STTR Phase I: Improving Privacy and Security in Biometrics

This Small Business Technology Transfer (STTR) Phase I research project investigates novel technological approaches with strong theoretical backing, which improve privacy and security in biometrics. This proposal develops secure robust revocable biometric transforms, applicable across a range of biometrics to produce tokens that can be used for identify/verification/identification, but which protect user privacy. In particular, they support pseudo-nimiety, they cannot be matched across different applications/databases, and they can be revoked if they are compromised. The most private form of the transform allows a biometric-based verification, without the ability to do recognition or search, addressing another major privacy issue. The approach transforms the original signature into a revocable form that protects privacy while it supports a robust distance metric supporting the approximate matching required for effective biometrics. The robust distance metric, computed on the encoded form, has been proven to not decrease accuracy, but to potentially increase accuracy. Previous work on privacy and biometric has traded accuracy for privacy; preliminary testing on the proposed approach improved performance. The broader impact of this proposal is on society in terms of privacy. This proposal represents an emerging opportunity in the unique space of privacy-oriented research applied to the rapidly growing space of biometrics. It addresses the most privacy invasive identification technologies including fingerprints and DNA. While applications to DNA are important from a long-term privacy view, fingerprints are more important for near-term commercial and social impact because of expected growth from programs such as e-passports/visas, HSPD-12 and the de-facto national ID cards required by the Real-ID act as well as commercial applications such as Pay-By-Touch and BioPay. The proposal addresses critical questions regarding privacy and security for identity verification. The proposed technique provides public-key cryptographic security of the identity; supports matching encoded from, cannot be linked across different databases and is revocable. Our identity solution, technologically, stops most of the potential forms of abuse that raises privacy concerns, while providing a significant value to financial solutions and the potential for improved security to the nation.