Privacy-preserving and verifiable multi-instance iris remote authentication using public auditor

Abstract

Homomorphic Encryption (HE) is the most widely explored research area to construct privacy-preserving biometric authentication systems due to its advantages over cancelable biometrics and biometric cryptosystem. However, most of the existing privacy-preserving biometric authentication systems using HE assume that the server performs computations honestly. In a malicious server setting, the server may return an arbitrary result to save the computational resources results in false accept/reject. To address this, we propose a privacy-preserving and verifiable multi-instance iris authentication using public auditor (PviaPA). Paillier HE provides confidentiality for the iris templates in PviaPA. A public auditor ensures the correctness of comparator result in PviaPA. Extensive experimental results on benchmark iris databases demonstrate that PviaPA provides privacy to the iris templates with no loss in the accuracy as well as trust on the comparator result.

Appendices

Appendix

1.1 A Preliminaries

Autoencoder Autoencoder is an unsupervised neural network method. It optimizes a rebuilding of the input data in the output layer through a hidden layer with chosen dimensions. The input, hidden, and output are the layers present in the autoencoder. The dimensions of output and input layers are the same, whereas the hidden layer contains fewer dimensions. Autoencoder consists of two phases, 1) encoder and 2) decoder. An encoder converts the input data into a hidden code, and the decoder reconstructs the original input data from the hidden code. The input and output for an autoencoder are I∈ [0, 1]^d and O∈ [0, 1]^d, where d is the number of dimensions. Firstly, the encoder maps the input into hidden (or) latent code, h∈ $[0, \ 1]^{d^{\prime }}$, $d^{\prime }$ < d using the transformation given in (10).

$$ h = S(W \times I + b) $$

(10)

Where S is a sigmoid function, W is a weight matrix, and b is the bias. The hidden code, h is then converted back into O with the same dimension as I by using the decoder. The conversion occurs through the transformation given in (11).

$$ O = S(W^{\prime} \times h + b^{\prime}) $$

(11)

Where S is a sigmoid function, $W^{\prime }$ is a weight matrix of the reverse mapping, and b is the bias. The average reconstruction error is maximized by optimizing the parameters ($W,\ b, \ b^{\prime }$). The reconstruction error can be measured by either squared error, L(I,O) = ||I − O||² or binary cross-entropy, $L(I, \ O) \ = \ - {\sum }_{k=1}^{d}[I_{k}log O_{k} + (1 - I_{k}) log(1-O_{k})]$. Similar to the state-of-the-art dimensionality reduction techniques such as linear discriminant analysis (LDA), principal component analysis (PCA), isometric mapping (ISOMAP), etc. autoencoder can be used to reduce the high-dimensional feature vector [56]. To use the autoencoder as a dimensionality reduction technique, use the data obtained in hidden layer and discard the decoder phase.

B Algorithms to generate encrypted verification vector and check the correctness of Manhattan distance

1.1 B.1 Generation of encrypted verification vector

The TA implements the Algorithm 3 after the enrollment phase. The verification vector denoted as Z_n+ 1 is initialized to (1, 1, ..., 1). Z_n+ 1 and X_i are of same dimensions. Encrypt Z_n+ 1 using the public key P_k. The function randomInteger() generates a random value v_i. Encrypt v_i using the public key P_k. The random value generated in each and every iteration is encrypted with different public keys. The keys used to encrypt v_i are completely different from the keys used to encrypt iris templates. multiply function is used to achieve the property 1 of Paillier discussed in Section 3.3. The function multiply is called to perform the multiplication between j^th value of ε(X_i) and ε(v_i), where i varies from 1 to N. ε(tmp) stores the multiplication result. The function multiply is called to perform the multiplication between ε(Z_n+ 1) and ε(tmp). After the completion of m iterations, ε(Z_n+ 1) which is shown in (8) is obtained. The N random values are assigned to ε(V ). The TA sends ε(Z_n+ 1) and ε(V ) to the PA after all the users are enrolled.

B.2 Ensuring the correctness of Manhattan distance

The steps (4-8) of Algorithm 4 computes $\varepsilon (D1) = {\prod }_{j=1}^{m}(\varepsilon (Z_{n+1}[j]) \cdot \varepsilon (Y[j]))$. The steps (11-15) of Algorithm 4 computes $\varepsilon (D2)={\prod }_{i=1}^{N}(\varepsilon (r_{i}) \cdot \varepsilon (v_{i}))$. The PA decrypt ε(D1) and ε(D2). Finally, compute ε(D1) − ε(D2) and send the result to TA. If the result is zero, the Manhattan distances ε(R) returned by the CS are considered to be correct. So, the TA finds the value with index id given by the end-user. The value is compared with a threshold, τ to determine whether the user is valid or not.