Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

International Symposium on Information Theory and its Applications

Fundamental limits for biometric identification with a database containing protected templates

Tanya Ignatenko, F.M.J. Willems

Published Oct 1, 2010• 10 citations
Publisher

Abstract

In this paper we analyze secret generation in biometric identification systems with protected templates. This problem is closely related to the study of the biometric identification capacity of Willems et al. 2003 and O'Sullivan and Schmid 2002 and the common randomness generation of Ahlswede and Csiszár 1993. In our system two terminals observe biometric enrollment and identification sequences of a number of individuals. It is the goal of these terminals to form a common secret for the sequences that belong to the same individual by interchanging public (helper) messages for all individuals in such a way that the information leakage about the secrets from these helper messages is negligible. It is important to realize that biometric data are unique for individuals and cannot be replaced if compromised. Therefore the helper messages should contain as little as possible information about the biometric data. On the other hand, the second terminal has to establish the identity of the individual who presented his biometric sequence, based on the helper data produced by the first terminal. In this paper we determine the fundamental tradeoff between secret-key rate, identification rate and privacy-leakage rate in biometric identification systems.

DOI
10.1109/isita.2010.5649707

Related papers

Secret-key and identification rates for biometric identification systems with protected templates

Tanya Ignatenko, Fmj Frans Willems

In this paper we consider secret generation in biometric identification systems\nwith protected templates. This problem is closely related to the study of the bio\nmetric identification capacity [Willems et al., 2003] and [O’Sullivan and Sclmmid,\n2002] and the common randomness generation scheme [Ahlswede and Csiszár.\n1993]. In our system two terminals observe biometric enrollment and identifi\ncation sequences of a number of individuals. It is the goal of these terminals\nto form a common secret for the sequences that belong to the same individual\nby interchanging public (helper) messages for all individuals in such a way that\nthe information leakage about the secrets from these helper messages is negli\ngible. Moreover, based on the helper data produced by the first terminal, the\nsecond terminal has to establish tIme identity of the individual who presented his\nbiometric sequence.

•Jan 1, 2010•5 citations

Privacy leakage in biometric secrecy systems

Tanya Ignatenko, F.M.J. Willems

Motivated by Maurer [1993], Ahlswede and Csiszar [1993] introduced the concept of secret sharing. In their source model two terminals observe two correlated sequences. It is the objective of both terminals to form a common secret by interchanging a public message (helper data), that should contain only a negligible amount of information about the secret. Ahlswede and Csiszar showed that the maximum secret key rate that can be achieved in this way is equal to the mutual information between the two source outputs. In a biometric setting, where the sequences correspond to the enrollment and authentication data, it is crucial that the public message leaks as little information as possible about the biometric data, since compromised biometric data cannot be replaced. We investigate the fundamental trade-offs for four biometric settings. The first one is the standard (Ahlswede-Csiszar) secret generation setting, for which we determine the secret key rate - privacy leakage region. Here leakage corresponds to the mutual information between helper data and biometric enrollment sequence conditional on the secret. In the second setting the secret is not generated by the terminals but independently chosen, and transmitted using a public message. Again we determine the region of achievable rate - leakage pairs. In setting three and four we consider zero-leakage, i.e. the public message contains only a negligible amount of information about the secret and the biometric enrollment sequence. To achieve this a private key is needed which can be observed only by the terminals. We consider again both secret generation and secret transmission and determine for both cases the region of achievable secret key rate - private key rate pairs.

Allerton Conference on Communication, Control, and Computing•Sep 1, 2008•23 citations

Biometric Systems: Privacy and Secrecy Aspects

Tanya Ignatenko, F.M.J. Willems

This paper addresses privacy leakage in biometric secrecy systems. Four settings are investigated. The first one is the standard Ahlswede-Csiszar secret-generation setting in which two terminals observe two correlated sequences. They form a common secret by interchanging a public message. This message should only contain a negligible amount of information about the secret, but here, in addition, we require it to leak as little information as possible about the biometric data. For this first case, the fundamental tradeoff between secret-key and privacy-leakage rates is determined. Also for the second setting, in which the secret is not generated but independently chosen, the fundamental secret-key versus privacy-leakage rate balance is found. Settings three and four focus on zero-leakage systems. Here the public message should only contain a negligible amount of information on both the secret and the biometric sequence. To achieve this, a private key is needed, which can only be observed by the terminals. For both the generated-secret and the chosen-secret model, the regions of achievable secret-key versus private-key rate pairs are determined. For all four settings, the fundamental balance is determined for both unconditional and conditional privacy leakage.

IEEE Transactions on Information Forensics and Security•Sep 30, 2009•176 citations

Biometric Identification Systems With Noisy Enrollment for Gaussian Source

Vamoua Yachongka, Hideki Yagi, Yasutada Oohama

In the present paper, we investigate the fundamental trade-off of identification, secrecy, storage, and privacy-leakage rates in biometric identification systems for hidden or remote Gaussian sources. We introduce a technique for deriving the capacity region of these rates by converting the system to one where the data flow is in one-way direction. Also, we provide numerical calculations of three different examples for the generated-secret model. The numerical results imply that it seems hard to achieve both high secrecy and small privacy-leakage rates simultaneously. In addition, as special cases, the characterization coincides with several known results in previous studies.

IEEE Information Theory Workshop (ITW)•Apr 11, 2021•1 citation

Biometric Identification Systems with Noisy Enrollment for Gaussian Sources and Channels

Vamoua Yachongka, Hideki Yagi, Yasutada Oohama

In the present paper, we investigate the fundamental trade-off of identification, secret-key, storage, and privacy-leakage rates in biometric identification systems for remote or hidden Gaussian sources. We use a technique of converting the system to one where the data flow is in one-way direction to derive the capacity region of these rates. Also, we provide numerical calculations of three different examples for the system. The numerical results imply that it seems hard to achieve both high secret-key and small privacy-leakage rates simultaneously.

arXiv:2010.10799•Entropy•Aug 15, 2021•9 citations

Secret Key Generation from a Biometric Source with an Eavesdropping Jammer

Sebastian Baur, Holger Boche, Ning Cai

We consider secret key generation from a biometric source. We examine an information theoretic model where a legitimate user reads from the biometric source two times. A secret key is generated from the first output of the biometric source. From the second output of the biometric source this secret key is reconstructed. The corresponding outputs of the biometric source are modelled as jointly distributed random variables. We also assume that a helper message, generated after reading from the biometric source for the first time, is available to the legitimate user when reading from the biometric source for the second time. Additionally the helper message is assumed to be publicly available and an eavesdropper wants to learn the secret key from the helper message. We assume the biometric source is jammed before the legitimate user reads from the source for the second time. The jammer gets to know the public helper message too. Considering the secret key generation rate and the privacy leakage rate we characterize the corresponding capacity region taking into account protocols that guarantee perfect secrecy and uniform distribution of the key.

IEEE Conference on Computer Communications Workshops (INFOCOM WKSHPS)•Apr 29, 2019•4 citations
In this paper we analyze secret generation in biometric identification systems with protected templates. This problem is closely related to the study of the biometric identification capacity of Willems et al. 2003 and O'Sullivan and Schmid 2002 and the common randomness generation of Ahlswede and Csiszár 1993. In our system two terminals observe biometric enrollment and identification sequences of a number of individuals. It is the goal of these terminals to form a common secret for the sequences that belong to the same individual by interchanging public (helper) messages for all individuals in such a way that the information leakage about the secrets from these helper messages is negligible. It is important to realize that biometric data are unique for individuals and cannot be replaced if compromised. Therefore the helper messages should contain as little as possible information about the biometric data. On the other hand, the second terminal has to establish the identity of the individual who presented his biometric sequence, based on the helper data produced by the first terminal. In this paper we determine the fundamental tradeoff between secret-key rate, identification rate and privacy-leakage rate in biometric identification systems.
In this paper we consider secret generation in biometric identification systems\nwith protected templates. This problem is closely related to the study of the bio\nmetric identification capacity [Willems et al., 2003] and [O’Sullivan and Sclmmid,\n2002] and the common randomness generation scheme [Ahlswede and Csiszár.\n1993]. In our system two terminals observe biometric enrollment and identifi\ncation sequences of a number of individuals. It is the goal of these terminals\nto form a common secret for the sequences that belong to the same individual\nby interchanging public (helper) messages for all individuals in such a way that\nthe information leakage about the secrets from these helper messages is negli\ngible. Moreover, based on the helper data produced by the first terminal, the\nsecond terminal has to establish tIme identity of the individual who presented his\nbiometric sequence.
Motivated by Maurer [1993], Ahlswede and Csiszar [1993] introduced the concept of secret sharing. In their source model two terminals observe two correlated sequences. It is the objective of both terminals to form a common secret by interchanging a public message (helper data), that should contain only a negligible amount of information about the secret. Ahlswede and Csiszar showed that the maximum secret key rate that can be achieved in this way is equal to the mutual information between the two source outputs. In a biometric setting, where the sequences correspond to the enrollment and authentication data, it is crucial that the public message leaks as little information as possible about the biometric data, since compromised biometric data cannot be replaced. We investigate the fundamental trade-offs for four biometric settings. The first one is the standard (Ahlswede-Csiszar) secret generation setting, for which we determine the secret key rate - privacy leakage region. Here leakage corresponds to the mutual information between helper data and biometric enrollment sequence conditional on the secret. In the second setting the secret is not generated by the terminals but independently chosen, and transmitted using a public message. Again we determine the region of achievable rate - leakage pairs. In setting three and four we consider zero-leakage, i.e. the public message contains only a negligible amount of information about the secret and the biometric enrollment sequence. To achieve this a private key is needed which can be observed only by the terminals. We consider again both secret generation and secret transmission and determine for both cases the region of achievable secret key rate - private key rate pairs.
This paper addresses privacy leakage in biometric secrecy systems. Four settings are investigated. The first one is the standard Ahlswede-Csiszar secret-generation setting in which two terminals observe two correlated sequences. They form a common secret by interchanging a public message. This message should only contain a negligible amount of information about the secret, but here, in addition, we require it to leak as little information as possible about the biometric data. For this first case, the fundamental tradeoff between secret-key and privacy-leakage rates is determined. Also for the second setting, in which the secret is not generated but independently chosen, the fundamental secret-key versus privacy-leakage rate balance is found. Settings three and four focus on zero-leakage systems. Here the public message should only contain a negligible amount of information on both the secret and the biometric sequence. To achieve this, a private key is needed, which can only be observed by the terminals. For both the generated-secret and the chosen-secret model, the regions of achievable secret-key versus private-key rate pairs are determined. For all four settings, the fundamental balance is determined for both unconditional and conditional privacy leakage.
In the present paper, we investigate the fundamental trade-off of identification, secrecy, storage, and privacy-leakage rates in biometric identification systems for hidden or remote Gaussian sources. We introduce a technique for deriving the capacity region of these rates by converting the system to one where the data flow is in one-way direction. Also, we provide numerical calculations of three different examples for the generated-secret model. The numerical results imply that it seems hard to achieve both high secrecy and small privacy-leakage rates simultaneously. In addition, as special cases, the characterization coincides with several known results in previous studies.
In the present paper, we investigate the fundamental trade-off of identification, secret-key, storage, and privacy-leakage rates in biometric identification systems for remote or hidden Gaussian sources. We use a technique of converting the system to one where the data flow is in one-way direction to derive the capacity region of these rates. Also, we provide numerical calculations of three different examples for the system. The numerical results imply that it seems hard to achieve both high secret-key and small privacy-leakage rates simultaneously.
We consider secret key generation from a biometric source. We examine an information theoretic model where a legitimate user reads from the biometric source two times. A secret key is generated from the first output of the biometric source. From the second output of the biometric source this secret key is reconstructed. The corresponding outputs of the biometric source are modelled as jointly distributed random variables. We also assume that a helper message, generated after reading from the biometric source for the first time, is available to the legitimate user when reading from the biometric source for the second time. Additionally the helper message is assumed to be publicly available and an eavesdropper wants to learn the secret key from the helper message. We assume the biometric source is jammed before the legitimate user reads from the source for the second time. The jammer gets to know the public helper message too. Considering the secret key generation rate and the privacy leakage rate we characterize the corresponding capacity region taking into account protocols that guarantee perfect secrecy and uniform distribution of the key.