IBM Research MultiBiometric Integration Privacy Ruud Bolle Nalini

IBM Research Outline § § § Traditional Authentication Biometric Authentication Multibiometric Authentication Biometrics & Privacy Concerns (Multi)biometrics is pro-privacy Conclusions Exploratory Computer Vision Group © IBM Corporation

IBM Research Existing Authentication • Insecure (uses “surrogate” representations of identification). • Inconvenient (the identification means can be lost, stolen, shared). Exploratory Computer Vision Group © IBM Corporation

IBM Research Biometric Authentication I am who I say I am • Authentication based on distinctive traits • Cannot be lost, forged, shared, stolen. Match Yes/No • Reliable method of person identification 1: 1 match Problems ID/ Name Biometric database Central/distributed Exploratory Computer Vision Group • Limited Accuracy • False reject rates • Failure to acquire • Failure to enroll • “Privacy” issues © IBM Corporation

IBM Research Need for Multi-Biometric Integration § Large scale deployment (e. g. , US-VISIT program) of biometrics authentication and identification cannot rely on a single biometrics because a single biometrics has a number of limitations, e. g. , § Accuracy: poor accuracy of individual biometrics can be improved by combining it with other weak biometrics. § Acceptability: some biometrics are not acceptable within some. applications and target populations. § Availability: some biometrics are not available because of application domains or all individuals within population. § Security: More difficult to spoof or sabotage. § Smart Integration of multiple biometrics provides a way to overcome the above limitations and make biometric deployments feasible. Exploratory Computer Vision Group © IBM Corporation

IBM Research Different Modes of Integration © Bolle et al. , Springer 2004 Exploratory Computer Vision Group © IBM Corporation

IBM Research Architectures for Multi Biometrics Integration § Integration of multiple biometrics can be achieved in different ways. § Loosely-coupled integration - each biometrics is independent of the others: . § Score level – Each biometric provides its matching “score” (e. g. , between 0 and 100) and the integration scheme provides overall decision. § Decision level – Each biometric provides its matching decision (e. g. , yes/no) and the integration scheme provides overall decision. More general Exploratory Computer Vision Group © IBM Corporation

IBM Research Typical Multibiometric Architecture Exploratory Computer Vision Group © IBM Corporation

IBM Research Conventional Face/Finger Integration Example (Hong & Jain, 1998). Exploratory Computer Vision Group © IBM Corporation

IBM Research Biometrics & Privacy: Anonymity § Claim: Only biometrics can permit “negative” identification § Enables searches in database and can break anonymity § Response: § System architecture can be designed to prevent/restrict search scope – Prevention: Cancelable biometrics – Restrict: Smart Card-based authentication. § Multibiometrics: § Same techniques can be used for protecting anonymity in multi-biometrics scenario Exploratory Computer Vision Group © IBM Corporation

IBM Research Cancelable Biometrics Enrollment Authentication Exploratory Computer Vision Group © IBM Corporation

IBM Research Smart Card Matcher Enrollment Matcher Yes/No Authentication Exploratory Computer Vision Group © IBM Corporation

IBM Research Biometrics & Privacy: false positives § Claim: Inaccurate biometric performance can cause inconvenience § Harassment of innocent subjects § Response: § System process can be designed to minimize user inconvenience – Exception processing – Compare it with completely manual system. § Multibiometrics: § By offering increased accuracy performance, fewer false positives need human “manual” processing Exploratory Computer Vision Group © IBM Corporation

IBM Research Biometrics & Privacy: false negatives § Claim: Inaccurate biometric performance can cause security lapses § “wanted” people can escape biometric scrutiny § Response: § System process can be designed to minimize security breaches – Deterrence effect – Compare it with manual system. – Post-event investigation can provide more evidence § Multibiometrics: § By offering increased accuracy performance, fewer false negatives result. § Higher deterrence to undesirable elements Exploratory Computer Vision Group © IBM Corporation

IBM Research Biometrics & Privacy: Theft § Claim: biometric information once lost can cause irreproducible damage § Response: § System architecture can provide judicious solutions – Template theft: Impact of template theft is negligible in “cancelable” systems – Spoofing: Multibiometrics can help (see below) § Multibiometrics: . § It becomes more and more difficult for the attackers to operationally replicate multiple biometric identifiers – Its more difficult to offer finger and voice identifier than only finger identifier. – Cannot wear masks to airport!! – Multibiometrics can be further combined with other conventional methods of identification (e. g. , knowledge or possession) Exploratory Computer Vision Group © IBM Corporation

IBM Research (Multi)Biometrics & Privacy: functional creep § Claim: biometric information be abused for unforeseen functions § Biometrics may be acquired for the express purpose of identification § Some biometrics can reveal medical information and can therefore be potentially abused for acquiring other information about the individual § Response: § System architecture can provide judicious solutions. – Using smart card matcher architecture can minimize the risk of extraction of proscribed information § Multibiometrics: – By providing choice of biometrics, users can offer biometric identifiers that minimally expose them to risks of “data mining”. Exploratory Computer Vision Group © IBM Corporation

IBM Research (Multi)Biometrics is “objective” § Claim: Biometric information offers an objective way of § Support: § Manual system – Human attention (and trained expert attention) is affected by many uncontrollable factors such as physical/emotional states – Human triggers may include various extraneous factors including social and cultural biases – Monotonous tasks are even more notorious for attention drop-off times. (NIJ study) – Difficult to record the entire process § Automatic (biometric) system – (imperfect) system decisions are uniformly applied to comply with the letter of law: no Caesar's wife syndrome – System decision can be logged, objectively scrutinized, and studied. – Access to system decisions can be controlled and logged – Fewer people pass through subjective human scrutiny § Multibiometrics: By offering higher performance even fewer people pass through subjective human scrutiny. Exploratory Computer Vision Group © IBM Corporation

IBM Research Multi-Biometrics is “Pro-Choice” § Claim: By offering of choice of biometrics can expand the scope of system. § Support: – Acceptability: different biometric identifiers may be unacceptable in different social/cultural settings. – Universality: different cross-sections of user population may be unable to offer a specific single biometrics because of the existing state of that. specific biometric acquisition and matcher technology. – Segmentation choice: By offering users choice of biometrics, the users can decide how they want to delink different applications to minimize linkage risks Exploratory Computer Vision Group © IBM Corporation

IBM Research (Multi)Biometrics is privacy friendly § Claim: Personally sensitive information can be better protected using biometrics § Support: – Identity theft is becoming easier and more pervasive with advancement of technology – Biometric means of access to personally sensitive information offers better resistance against its theft. and misuse – Biometric means of access also offer better protection against nonrepudiation and collusion attacks – We already see more and more government regulations requiring biometric access control to personally sensitive information (HIPAA). Exploratory Computer Vision Group © IBM Corporation

IBM Research Summary § Conventional means of identification have proven to be unreliable. § Single biometrics systems have inherent limitations § Fusing multiple biometric systems is expected to provide inherently better performance § Multibiometrics systems have been primarily studied in academic settings § More studies and research needs to be undertaken in regards to § More robust methods of multibiometric integration § Architectures for multibiometric integration § Business processes for multibiometric integration § Cost is an issue. § Caution must be exerted to implement multibiometric systems to obtain maximum benefits and to avoid its abuse. § Multibiometrics may be the reality that we have to live with given the situations of increasing incidences of (identity thefts + security threats) and pressure to minimize the costs. Exploratory Computer Vision Group © IBM Corporation

IBM Research References § R. M. Bolle, J. H. Connell, S. Pankanti, A. Senior, N. K. Ratha, § § Guide to Biometrics, Springer Verlag, 2003. A. Jain, R. M. Bolle, S. Pankanti (eds), Biometrics: Personal Identification in Networked Society, Kluwer, 1999. N. K. Ratha and R. M. Bolle, Automatic Fingerprint Recognition Systems, Springer Verlag, 2003. Enhancing security and privacy in biometrics-based authentication systems N. Ratha, J. Connell, R. Bolle IBM Systems Journal, vol. 40, no. 3, 2001, pp. 614 -634. L. Hong, A. Jain, S. Pankanti, “Can Multibiometrics improve performance? ” IEEE Auto. ID Conference, New Jersey, 1999. Exploratory Computer Vision Group © IBM Corporation