, South Korea, August 2007.

E.-C. Chang, R. Shen, and F. W. Teo. Finding the Original Point Set Hidden
Among Chaff. In Proceedings of ACM Symposium on Information, Computer
and Communications Security, pages 182—188, Taipei, Taiwan, 2006.

K. Chang, K. W. Bowyer, S. Sarkar, and B. Victor. Comparison and Combina-
tion of Bar and Face Images in Appearance-based Biometrics. IEEE Transac-
tions on Pattern Analysis and Machine Intelligence, 25(9):1160—1165, Septem-
ber 2003.

K. I. Chang, K. W. Bowyer, and P. J. Flynn. An Evaluation of Multimodal
2D+3D Face Biometrics. IEEE Transactions on Pattern Analysis and Machine
Intelligence, 27(4):619—624, April 2005.

K. I. Chang, K. W. Bowyer, P. J. Flynn, and X. Chen. Multibiometrics Using
Facial Appearance, Shape and Temperature. In Sixth IEEE International Con-

ference on Automatic Face and Gesture Recognition, pages 43—48, Seoul, Korea,
May 2004.

Y.-J. Chang, W. Zhang, and T. Chen. Biometrics Based Cryptographic Key
Generation. In Proceedings of IEEE Conference on Multimedia and Ezpo, vol-
ume 3, pages 2203—2206, Taipei, Taiwan, June 2004.

O. Chapelle and V. Vapnik. Model Selection for Support Vector Machines In
Advances in Neural Information Processing Systems 12 (NIPS), pages 230—236,
Colorado, USA, November-December 1999.

K. Chen, L. Wang, and H. Chi. Methods of Combining Multiple Classiﬁers with
Different Features and their Applications to Text-Independent Speaker Identiﬁ-

cation. International Journal of Pattern Recognition and Artiﬁcial Intelligence,
11(3):417—445, 1997.

X. Chen, P. J. Flynn, and K. W. Bowyer. IR and Visible Light Face Recognition.
Computer Vision and Image Understanding, 99(3):332—358, September 2005.

Y. Chen, S. C. Dass, and A. K. Jain. Fingerprint Quality Indices for Predicting
Authentication Performance. In Proceedings of Fifth International Conference
on Audio- and Video-Based Biometric Person Authentication, pages 160—170,
Rye Brook, USA, July 2005.

212

[33]

[34]

[35]

[36]

[37]

[38]

[391

[40]

[41]

[42]

[43]

[44]

Y. Chen, S. C. Dass, and A. K. Jain. Localized Iris Image Quality Using 2-
D Wavelets. In IAPR International Conference on Biometrics (ICB), pages
373—381, Hong Kong, China, January 2006.

U. Cherubini, E. Luciano, and W. Vecchiato. Copula Methods in Finance.
Wiley, 2004.

D. Chetverikov, D. Svirko, D. Stepanov, and P. Krsek. The Trimmed Iterative
Closest Point Algorithm. In Proceedings of International Conference on Pattern
Recognition, pages 545-548, Quebec City, Canada, August 2002.

M. Cheung, K. Yiu, M. Mak, and S. Kung. Multi-Sample Fusion with Con—
strained Feature Transformation for Robust Speaker Veriﬁcation. In Eighth

International Conference on Spoken Language Processing (ICSLP), pages 1813—
1816, Jeju Island, Korea, October 2004.

C. C. Chibelushi, J. S. D. Mason, and F. Deravi. Feature-level Data Fusion for
Bimodal Person Recognition. In Proceedings of the Sixth International Con-

ference on Image Processing and Its Applications, volume 1, pages 399—403,
Dublin, Ireland, July 1997.

C. S. Chin, A. B. J Teoh, and D. C. L. Ngo. High Security Iris Veriﬁcation
System Based On Random Secret Integration. Computer Vision and Image
Understanding, 102(2):169~177, May 2006.

Chinese Academy of Sciences. Speciﬁcation of CASIA Iris Image Database (ver
1.0). http: //www.n1pr . ia. ac. cn/english/irds/irisdatabase.htm, March
2007.

K. Choi, H. Choi, and J. Kim. Fingerprint Mosaicking by Rolling and Sliding.
In Proceedings of Fifth InternationalConference on Audio- and Video-Based
Biometric Person Authentication (AVBPA), pages 260—269, Rye Brook, USA,
July 2005.

Y. Chung, D. Moon, S. Lee, S. Jung, T. Kim, and D. Ahn. Automatic Align-
ment of Fingerprint Features for Fuzzy Fingerprint Vault. In Proceedings of

Conference on Information Security and Cryptology, pages 358-369, Beijing,
China, December 2005.

T. Clancy, D. Lin, and N. Kiyavash. Secure Smartcard-Based Fingerprint Au-
thentication. In Proceedings of ACM SI GMM Workshop on Biometric Methods
and Applications, pages 45—52, Berkley, USA, November 2003.

T. Connie, A. B. J Teoh, M. Goh, and D. C. L. Ngo. PalmHashing: A Novel
Approach for Cancelable Biometrics. Information Processing Letters, January
2005.

IBM Corporation. The Consideration of Data Security in a Computer Environ-
ment. Technical Report G520-2169, IBM, White Plains, USA, 1970.

213

[45]

[46]

[47]

[48]

[49]

[50]

[51]

[52]

[53]

[54]

[55]

[56]

J. Czyz, J. Kittler, and L. Vandendorpe. Multiple Classiﬁer Combination for
Face-based Identity Veriﬁcation. Pattern Recognition, 37(7):1459—1469, July
2004.

S. C. Dass. Markov Random Field Models for Directional Field and Singularity
Extraction in Fingerprint Images. IEEE Transactions on Image Processing,
13(10):1358—1367, October 2004.

S. C. Dass and A. K. Jain. Fingerprint Classiﬁcation Using Orientation Field
Flow Curves. In Proceedings of Indian Conference on Computer Vision, Graph-
ics and Image Processing, pages 650—655, Kolkata, India, December 2004.

S. C. Dass, K. Nandakumar, and A. K. Jain. A Principled Approach to Score
Level Fusion in Multimodal Biometric Systems. In Proceedings of Fifth Interna-

tional Conference on Audio- and Video-based Biometric Person Authentication
(AVBPA), pages 1049—1058, Rye Brook, USA, July 2005.

J. Daugman. Combining Multiple Biometrics. Available at http://www. c1.
cam. ac . uk/users/ j gd1000/ combine/ combine .html, 2000.

J. Daugman. How Iris Recognition Works? IEEE Transactions on Circuits and
Systems for Video Technology, 14(1):21—30, 2004.

G. I. Davida, Y. Frankel, and B. J. Matt. On Enabling Secure Applications
Through Off-Line Biometric Identiﬁcation. In Proceedings of IEEE Symposium
on Security and Privacy, pages 148—157, Oakland, USA, May 1998.

J. De Boer, A. M. Bazen, and S. H. Gerez. Indexing Fingerprint Databases
Based on Multiple Features. In Proceedings of Workshop on Circuits, Systems
and Signal Processing ( ProRIS C 2001), pages 300—306, Veldhoven, Netherlands,
November 2001.

P. A. Devijver and J. Kittler. Pattern Recognition: A Statistical Approach.
Prentice Hall, 1982.

G. Doddington, W. Liggett, A. Martin, M. Przybocki, and D. Reynolds. Sheep,
Goats, Lambs and Wolves: A Statistical Analysis of Speaker Performance in the
NIST 1998 Speaker Recognition Evaluation. In Proceedings of the Fifth Interna-
tional Conference on Spoken Language Processing (ICSLP), Sydney, Australia,
November / December 1998.

Y. Dodis, R. Ostrovsky, L. Reyzin, and A. Smith. Fuzzy Extractors: How to
Generate Strong Keys from Biometrics and Other Noisy Data. Technical Report
235, Cryptology ePrint Archive, February 2006. A preliminary version of this
work appeared in EUROCRYPT 2004.

S. C. Draper, A. Khisti, E. Martinian, A. Vetro, and J. S. Yedidia. Using
Distributed Source Coding to Secure Fingerprint Biometrics. In Proceedings

214

[57]

[58]

[59]

[60]

[61]

[62]

[53]

[64]

[65]

[66]

[67]

of IEEE International Conference on Acoustics, Speech, and Signal Processing
(ICASSP), volume 2, pages 129—132, Hawaii, USA, April 2007.

R. O. Duda, P. E. Hart, and D. G. Stork. Pattern Classiﬁcation. John Wiley
& Sons, 2001.

A. Eriksson and P. Wretling. How Flexible is the Human Voice? A Case Study
of Mimicry. In Proceedings of the European Conference on Speech Technology,
pages 1043—1046, Rhodes, Greece, September 1997.

Y. Fang, T. Tan, and Y. Wang. Fusion of Global and Local Features for
Face Veriﬁcation. In Sixteenth International Conference on Pattern Recogni-

tion (I CPR ), volume 2, pages 382—385, Quebec City, Canada, August 2002.

G. Feng, K. Dong, D. Hu, and D. Zhang. When Faces are Combined with Palm-
prints: A Novel Biometric Fusion Strateg. In First International Conference
on Biometric Authentication (ICBA), pages 701—707, Hong Kong, China, July
2004.

J. Feng. Combining Minutiae Descriptors for Fingerprint Matching. Pattern
Recognition, 41(1):342—352, January 2008.

Y. C. Feng and P. C. Yuen. Protecting Face Biometric Data on Smartcard with
Reed-Solomon Code. In Proceedings of C VPR Workshop on Privacy Research
In Vision, page 29, New York, USA, June 2006.

J. Fierrez-Aguilar, D. Garcia-Romero, J. Ortega-Garcia, and J. Gonzalez-
Rodriguez. Bayesian Adaptation for User-Dependent Multimodal Biometric
Authentication. Pattern Recognition, 38(8):1317—1319, August 2005.

J. Fierrez-Aguilar, L. Nanni, J. Lopez-Penalba, J. Ortega-Garcia, and D. Mal-
toni. An On-line Signature Veriﬁcation System based on Fusion of Local and
Global Information. In Fifth International Conference on Audio- and Video-
based Biometric Person Authentication (AVBPA), pages 523—532, Rye Brook,
USA, July 2005.

J. Fierrez-Aguilar, J. Ortega-Garcia, J. Gonzalez-Rodriguez, and J. Bigun. Dis-
criminative Multimodal Biometric Authentication based on Quality Measures.
Pattern. Recognition, 38(5):777—779, May 2005.

J. Fierrez-Aguilar, J. Ortega-Garcia, J. Gonzalez-Rodriguez, and J. Bigun. Dis-
criminative Multimodal Biometric Authentication based on Quality Measures.
Pattern Recognition, 38(5):777—779, May 2005.

M. Figueiredo and A. K. Jain. Unsupervised Learning of Finite Mixture Models.

IEEE Transactions on Pattern Analysis and Machine Intelligence, 24(3):381—
396, March 2002.

215

[68] M. Freire—Santos, J. Fierrez-Aguilar, and J. Ortega-Garcia. Cryptographic Key
Generation Using Handwritten Signature. In Proceedings of Biometric Tech-
nologies for Human Identiﬁcation, Part of SPIE Defense and Security Sympo-
sium, volume 6202, pages 225—231, Orlando, USA, April 2006.

[69] R. Frischholz and U. Dieckmann. BioID: A Multimodal Biometric Identiﬁcation
System. IEEE Computer, 33(2):64—68, February 2000.

[70] H. Frohlich and A. Zell. Efﬁcient Parameter Selection for Support Vector Ma-
chines in Classiﬁcation and Regression via Model-based Global Optimization.

In Proceedings of IEEE International Joint Conference on Neural Networks
(IJCNN), volume 3, pages 1431—1436, Montreal, Canada, July-August 2005.

[71] M. Fuentes, S. Garcia—Salicetti, and B. Dorizzi. On-line Signature Veriﬁcation:
Fusion of a Hidden Markov Model and a Neural Network via a Support Vec-
tor Machine. In Eighth International Workshop on Frontiers in Handwriting
Recognition, pages 253—258, Ontario, Canada, August 2002.

[72] M. D. Garris, C. 1. Watson, and C. L. Wilson. Matching Performance for the US-
Visit IDEN T System Using Flat Fingerprints. Technical Report 7110, National
Institute of Standards and Technology (NIST), July 2004. NIST Internal Report
7110.

[73] R. S. Germain, A. Califano, and S. Colville. Fingerprint Matching Using Trans-

formation Parameter Clustering. IEEE Computational Science and Engineer-
ing, 4(4):42—49, October 1997.

[7 4] P. Grifﬁn. Optimal Biometric Fusion for Identity Veriﬁcation. Technical Report
RDNJ-03-0064, Identix Corporate Research Center, 2004.

[75] P. Grother and P. J. Phillips. Models of Large Population Recognition Per-
formance. In Proceedings of IEEE Computer Society Conference on Computer
Vision and Pattern Recognition (CVPR), volume 2, pages 68—75, Washington,
DC, USA, June-July 2004.

[76] F. Hao, R. Anderson, and J. Daugman. Combining Crypto with Biometrics
Effectively. IEEE Transactions on Computers, 55(9):1081—1088, September
2006.

[77] K. Harmel and L. Spadanuta. Disney World scans ﬁngerprint details of park vis-
itors. Available at http : //www. boston. com/news/nation/articles/2006/
09/03/disney_wor1d_scans_fingerprint_details_of_park_visitors,
September 2006.

[78] W. R. Harrison. Suspect Documents, their Scientiﬁc Examination. Nelson-Hall
Publishers, 1981.

216

 

[79]

[80]

[81]

T. K. Ho, J. J. Hull, and S. N. Srihari. Decision Combination in Multiple Classi-
ﬁer Systems. IEEE Transactions on Pattern Analysis and Machine Intelligence,
16(1):66—75, January 1994.

L. Hong and A. K. Jain. Integrating Faces and Fingerprints for Personal Iden-
tiﬁcation. IEEE Transactions on Pattern Analysis and Machine Intelligence,
20(12):1295—1307, December 1998.

L. Hong, A. K. Jain, and S. Pankanti. Can Multibiometrics Improve Perfor-
mance? In Proceedings of IEEE Workshop on Automatic Identiﬁcation Ad-
vanced Technologies (AutoID), pages 59—64, New Jersey, USA, October 1999.

[82] Y. S. Huang and C. Y. Suen. Method of Combining Multiple Experts for the

[83]

[84}

[85]

[85]

[87}

[88]

[89]

[90]

Recognition of Unconstrained Handwritten Numerals. IEEE Transactions on
Pattern Analysis and Machine Intelligence, 17(1):90—94, January 1995.

S. S. Iyengar, L. Prasad, and H. Min. Advances in Distributed Sensor T echnol-
ogy. Prentice Hall, 1995.

A. K. Jain, R. Bolle, and S. Pankanti, editors. Biometrics: Personal Identiﬁ-
cation in Networked Society. Kluwer Academic Publishers, 1999.

A. K. Jain and B. Chandrasekaran. Dimensionality and Sample Size Consider-
ations in Pattern Recognition Practice. In P.R. Krishnaiah and L. N. Kanal,
editors, Handbook of Statistics, volume 2, pages 835—855. North-Holland, Ams-
terdam, 1982.

A. K. Jain, L. Hong, and R. Bolle. On-line Fingerprint Veriﬁcation. IEEE
Transactions on Pattern Analysis and Machine Intelligence, 19(4):302—314,
April 1997.

A. K. Jain, L. Hong, and R. Bolle. On—line Fingerprint Veriﬁcation. IEEE
Transactions on Pattern Analysis and Machine Intelligence, 19(4):302—314,
April 1997.

A. K. Jain, L. Hong, and Y. Kulkarni. A Multimodal Biometric System using
Fingerprint, Face and Speech. In Second International Conference on Audio-
and Video-based Biometric Person Authentication (AVBPA), pages 182—187,
Washington DC, USA, March 1999.

A. K. Jain, K. Nandakumar, X. Lu, and U. Park. Integrating Faces, Finger-
prints and Soft Biometric Traits for User Recognition. In Proceedings of ECG V
International Workshop on Biometric Authentication (BioA W), volume LNCS
3087, pages 259—269, Prague, Czech Republic, May 2004. Springer.

A. K. Jain, K. Nandakumar, and A. Ross. Score Normalization in Multimodal
Biometric Systems. Pattern Recognition, 38(12):2270—2285, December 2005.

217

 

[91] A. K. Jain and S. Pankanti. A Touch of Money. IEEE Spectrum, 3(7):22—27,
2006.

[92] A. K. Jain, S. Pankanti, S. Prabhakar, L. Hong, and A. Ross. Biometrics:
A Grand Challenge. In Proceedings of International Conference on Pattern
Recognition (ICPR), volume 2, pages 935—942, Cambridge, UK, August 2004.

[93] A. K. Jain, S. Prabhakar, and S. Chen. Combining Multiple Matchers for a
High Security Fingerprint Veriﬁcation System. Pattern Recognition Letters,
20(11—13):1371—1379, November 1999.

[94] A. K. Jain, S. Prabhakar, and A. Ross. Fingerprint Matching: Data Acquisi-
tion and Performance Evaluation. Technical Report TR99-14, Michigan State
University, 1999.

[95] A. K. Jain and A. Ross. Fingerprint Mosaicking. In IEEE International Con-
ference on Acoustics, Speech, and Signal Processing ( I CASSP), volume 4, pages
4064—4067, Orlando, USA, May 2002.

[96] A. K. Jain and A. Ross. Learning User-speciﬁc Parameters in a Multibiomet-
ric System. In Proceedings of International Conference on Image Processing
(ICIP), pages 57—60, Rochester, USA, September 2002.

[97] A. K. Jain and A. Ross. Multibiometric Systems. Communications of the ACM,
Special Issue on Multimodal Interfaces, 47(1):34—40, January 2004.

[98] A. K. Jain, A. Ross, and S. Pankanti. A Prototype Hand Geometry-based Ver-
iﬁcation System. In Proceedings of Second International Conference on Audio-
and Video-based Biometric Person Authentication (AVBPA), pages 166—171,
Washington D.C., USA, March 1999.

[99] A. K. Jain, A. Ross, and S. Prabhakar. An Introduction to Biometric Recogni-
tion. IEEE Transactions on Circuits and Systems for Video Technology, Special
Issue on Image- and Video-Based Biometrics, 14(1):4—20, January 2004.

[100] D. S. Jeong, H.-A. Park, K. R. Park, and J. Kim. Iris Recognition in Mobile
Phone Based on Adaptive Gabor Filter. In Proceedings of IAPR International
Conference on Biometrics (103), pages 457—463, Hong Kong, China, January
2006.

[101] X. Jiang and W. Ser. Online ﬁngerprint template improvement. IEEE Transac-
tions on Pattern Analysis and Machine Intelligence, 24(8):1121—1126, August
2002.

[102] A. Juels and M. Sudan. A Fuzzy Vault Scheme. In Proceedings of IEEE Inter-
national Symposium on Information Theory, page 408, Lausanne, Switzerland,
2002.

218

 

[103] A. Juels and M. Wattenberg. A Fuzzy Commitment Scheme. In Proceedings
of Sixth ACM Conference on Computer and Communications Security, pages
28—36, Singapore, November 1999.

[104] A. Kale, A. K. RoyChowdhury, and R. Chellappa. Fusion of Gait and Face for
Human Identiﬁcation. In IEEE International Conference on Acoustics, Speech,
and Signal Processing (ICASSP), volume 5, pages 901—904, Montreal, Canada,
May 2004.

[105] E. J. C. Kelkboom, B. Gkberk, T. A. M. Kevenaar, A. H. M. Akkermans,
and M. van der Veen. “3D Face”: Biometric Template Protection for 3D Face
Recognition. In Proceedings of Second International Conference on Biometrics,
pages 566—573, Seoul, South Korea, August 2007.

[106] A. Kholmatov and B. Yanikoglu. Realization of Correlation Attack Against the
Fuzzy Vault Scheme. In Proceedings of SPIE Symposium on Security, Forensics,
Steganography, and Watermarking of Multimedia Contents X (To appear), San
Jose, USA, January 2008.

[107] T. Kinnunen, V. Hautamaki, and P. Franti. Fusion of Spectral Feature Sets for
Accurate Speaker Identiﬁcation. In Ninth Conference on Speech and Computer,
pages 361—365, Saint-Petersburg, Russia, September 2004.

[108] J. Kittler, M. Hatef, R. P. Duin, and J. G. Matas. On Combining Classiﬁers.
IEEE Transactions on Pattern Analysis and Machine Intelligence, 20(3):226—
239, March 1998.

[109] J. Kittler and M. Sadeghi. Physics-based Decorrelation of Image Data for
Decision Level Fusion in Face Veriﬁcation. In Fifth International Workshop
on Multiple Classiﬁer Systems, pages 354—363, Cagliari, Italy, June 2004.

[110] D. V. Klien. Foiling the Cracker; A Survey of, and Improvements to Unix Pass-
word Security. In Proceedings of the Second USENIX Workshop on Security,
pages 5—14, August 1990.

[111] S. Krawczyk and A. K. Jain. Securing Electronic Medical Records using Biomet-
ric Authentication. In Proceedings of Fifth International Conference on Audio-
and Video-based Biometric Person Authentication (AVBPA), pages 1110—1119,
Rye Brook, USA, July 2005.

[112] A. Kumar, D. C. M. Wong, H. C. Shen, and A. K. Jain. Personal Veriﬁcation
Using Palmprint and Hand Geometry Biometric. In Fourth International Con-
ference on Audio- and Video-based Biometric Person Authentication (A VBPA),
pages 668—678, Guildford, UK, June 2003.

[113] A. Kumar and D. Zhang. Personal Authentication using Multiple Palmprint
Representation. Pattern Recognition, 38(10):1695—1704, October 2005.

219

 

[114] L. I. Kuncheva. Combining Pattern Classiﬁers - Methods and Algorithms. Wiley,
2004.

[115] RSA Laboratories. PKCS #5: Password-Based Crptography Standard, Version
2.0. Technical report, RSA Laboratories, March 1999.

[116] L. Lam and C. Y. Suen. Application of Majority Voting to Pattern Recognition:
An Analysis of its Behavior and Performance. IEEE Transactions on Systems,
Man, and Cybernetics, Part A: Systems and Humans, 27(5):553—568, 1997.

[117] Y. J. Lee, K. Bae, S. J. Lee, K. R. Park, and J. Kim. Biometric Key Bind-
ing: Fuzzy Vault based on Iris Images. In Proceedings of Second International
Conference on Biometrics, pages 800—808, Seoul, South Korea, August 2007.

[118] E. L. Lehmann and J. P. Romano. Testing Statistical Hypotheses. Springer,
2005.

[119] J. Q. Li and A. Barron. Mixture Density Estimation. In S. A. Solla, T. K.
Leen, and K.-R. Muller, editors, Advances in Neural Information Processings
Systems 12. Morgan Kaufmann Publishers, San Mateo, USA, 1999.

[120] Q. Li and E. C. Chang. Robust, Short and Sensitive Authentication Tags Using
Secure Sketch. In Proceedings of ACM Multimedia and Security Workshop,
pages 56—61, Geneva, Switzerland, September 2006.

[121] Y. Li, S. Gong, and H. Liddell. Constructing Facial Identity Surfaces for Recog-
nition. International Journal of Computer Vision, 53(1):71—92, June 2003.

[122] S. Lin and D. J. Costello. Error Control Coding: Fundamentals and Applica-
tions. Prentice Hall, Englewood Cliffs, USA, 1983.

[123] X. Liu and T. Chen. Geometry-assisted Statistical Modeling for Face Mosaicing.
In Proceedings of IEEE International Conference on Image Processing (ICIP),
volume 2, pages 883—886, Barcelona, Spain, September 2003.

[124] X. Lu and A. K. Jain. Integrating Range and Texture Information for 3D Face
Recognition. In IEEE Computer Society Workshop on Application of Computer
Vision ( WA C V), pages 156—163, Breckenridge, USA, January 2005.

[125} X. Lu, Y. Wang, and A. K. Jain. Combining Classiﬁers for Face Recognition.
In IEEE International Conference on Multimedia and Expo (ICME), volume 3,
pages 13—16, Baltimore, USA, July 2003.

[126] L. Ma, T. Tan, Y. Wang, and D. Zhang. Personal Identiﬁcation Based on

Iris Texture Analysis. IEEE Transactions on Pattern Analysis and Machine
Intelligence, 25(12):1519—1533, December 2003.

220

 

[127] Y. Ma, B. Cukic, and H. Singh. A Classiﬁcation Approach to Multi—biometric
Score Fusion. In Fifth International Conference on Audio- and Video-based
Biometric Person Authentication (A VBPA), pages 484—493, Rye Brook, USA,
July 2005.

[128] D. Maio, D. Maltoni, J. L. Wayman, and A. K. Jain. FVC2002: Second F in-
gerprint Veriﬁcation Competition. In Proceedings of International Conference
on Pattern Recognition (I CPR ), pages 811—814, Quebec City, Canada, August
2002.

[129] D. Maltoni, D. Maio, A. K. Jain, and S. Prabhakar. Handbook of Fingerprint
Recognition. Springer-Verlag, 2003.

[130] G. L. Marcialis and F. Roli. Fingerprint Veriﬁcation by Fusion of Optical
and Capacitive Sensors. Pattern Recognition Letters, 25(11):1315—1322, August
2004.

[131] G. L. Marcialis and F. Roli. Fusion of Appearance-based Face Recognition
Algorithms. Pattern Analysis and Applications, 7(2):151—163, July 2004.

[132] G. L. Marcialis and F. Roli. Fusion of Multiple Fingerprint Matchers by Single-

layer Perceptron with Class-separation Loss Function. Pattern Recognition Let-
ters, 26(12):1830—1839, September 2005.

[133] T. Matsumoto, M. Hirabayashi, and K. Sato. A Vulnerability Evaluation of Iris
Matching (Part 3). In Proceedings of the 2004 Symposium on Cryptography and
Information Security, pages 701—706, Iwate, Japan, January 2004.

[134] T. Matsumoto, H. Matsumoto, K. Yamada, and S. Hoshino. Impact of Artiﬁcial
Gummy Fingers on Fingerprint Systems. In Optical Security and Counterfeit
Deterrence Techniques IV, Proceedings of SPIE, volume 4677, pages 275—289,
San Jose, USA, January 2002.

[135] O. Melnik, Y. Vardi, and C.-H. Zhang. Mixed Group Ranks: Preference and
Conﬁdence in Classiﬁer Combination. IEEE Transactions on Pattern Analysis
and Machine Intelligence, 26(8):973—981, August 2004.

[136] K. D. Mitnick, W. L. Simon, and S. Wozniak. The Art of Deception: Controlling
the Human Element of Security. Wiley, 2002.

[137] F. Monrose, M. K. Reiter, and S. Wetzel. Password Hardening Based on
Keystroke Dynamics. In Proceedings of Sixth ACM Conference on Computer
and Communications Security, pages 73—82, 1999.

[138] F. Monrose, M.K. Reiter, Q. Li, and S. Wetzel. Cryptographic Key Generation
from Voice. In Proceedings of IEEE Symposium on Security and Privacy, pages
202—213, Oakland, USA, May 2001.

221

[139] H. Moon and P. J. Phillips. Computational and Performance Aspects of PCA-
based Face Recognition Algorithms. Perception, 30(5):303—321, 2001.

[140] Y. S. Moon, H. W. Yeung, K. C. Chan, and S. O. Chan. Template Synthesis
and Image Mosaicking for Fingerprint Registration: An Experimental Study.
In IEEE International Conference on Acoustics, Speech, and Signal Processing
(ICASSP), volume 5, pages 409—412, Montreal, Canada, May 2004.

[141] A. Nagar and S. Chaudhury. Biometrics based Asymmetric Cryptosystem De-
sign Using Modiﬁed Fuzzy Vault Scheme. In Proceedings of IEEE International
Conference Pattern Recognition, volume 4, pages 537—540, Hong Kong, China,
August 2006.

[142] K. Nandakumar, Y. Chen, S. C. Dass, and A. K. Jain. Likelihood Ratio Based
Biometric Score Fusion. IEEE Transactions on Pattern Analysis and Machine
Intelligence, 30(2):342—347, February 2008.

[143] K. Nandakumar, Y. Chen, A. K. Jain, and S. C. Dass. Quality-based Score Level
Fusion in Multibiometric Systems. In Proceedings of International Conference
on Pattern Recognition (ICPR), pages 473—476, Hong Kong, China, August
2006.

[144] K. Nandakumar, A. K. Jain, and S. Pankanti. Fingerprint-based Fuzzy Vault:
Implementation and Performance. IEEE Transactions on Information Forensics
and Security, 2(4):744—757, December 2007.

[145] K. N andakumar, A. Nagar, and A. K. Jain. Hardening Fingerprint Fuzzy Vault
Using Password. In Proceedings of Second International Conference on Biomet-
rics, pages 927—937, Seoul, South Korea, August 2007.

[146] R. B. Nelsen. An Introduction to Copulas. Springer, 1999.

[147] BBC News. Long Lashes Thwart ID Scan 'IIial. Available at http:/ / news.
bbc . co . uk/ 2/hi/ uk_news/ politics/ 3693375 . stm, May 2004.

[148] Biometric System Laboratory University of Bologna. FVC2006: The Fourth
International Fingerprint Veriﬁcation Competition. Available at http : / / bias.
csr.unibo.it/fvc2006/defau1t.asp.

[149] Department of Homeland Security. Privacy Impact Assessment for
the Automated Biometric Identiﬁcation System (IDENT). Available
at http: //www . dhs . gov/x1ibrary/assets/privacy/privacy_pia_usvisit_
ident_fina1.pdf, July 2006.

[150] Federal Bureau of Investigation. Integrated Automated Fingerprint Identiﬁca-
tion System. Available at http: / /www.fbi . gov/hq/ c jisd/ iaf is .htm.

222

 

[151] National Institute of Standards and Technology. NIST Biometric
Scores Set. Available at http://http://www.itl.nist.gov/iad/894.03/
biometricscores,2004.

[152] P. J. Phillips, K. W. Bowyer, and P. J. Flynn. Comments on the CASIA
Version 1.0 Iris Data Set. IEEE Transactions on Pattern Analysis and Machine
Intelligence, 29(10):1869—1870, October 2007.

[153] P. J. Phillips, W. T. Scruggs, A. J. OToole, P. J. Flynn, K. W. Bowyer, C. L.
Schott, and M. Sharpe. FRVT 2006 and ICE 2006 Large-Scale Results. Tech-
nical Report NISTIR 7408, NIST, March 2007.

[154] N. Poh and S. Bengio. Database, Protocol and Tools for Evaluating Score—
Level Fusion Algorithms in Biometric Authentication. Pattern Recognition,
39(2):223—233, February 2006.

[155] S. Prabhakar and A. K. Jain. Decision-level Fusion in Fingerprint Veriﬁcation.
Pattern Recognition, 35(4):861—874, April 2002.

[156] M. Przybocki and A. Martin. NIST Speaker Recognition Evaluation Chronicles.
In Odyssey: The Speaker and Language Recognition Workshop, pages 12—22,
Toledo, Spain, May 2004.

[157] A. Rakhlin, D. Panchenko, and S. Mukherjee. Risk Bounds for Mixture Density
Estimation. ESAIM: Probability and Statistics, 9:220—229, June 2005.

[158] N. K. Ratha, S. Chikkerur, J. H. Connell, and R. M. Bolle. Generating Can-
celable Fingerprint Templates. IEEE Transactions on Pattern Analysis and
Machine Intelligence, 29(4):561—572, April 2007.

[159] N. K. Ratha, J. H. Connell, and R. M. Bolle. Image Mosaicing For Rolled
Fingerprint Construction. In Proceedings of Fourteenth International Confer-
ence on Pattern Recognition (ICPR), volume 2, pages 1651-1653, Brisbane,
Australia, August 1998.

[160] N. K. Ratha, J. H. Connell, and R. M. Bolle. An Analysis of Minutiae Match-
ing Strength. In Proceedings of Third International Conference on Audio- and
Video-Based Biometric Person Authentication (A VBPA), pages 223—228, Halm-
stad, Sweden, June 2001.

[161] N. K. Ratha, J. H. Connell, R. M. Bolle, and S. Chikkerur. Cancelable Bio-
metrics: A Case Study in Fingerprints. In Proceedings of IEEE International
Conference Pattern Recognition, volume 4, pages 370—373, Hong Kong, China,
August 2006.

[162] D. Reynolds, W. Andrews, J. Campbell, J. Navratil, B. Peskin, A. Adami,
Q. Jin, D. Klusacek, J. Abramson, R. Mihaescu, J. Godfrey, D. Jones, and
B. Xiang. The SuperSID Project: Exploiting High-level Information for High-
accuracy Speaker Recognition. In IEEE International Conference on Acoustics,

223

 

Speech, and Signal Processing (ICASSP), pages 784—787, Hong Kong, China,
April 2003.

[163] D. A. Reynolds, T. F. Quatieri, and R. B. Dunn. Speaker Veriﬁcation using
Adapted Gaussian Mixture Models. Digital Signal Processing, 10:19—41, Jan-
uary/ April/ July 2000.

[164] J. A. Rice. Mathematical Statistics and Data Analysis, Second Edition. Duxbury
Press, 1995.

[165] L. Rodriguez-Linares, C. Garcia-Mateo, and J. L. Alba-Castro. On Combin-
ing Classiﬁers for Speaker Authentication. Pattern Recognition, 36(2):347—359,
February 2003.

[166] A. Ross and R. Govindarajan. Feature Level Fusion Using Hand and Face
Biometrics. In Proceedings of SPIE Conference on Biometric Technology for
Human Identiﬁcation 11, volume 5779, pages 196—204, Orlando, USA, March
2005.

[167] A. Ross and A. K. Jain. Information Fusion in Biometrics. Pattern Recognition
Letters, 24(13):2115—2125, September 2003.

[168] A. Ross, A. K. Jain, and J. Reisman. A Hybrid Fingerprint Matcher. Pattern
Recognition, 36(7):1661—1673, July 2003.

[169] A. Ross, K. Nandakumar, and A. K. Jain. Handbook of Multibiometrics.
Springer, 2006.

[170] A. Ross, S. Shah, and J. Shah. Image Versus Feature Mosaicing: A Case Study
in Fingerprints. In Proceedings of SPIE Conference on Biometric Technology
for Human Identiﬁcation, volume 6202, pages 1—12, Orlando, USA, April 2006.

[171] A. K. Ross, J. Shah, and A. K. Jain. From Templates to Images: Reconstructing
Fingerprints From Minutiae Points. IEEE Transactions on Pattern Analysis
and Machine Intelligence, 29(4):544—560, 2007.

[172] C. Sanderson and K. K. Paliwal. Information Fusion for Robust Speaker Veri-
ﬁcation. In Seventh European Conference on Speech Communication and Tech-
nology, pages 755—758, Aalborg, Denmark, September 2001.

[173] C. Sanderson and K. K. Paliwal. Information Fusion and Person Veriﬁcation
Using Speech and Face Information. Technical Report IDIAP-RR 02-33, IDIAP,
September 2002.

[174] M. Savvides and B. V. K. Vijaya Kumar. Cancellable Biometric Filters for
Face Recognition. In Proceedings of IEEE International Conference Pattern
Recognition, volume 3, pages 922—925, Cambridge, UK, August 2004.

224

 

[175] W. J. Scheirer and T. E. Boult. Cracking Fuzzy Vaults and Biometric Encryp—
tion. In Proceedings of Biometrics Symposium, September 2007.

[176] Luchthaven Schiphol. Privium: A Select Way to Travel. Available at http:
//www.schiphol.nl/privium/privium.jsp.

[177] S. Shah. Enhanced Iris Recognition: Algorithms for Segmentation, Matching
and Synthesis. Master’s thesis, Lane Department of Computer Science and
Electrical Engineering, West Virginia University, 2006.

[178] G. Shakhnarovich, L. Lee, and T.J. Darrell. Integrated Face and Gait Recog-
nition from Multiple Views. In IEEE Conference on Computer Vision and
Pattern Recognition (CVPR), pages 439—446, Hawaii, USA, December 2001.

[179] B. W. Silverman. Density Estimation for Statistics and Data Analysis. Chap-
man & Hall, 1986.

[180] R. Snelick, U. Uludag, A. Mink, M. Indovina, and A. K. Jain. Large Scale Evalu-
ation of Multimodal Biometric Authentication Using State-of—the—Art Systems.
IEEE Transactions on Pattern Analysis and Machine Intelligence, 27(3):450—
455, March 2005.

[181] D. A. Socolinsky, A. Selinger, and J. D. Neuheisel. Face Recognition with Visible
and Thermal Infrared Imagery. Computer Vision and Image Understanding,
91(1-2):72—114, July-August 2003.

[182] B. Son and Y. Lee. Biometric Authentication System Using Reduced Joint
Feature Vector of Iris and Face. In Proceedings of Fifth International Conference
on Audio- and Video-Based Biometric Person Authentication (A VBPA), pages
513—522, Rye Brook, USA, July 2005.

[183] O. T. Song, A. B. J Teoh, and D. C. L. Ngo. Application-Speciﬁc Key Release
Scheme from Biometrics. International Journal of Network Security, 6(2):127—
133, March 2008.

[184] C. Soutar, D. Roberge, A. Stoianov, R. Gilroy, and B. V. K. V. Kumar. Biomet-
ric Encrpytion. In R. K. Nichols, editor, ICSA Guide to Cryptography. McGraw
Hill, 1999.

[185] Y. Sutcu, Q. Li, and N. Memon. Protecting Biometric Templates with Sketch:
Theory and Practice. IEEE Transactions on Information Forensics and Secu-
rity, 2(3):503—512, September 2007.

[186] Y. Sutcu, Q. Li, and N. Memon. Secure Biometric Templates from F ingerprint-
Face Features. In Proceedings of CVPR Workshop on Biometrics, Minneapolis,
USA, June 2007.

225

[187]

[188]

[189]

[190]

[191]

[192]

[193]

[194]

[195]

[196]

[197]

A. B. J. Teoh, A. Goh, and D. C. L. Ngo. Random Multispace Quantization
as an Analytic Mechanism for BioHashing of Biometric and Random Iden-

tity Inputs. IEEE Transactions on Pattern Analysis and Machine Intelligence,
28(12):1892—1901, December 2006.

A. B. J. Teoh, K.-A. Toh, and W. K. Yip. 2N Discretisation of BioPhasor in
Cancellable Biometrics. In Proceedings of Second International Conference on
Biometrics, pages 435—444, Seoul, South Korea, August 2007.

NIST Report to the United States Congress. Summary of NIST Standards
for Biometric Accuracy, Tamper Resistance, and Interoperability. Avail-
able at ftp://sequoyah.nist.gov/pub/nist_interna1_reports/NISTAPP_
Nov02 . pdf, November 2002.

K.-A. Toh, X. Jiang, and W.-Y. Yau. Exploiting Global and Local Decisions for
Multimodal Biometrics Veriﬁcation. IEEE Transactions on Signal Processing,
(Supplement on Secure Media), 52(10):3059—3072, October 2004.

K.—A. Toh, W. Xiong, W.-Y. Yau, and X. Jiang. Combining Fingerprint and
Hand-Geometry Veriﬁcation Decisions. In Fourth International Conference on
Audio- and Video-based Biometric Person Authentication (A VBPA), pages 688—
696, Guildford, UK, June 2003.

K.-A. Toh and W.-Y. Yau. Fingerprint and Speaker Veriﬁcation Decisions Fu-
sion Using a Functional Link Network. IEEE Transactions on Systems, Man,
and Cybernetics, Part A: Applications and Reviews, 35(3):357—370, August
2005.

M. Turk and A. Pentland. Eigenfaces for Recognition. Journal of Cognitive
Neuroscience, 3(1):71—86, 1991.

P. Tuyls, A. H. M. Akkermans, T. A. M. Kevenaar, G.-J. Schrijen, A. M.
Bazen, and R. N. J. Veldhuis. Practical Biometric Authentication with Tem-
plate Protection. In Proceedings of Fifth International Conference on Audio-

and Video-based Biometric Person Authentication, pages 436—446, Rye Town,
USA, July 2005.

B. Ulery, A. R. Hicklin, C. Watson, W. Fellner, and P. Hallinan. Studies of
Biometric Fusion. Technical Report IR 7346, NIST, September 2006.

U. Uludag and A. K. Jain. Securing Fingerprint Template: Fuzzy Vault With
Helper Data. In Proceedings of CVPR Workshop on Privacy Research In Vision,
page 163, New York, USA, June 2006.

U. Uludag, S. Pankanti, and A. K. Jain. Fuzzy Vault for Fingerprints. In Pro-
ceedings of Fifth International Conference on Audio- and Video-based Biometric
Person Authentication, pages 310—319, Rye Town, USA, July 2005.

226

 

[198]

[199]

[200]

[201]

[202]

[203]

[204]

[205]

[206]

[207]

[208]

[209}

U. Uludag, S. Pankanti, S. Prabhakar, and A. K. Jain. Biometric Cryptosys-
tems: Issues and Challenges. Proceedings of the IEEE, Special Issue on Multi-
media Security for Digital Rights Management, 92(6):948—960, June 2004.

A. Vetro and N. Memon. Biometric System Security. Tutorial presented at
Second International Conference on Biometrics, Seoul, South Korea, August
2007.

C. Vielhauer, R. Steinmetz, and A. Mayerhofer. Biometric Hash Based on
Statistical Features of Online Signatures. In Proceedings of 16th International

Conference on Pattern Recognition, volume 1, pages 123—126, Quebec, Canada,
August 2002.

A. Wald. Sequential Tests of Statistical Hypotheses. The Annals of Mathemat-
ical Statistics, 16(2):117—186, June 1945.

M. P. Wand and M. C Jones. Kernel Smoothing. Chapman & Hall, CRC Press,
1995.

Y. Wang, T. Tan, and A. K. Jain. Combining Face and Iris Biometrics for
Identity Veriﬁcation. In Fourth International Conference on Audio- and Video-
based Biometric Person Authentication (AVBPA), pages 805—813, Guildford,
UK, June 2003.

C. Wilson, A. R. Hicklin, M. Bone, H. Korves, P. Grother, B. Ulery, R. Micheals,
M. Zoepfl, S. Otto, and C. Watson. Fingerprint Vendor Technology Evaluation
2003: Summary of Results and Analysis Report. Technical Report NISTIR
7123, NIST, June 2004.

K. Woods, K. Bowyer, and W. P. Kegelmeyer. Combination of Multiple Classi-
ﬁers Using Local Accuracy Estimates. IEEE Transactions on Pattern Analysis
and Machine Intelligence, 19(4):405—410, April 1997.

L. Xu, A. Krzyzak, and C. Y. Suen. Methods for Combining Multiple Classiﬁers
and their Applications to Handwriting Recognition. IEEE Transactions on
Systems, Man, and Cybernetics, 22(3):418—435, 1992.

F. Yang, M. Paindavoine, H. Abdi, and A. Monopoli. Development of a Fast

Panoramic Face Mosaicking and Recognition System. Optical Engineering,
44(8), August 2005.

J. Yang, J .-Y. Yang, D. Zhang, and J .-F. Lu. Feature Fusion: Parallel Strategy
vs. Serial Strategy. Pattern Recognition, 38(6):1369—1381, June 2003.

S. Yang and I. Verbauwhede. Automatic Secure Fingerprint Veriﬁcation System
Based on Fuzzy Vault Scheme. In Proceedings of IEEE International Confer-

ence on Acoustics, Speech, and Signal Processing, volume 5, pages 609—612,
Philadelphia, USA, March 2005.

227

 

[210]

[211]

[212]

[213]

[214}

[215]

[216]

B. Yanikoglu and A. Kholmatov. Combining Multiple Biometrics to Protect
Privacy. In Proceedings of ICPR Workshop on Biometrics: Challenges arising
from Theory to Practice, Cambridge, UK, August 2004.

J. You, W.-K. Kong, D. Zhang, and K. H. Cheung. On Hierarchical Palmprint
Coding With Multiple Features for Personal Identiﬁcation in Large Databases.
IEEE Transactions on Circuits and Systems for Video Technology, 14(2):234—
243, February 2004.

Y.-L. Zhang, J. Yang, and H. Wu. A Hybrid Swipe Fingerprint Mosaicing
Scheme. In Proceedings of Fifth International Conference on Audio- and Video-
Based Biometric Person Authentication (A VBPA), pages 131—140, Rye Brook,
USA, July 2005.

S. Zhou, V. Krueger, and R. Chellappa. Probabilistic Recognition of Human
Faces from Video. Computer Vision and Image Understanding, 91(1-2):214—
245, July-August 2003.

X. Zhou. Template Protection and its Implementation in 3D Face Recogni-
tion Systems. In Proceedings of SPIE Conference on Biometric Technology for
Human Identiﬁcation, volume 6539, pages 214—225, Orlando, USA, April 2007.

Y. Zhu, S. C. Dass, and Jain. Statistical Models for Assessing the Individuality
of Fingerprints. IEEE Transactions on Information Forensics and Security,
2(3):391—401, September 2007.

Z. Zivkovic and F. van der Heijden. Recursive Unsupervised Learning of Fi-
nite Mixture Models. IEEE Transactions on Pattern Analysis and Machine
Intelligence, 26(5):651—656, May 2004.

228

    

M A

I!)[11]]111111111111[1111]]!

293 02956 5789