Design of alignment-free cancelable fingerprint ... - Semantic Scholar

Pattern Recognition ∎ (∎∎∎∎) ∎∎∎–∎∎∎

Contents lists available at ScienceDirect

Pattern Recognition journal homepage: www.elsevier.com/locate/pr

Design of alignment-free cancelable fingerprint templates via curtailed circular convolution Song Wang a,1, Jiankun Hu b,n a

School of Engineering and Mathematical Sciences, La Trobe University, VIC 3086, Australia School of Engineering and Information Technology, University of New South Wales at the Australian Defence Force Academy (UNSW@ADFA), Canberra, ACT 2600, Australia

b

art ic l e i nf o

a b s t r a c t

Article history: Received 24 August 2012 Received in revised form 15 July 2013 Accepted 2 October 2013

Fraudulent use of stolen fingerprint data and privacy invasion by tracking individuals unlawfully with shared or stolen fingerprint data justify the significance of fingerprint template protection. With no a priori fingerprint image registration, alignment-free cancelable fingerprint templates do not suffer from inaccurate singular point detection. In this paper, we propose an effective alignment-free method for constructing cancelable fingerprint templates via curtailed circular convolution. The proposed method features an efficient one-way transform, which protects the input binary string such that it cannot be retrieved from the length-reduced, convolved output vector. The transformed template fulfills the requirements of non-invertibility, revocability and diversity for cancelable fingerprint templates. Evaluation of the proposed scheme over FVC2002 DB1, DB2 and DB3 shows that the new method demonstrates satisfactory performance compared to the existing alignment-free cancelable template schemes. & 2013 Elsevier Ltd. All rights reserved.

Keywords: Cancelable templates Alignment-free One-way transform Circular convolution Security

1. Introduction With a long history in forensic and criminal investigations, it is well recognized that fingerprints are the most widely used biometric identifiers. Driven by advances in fingerprint sensing and rapid developments in areas such as image processing and pattern recognition, fingerprint-based biometric systems have ushered in an era of extensive applications in commercial, civilian and financial domains. Fingerprint authentication has been widely deployed in small- and large-scale systems for access control or personal identification. Due to the intrinsic bond between one's identity and his/her fingerprint and the characteristics of permanence and uniqueness of one's fingerprint, privacy and security concerns arise in the use of fingerprint-based biometric systems. Unlike a compromised token or password, compromised fingerprint data cannot be replaced or reissued. A fingerprint template, if compromised, may leak fingerprint features that can be used to reconstruct a fingerprint image. For example, Cappelli et al. [1] reconstructed a fingerprint image based on a standard template. Feng and Jain [2] developed a method to reconstruct a whole grayscale fingerprint image through the phase image. Wang and Hu [3] proposed a n

Corresponding author. Tel.: þ 61 2 6268 8186; fax: þ 61 2 6268 8581. E-mail addresses: [email protected] (S. Wang), [email protected] (J. Hu). 1 Tel.: þ61 3 9479 3744; fax: þ 61 3 9471 0524.

scheme for reconstructing a full fingerprint from a partial fingerprint. Fraudulent use of stolen fingerprint data and privacy invasion by tracking individuals unlawfully with shared or stolen data make fingerprint template protection absolutely vital. The idea of cancelable biometrics was initiated by Ratha et al. [4,5]. Cancelable biometrics consist of intentional, repeatable distortions of biometric signals based on transforms that are non-invertible. Cancelable biometrics, also referred to as feature transformations, constitute an important biometric template protection scheme [6]. The well-known work of Ratha et al. [7] is representative of generating cancelable fingerprint templates, in which three noninvertible transformations (cartesian, polar and surface folding) are proposed to transform fingerprint minutiae. Considering the large variability and uncertainty in fingerprint images, the main challenge in designing cancelable fingerprint templates is to capture discriminatory information while coping with elastic deformation in fingerprint acquisition. Cancelable fingerprint templates are required to possess three properties: pre-image resistance (also known as non-invertibility), revocability and diversity [8]. Non-invertibility implies that it is infeasible or computationally hard to recover original fingerprint features from a transformed, protected template. Revocability ensures that if a stored template is compromised, it can be revoked and a new template can be issued. Diversity allows the generation of different transformed templates from the same fingerprint data, thus preserving users' privacy across different applications.

0031-3203/$ - see front matter & 2013 Elsevier Ltd. All rights reserved. http://dx.doi.org/10.1016/j.patcog.2013.10.003

Please cite this article as: S. Wang, J. Hu, Design of alignment-free cancelable fingerprint templates via curtailed circular convolution, Pattern Recognition (2013), http://dx.doi.org/10.1016/j.patcog.2013.10.003i

S. Wang, J. Hu / Pattern Recognition ∎ (∎∎∎∎) ∎∎∎–∎∎∎

2

At the heart of cancelable fingerprint templates is the design of an irreversible transformation. In this paper, we approach such a one-way transform from a fundamental digital signal processing (DSP) perspective. Specifically, our cancelable fingerprint template is built upon the binary bit-string which is generated from quantizing and bin-indexing pair-minutiae vectors. The binary string is treated as a finite-duration input sequence to a linear time-invariant (LTI) system whose impulse response is another finite-duration sequence, controlled by the user-specific key. Recall that conventional system identification (e.g., [9]) and blind channel estimation (e.g., [10,11]) necessitate invertibility and that in blind channel identification, it is required to have enough samples in the received signal so that source symbols are identifiable. Motivated by this, instead of convolving the above-mentioned two finite-duration sequences to get the system output as in normal convolution operation, we apply the curtailed circular convolution to reduce the data record in the output sequence. Because the output cannot be restored to full length, the input binary string is protected in the sense that it cannot be recovered from the lengthreduced output sequence. The shortened, convolved output vector, as a result of the curtailed circular convolution, is taken as the transformed template, which turns out to meet the requirements of non-invertibility, revocability and diversity for cancelable fingerprint templates. Alignment-free, efficient one-way transform and satisfactory performance are the highlighted strengths of the proposed cancelable fingerprint template design. First, we construct transformed templates based on pair-minutiae vectors and thus relinquish the process of registering fingerprint images with respect to singular points (core and delta). Therefore, our alignment-free cancelable template design overcomes the difficulty of singular point detection. Second, the proposed one-way transform is accomplished by the curtailed circular convolution and realized by multiplying the Discrete Fourier Transform (DFT) of two sequences. It is well known that the DFT can be computed efficiently by exploiting fast Fourier Transform (FFT) algorithms. Third, the proposed method demonstrates good matching performance evaluated over three databases (DB1, DB2 and DB3) of FVC2002 [12]. Performance comparison between the new scheme and some existing methods is detailed in Section 4. The rest of the paper is organized as follows. Section 2 presents related research on registration-free (or alignment-free) cancelable fingerprint templates. Section 3 describes the development of alignment-free cancelable templates through the curtailed circular convolution and qualitatively compares the proposed method with some existing alignment-free cancelable template design. Section 4 demonstrates and analyzes experimental results as well as discusses the security of the proposed method. The conclusion and future work is given in Section 5.

2. Related work Generating cancelable fingerprint templates mainly involves registration-based and registration-free methods. Registrationbased methods entail accurate detection of singular points, which is hard to achieve in noisy and rotated fingerprint images [13]. A registration error is likely to result in a matching error. Moreover, it is difficult to define the core point in arch and tented-arch fingerprint patterns. Thus, the accuracy of registration-based methods is limited by these issues. Numerous registration-based cancelable fingerprint template protection schemes can be found in the literature, see e.g., [14–17]. With no a priori alignment, registration-free methods exploit local minutia information and make use of relative features between minutiae, e.g., the distance between a pair of minutiae.

It is known that the relative relationship between minutiae is rotation- and shift-invariant to any coordinate transform. With the benefit brought by registration-free fingerprint template protection, in the following we briefly review some existing alignmentfree methods. Chikkerur et al. [18] proposed a registration-free algorithm for cancelable fingerprint templates based on localized, self-aligned texture features. A two factor key, formulated by two orthogonal matrices, was designed for the projection matrix. Although several modes of attack were presented in [18], the paper did not discuss how the proposed algorithm handles the loss of both the template and the two factor key (both orthogonal matrices). Lee et al. [19] developed an alignment-free fingerprint cancelable template approach by generating invariant values, which are calculated using the orientations of neighboring regions around each minutia. Two changing functions are provided to decide the amount of transformation around each minutia. The stored templates can be revoked and regenerated by replacing the changing functions. Because the invariant values are extracted from the orientation information around each minutia, the method in [19] is affected by the quality of fingerprint images. If the image quality is poor, the performance of the method decreases. With no assumption on pre-alignment, Tulyakov et al. [20] derived a family of symmetric hash functions to secure fingerprint templates. The hash functions are built based on minutiae locations, taking into account accidental shifting of minutiae points in fingerprint scanning. The developed fingerprint hashes are cancelable and demonstrate reasonable performance. However, the weights incorporated in the error functions are empirically set, which may not adapt to real applications. Yang and Busch [21] developed a geometric alignment method for fingerprint template protection, which achieves self-alignment based on minutia vicinity instead of using the reference point (the core) for pre-alignment. To obtain diversification and obscure the topology of minutiae points, parameterized coordinate offsetting is added to each self-aligned minutiae group. The final protected minutia vicinity is formed by superimposing all self-aligned minutiae groups. The proposed method in [21] shows good EER (Equal Error Rate) results. Unfortunately, there is no discussion about how to revoke and replace a compromised template. Farooq et al. [22] introduced a triangle-based alignment-free method to build cancelable fingerprint templates in the form of bit strings. In this method, a triangle is formed by any set of three minutiae. Three sides of the triangle, three angles of minutiae orientation and the height of the longest triangle side constitute seven invariants. Through quantization and bin shuffling, a bitstring cancelable template is produced. The method in [22] incurs a high computational cost due to the calculation of invariants from all possible minutia triplet combinations. Comparisons between this registration-free method and the registration-based method in [7] are given in [23]. Jin et al. [24–26] and Lee and Kim [27] also developed alignment-free cancelable fingerprint templates in the form of bit strings. In [24] and [25], invariant features are first extracted from minutiae pairs, then quantized and bin indexed to generate a bit string. In [27], a three-dimensional array is defined, and each minutia is selected in turn as the reference point, according to which other minutiae are transformed and rotated. Transformed minutiae are then mapped into the 3D array so that a bit string is generated. In [26] a cancelable bit-string template is constructed from fingerprint minutiae using polar grid based 3-tuple quantization. In [24–27], the resultant bit string is permuted with a userspecific token. However, the permutation matrix is invertible, and if it is hacked, quantized minutiae positions would be exposed. Ahmad et al. [28] designed registration-free cancelable fingerprint templates in a polar coordinate space. Motivated by polar

Please cite this article as: S. Wang, J. Hu, Design of alignment-free cancelable fingerprint templates via curtailed circular convolution, Pattern Recognition (2013), http://dx.doi.org/10.1016/j.patcog.2013.10.003i

S. Wang, J. Hu / Pattern Recognition ∎ (∎∎∎∎) ∎∎∎–∎∎∎

transformation in [7], the authors explored relative locations of minutiae between one another in a pair-polar coordinate system. The proposed method [28] has acceptable performance over FVC2002 DB2 but poor performance over FVC2002 DB3, in which fingerprint images are of low quality. Das et al. [29] presented an alignment-free fingerprint hashing algorithm based on minimum distance graphs (MDG). The MDG is composed of a set of connected nodes formed by computing the distance between the core and the next nearest minutia and then the distance between the next closest minutia and its predecessor and so on. The MDG hash is further extended to a cancelable template. Although the proposed algorithm has a good security strength against brute force attack, it relies on accurate detection of the core point. Wang and Hu [30] proposed to design alignment-free cancelable fingerprint templates using pair-minutiae vectors through infinite-to-one mapping. The generated template takes the form of a finite-length, complex-valued vector. Protection of quantized minutiae vectors is accomplished by hiding the true solution among infinitely many alternative solutions. The proposed method achieves much better matching accuracy over FVC2002 DB3 than [28]. However, the matrix used for storing the user-specific key has a large size, which takes up considerable memory storage.

3. Alignment-free cancelable fingerprint template design based on curtailed circular convolution This section is devoted to the development of alignment-free cancelable fingerprint templates via curtailed circular convolution. We first illustrate a fundamental transform analysis of LTI (linear time-invariant) systems from a DSP perspective and then use this analysis as the prelude to the core transformation in the design of cancelable templates. Suppose that we have an arbitrary finite-

duration sequence frðnÞg of length ζ. This sequence is applied as an input signal to excite an LTI system whose finite impulse response is represented by h(n), n ¼ 0; 1; …; η  1 . It is well known [31] that the output signal s(n) of the system is yielded by convolving the input signal with the impulse response h(n), i.e., η1

sðnÞ ¼ rðnÞnhðnÞ ¼ ∑ rðn  kÞhðkÞ

ð1Þ

k¼0

where the asterisk denotes the convolution operation. Since frðnÞg and fhðnÞg are finite-duration sequences, the output signal s(n) is also finite in duration with length ζ þ η  1. The realization of (1) in practical LTI systems is through computing the product of the ðζ þ η  1Þ  point DFTs of r(n) and h(n). This is equivalent to the circular convolution of r(n) and h(n) with extended length. It is worth noting that the received signal of each block of a communication system containing guard intervals satisfies (1) in signal format [32]. It has been proved [32] that to recover the source signal r(n), the received signal needs to accumulate a minimum of two blocks. In other words, if the number of available samples in the received signal is insufficient, then the source symbols cannot be identified. This characteristic in blind channel estimation is analogous to the property of non-invertibility of cancelable templates. It motivates us to investigate whether the original input can be retrieved from the output if the circular convolution which can be used to implement (1) is performed in a suppressed fashion. In the following section (Section 3.1), we first present how to form pair-minutiae vectors and use them to generate a binary string. Treating the binary string as a finite-length sequence, we go on to develop the non-invertible transformation in the lead-up to cancelable fingerprint templates.

3

3.1. Cancelable template generation Due to various physical factors in fingerprint acquisition, fingerprint images involve large variations, leading to small inter-class variability and large intra-class variability in fingerprint patterns [8]. Nevertheless, local minutiae structures tend to be robust to nonlinear distortion and are invariant to fingerprint image rotation and translation. By exploiting this invariance property, we relinquish the process of fingerprint registration, thus making the proposed transform repeatable without prealigning minutiae positions to the singular points. Suppose that minutiae points are extracted from an input fingerprint image. The minutia set is denoted by M ¼ fM k ðxk ; yk ; θk Þgk ¼ 1 m

ð2Þ

where m is the number of minutiae, xk, yk and θk are the x, y coordinates and orientation of the kth minutia, respectively. Minutiae pairing is a straightforward way of exploiting local minutia information, which was described in [24,25] and applied in a slightly modified manner in our recent work [30]. Below we briefly describe the construction of pair-minutiae vectors. Connecting a pair of minutiae by a straight line, the length of this line segment and two angles respectively formed by the orientation of each minutia with the connecting line compose a pair-minutiae vector. To make the angle definition for Vij unambiguous, we assume that the reference direction of the line segment connecting the minutiae pair is from M i ðxi ; yi ; θi Þ to M j ðxj ; yj ; θj Þ. Let Vij represent the pair-minutiae vector formed by pairing up minutiae M i ðxi ; yi ; θi Þ and M j ðxj ; yj ; θj Þ in the set M. Vij is expressed as V ij ¼ ðlij ; αi ; βj Þ

ð3Þ

where lij denotes the distance between the minutiae pair M i ðxi ; yi ; θi Þ and M j ðxj ; yj ; θj Þ, αi is the angle formed in the counter-clockwise direction between the line connecting the pair

βj is defined in a similar way. The range of αi and βj is between 0 and 2π . The three components lij, αi and βj of Vij are illustrated in Fig. 1.

and the orientation of M i ðxi ; yi ; θi Þ, and

We calculate the following two quantities X ij and Y ij to determine V ij ¼ ðlij ; αi ; βj Þ: " # " #" # xj  xi X ij cos θi  sin θi ¼  ðyj yi Þ Y ij sin θi cos θi Hence, qffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffi lij ¼ X 2ij þY 2ij

αi ¼ arctan

Y ij X ij

β j ¼ αi þ θ j  θ i

ð4Þ

Given that the number of minutiae in the set M [see (2)] is m, there will be ðmðm  1Þ=2Þ pair-minutiae vectors, constituting the

Fig. 1. The triplet ðlij ; αi ; βj Þ formed by minutiae pair ðM i ; M j Þ.

Please cite this article as: S. Wang, J. Hu, Design of alignment-free cancelable fingerprint templates via curtailed circular convolution, Pattern Recognition (2013), http://dx.doi.org/10.1016/j.patcog.2013.10.003i

S. Wang, J. Hu / Pattern Recognition ∎ (∎∎∎∎) ∎∎∎–∎∎∎

4

set V as follows: V ¼ fV ij : 1 r i; jr m and i a jg

ð5Þ

Since the pair-minutiae vector set V contains original fingerprint data, to protect this information, we quantize each Vij in V using a similar procedure in [25]. Another purpose of quantization is to reduce the effect of distortion during fingerprint acquisition.

A stepsize is judiciously selected to quantize each term of ðlij , αi, βj Þ. Let nlij , nαi and nβj be the bit length of the binary representation of the quantized lij, αi and βj, respectively. Then the total number of bits required for quantizing the set V is N ¼ nlij þ nαi þ nβj

ð6Þ

Therefore, each pair-minutiae vector Vij in V [see (5)] has its N corresponding N-bit binary notation V ðbÞ ij . N bits can represent 2

binary values, which correspond to 2N binary bins with the first bin made up of N zeros and the last bin N ones. We inspect each ðbÞ V ðbÞ ij and index a bin by one if V ij falls in it. It is possible that some

bins are indexed multiple times. However, only the bins indexed once are assigned the value of 1 and all other bins the value of 0. At the end of this binarization process, we obtain a binary string fbn ; n ¼ 0; 1; …; 2N  1g, in which 1 s correspond to the unique occurrence of those V ðbÞ ij .

N

fbn ; n ¼ 0; 1; …; 2  1g is compromised, those binary representathat appear once would be revealed, which would tions V ðbÞ ij further disclose the corresponding Vij. Therefore, it is critical to secure the binary string fbn ; n ¼ 0; 1; …; 2N  1g by transforming it irreversibly. If we treat the binary string fbn g as a finite-duration sequence of length 2N and convolve it with another finite-duration sequence fμn g, chosen at random, of length p with p o 2 , then according to N

(1), the resultant sequence would have length 2N þ p  1 and can be obtained through the circular convolution with extended length, that is, a length of least 2N þ p  1 points. But such an “augmented” circular convolution does not help to protect the binary string fbn ; n ¼ 0; 1; …; 2N  1g because with the knowledge of the resultant sequence (after the circular convolution) and the sequence fμn ; n ¼ 0; 1; …; p  1g, the binary string fbn ; n ¼ 0; 1; …; 2N  1g can be reverse engineered. We note that the problem here lies with the size of the circular convolution. The above observation prompts us to realize that if the circular convolution can be “curtailed”, then the output sequence obtained would be insufficient to be used to deduce the original input, namely, the binary string fbn ; n ¼ 0; 1; …; 2N 1g. This is analogous to the situation in blind channel estimation where the source signal can never be identified if there are inadequate samples in the received signal. We show below how to apply the curtailed circular convolution to construct cancelable fingerprint templates. In the meantime a one-way transform is designed. Based on the above analysis, instead of taking the ð2N þp  1Þ-point circular convolution of fbn g and fμn g, we take the L-point circular convolution of these two sequences, where L ¼ 2N . This circular convolution yields another sequence fϕn g of

ϕn ¼ bn Ⓛμn

ϕn, n ¼ 0; 1; …; L  1, is obtained by

ð7Þ

where Ⓛ denotes the L-point circular convolution. Alternatively,

ð8Þ

where Cb is the L  L circulant matrix, μ is the L  1 vector formed by padding the sequence fμn ; n ¼ 0; 1; …; p  1g with zeros, and ϕ is the L  1 vector representing the sequence fϕn g, namely,

ϕ ¼ ½ϕ0 ϕ1 ⋯ ϕL  1 T

ð9Þ

The L-point circular convolution of the sequences fbn g and fμn g in (7) and (8) in the time domain is equivalent to the multiplication of the L-point DFTs of the two sequences in the frequency domain. The frequency-domain approach is computationally more efficient [31] than time-domain convolution due to the existence of powerful FFT techniques. So we calculate the frequency-domain sequence fΦk ; k ¼ 0; 1; …; L 1g, which is the DFT of fϕn g, by multiplying the DFTs of fbn g and fμn g, i.e.,

Φk ¼ Bk U k ;

k ¼ 0; 1; …; L  1

ð10Þ

where Bk and Uk denote the L-point DFTs of bn and μn, respectively. Bk and Uk are given by L1

The binary string fbn ; n ¼ 0; 1; …; 2N  1g is vulnerable in that it may be used to access the associated biometric system [26] if it is acquired by an attacker. In addition, if the binary string

length L. So

Eq. (7) can be written in the matrix form as follows: 2 3 bL  1 bL  2 ⋯ b2 b1 b0 6 b b0 bL  1 ⋯ b3 b2 7 6 1 7 6 7 6 7μ ⋱ ϕ ¼ Cb μ ¼ 6 7 6b 7 b ⋯ ⋯ b b 4 L2 L3 0 L1 5 bL  1 bL  2 ⋯ ⋯ b1 b0

Bk ¼ ∑ bn e  j2π kn=L ; n¼0

k ¼ 0; 1; …; L  1

L1

p1

n¼0

n¼0

U k ¼ ∑ μn e  j2π kn=L ¼ ∑ μn e  j2π kn=L ;

k ¼ 0; 1; …; L  1

Then we take the L-point inverse Discrete Fourier Transform (IDFT) of Φk to get ϕn. Since the first p 1 points of fϕn ; n ¼ 0; 1; …; L 1g are corrupted by aliasing [31] and need to be discarded, the last L  p þ 1 points are kept and stored in the vector ψ . Thus,

ψ ¼ ½ϕp  1 ϕp ⋯ ϕL  1 T

ð11Þ

The vector ψ is a cut-down version of the vector ϕ in (9) or the sequence fϕn ; n ¼ 0; 1; …; L  1g. In conclusion, rather than going through the normal convolution as in (1), the vector ψ is attained by curtailing the circular convolution, including removal of some samples from fϕn g. The vector ψ is of length L  p þ 1, compared to the length L þp  1 of the output sequence of what would be acquired from (1). The curtailed circular convolution basically achieves the effect of dimension reduction in that the transformed template ψ has a lower dimension than both the binary string fbn g and the output sequence of what would otherwise be produced by (1). Because of the short data record in the vector ψ , the binary string fbn g cannot be retrieved from it. This holds true even when both ψ and the sequence fμn ; n ¼ 0; 1; …; p  1g are stolen by an adversary (see more analysis in Section 4.3). Therefore, the vector ψ secures the binary string fbn g and can be taken as the cancelable template. Remarks. 1. The sequence fμn g of length p plays the role of parameter key and is user-specific. By generating a different fμn g randomly, a compromised template ψ can be revoked and a new one can be issued. 2. To protect the binary string fbn g, we have transformed it by first computing Φk in (10), k ¼ 0; 1; …; L  1, as the product of the DFTs of fbn g and fμn g, then taking the IDFT of Φk to get the sequence fϕn ; n ¼ 0; 1; …; L  1g, and finally deleting the first p  1 elements of fϕn g to obtain the vector ψ in (11). Such a transformation is non-invertible since the binary string fbn g of

Please cite this article as: S. Wang, J. Hu, Design of alignment-free cancelable fingerprint templates via curtailed circular convolution, Pattern Recognition (2013), http://dx.doi.org/10.1016/j.patcog.2013.10.003i

S. Wang, J. Hu / Pattern Recognition ∎ (∎∎∎∎) ∎∎∎–∎∎∎

length L cannot be recovered from the transformed template ψ of length L  p þ 1 even in the circumstance of lost keys (more analysis in Section 4.3).

5

the security of ψ is enhanced as it becomes even harder to recover fbn g.

3.3. Fingerprint matching in the transformed domain 3.2. Algorithm description and discussion We summarize the proposed algorithm as follows. Step 1 Compute pair-minutiae vectors Vij defined in (3) according to (4) and establish the set V in (5). Step 2 Determine the total bit length N in (6) and quantize each pair-minutiae vector Vij in V such that its binary representation V ijðbÞ is obtained. Step 3 Index and binarize all 2N bins to produce the binary string fbn g of length L ¼ 2N . This process follows the same rule as in [25]. Step 4 Use (10) to determine Φk, k ¼ 0; 1; …; L  1. Step 5 Take the IDFT of Φk to get the sequence fϕn ; n ¼ 0; 1; …; L  1g. Step 6 Remove the first p  1 samples of fϕn g to form the cancelable template ψ in (11). To highlight the features of the proposed cancelable template design and compare it with some existing methods, we make the following comments:

1. Mapping pair-minutiae vectors to a binary string was designed in [24]. We choose to build a cancelable template upon the binary string because the binary string development not only tackles intra- and inter-class variability to some extent, but also enables a batch operation on all minutiae. This is an improvement over the existing work of [26–28], where fingerprint matching is carried out on a minutia-by-minutia basis. Clearly, batch processing improves efficiency in fingerprint matching. 2. The computational cost of the proposed method is low in the sense that the main operation involved is the DFT/IDFT. Given that the length of the DFT/IDFT is 2N, computationally efficient FFT algorithms [33] such as radix-2 algorithms can be applied to expedite the DFT/IDFT computation. 3. Although the cancelable templates designed in the proposed method and [30] are both built on the binary string, the proposed method takes a completely different approach in the treatment of the binary string. Specifically, the new method applies the curtailed circular convolution to cut back the data record in the cancelable template such that the binary string is transformed irreversibly. By contrast, an infinite-to-one mapping was established in [30]. 4. The user-specific key or token used in the proposed method is the sequence fμn ; n ¼ 0; 1; …; p  1g. In comparison with some existing schemes (e.g., [25,27,30]), where user-specific keys or tokens are large matrices, the size of the key in our method is moderate. It requires little memory space to store the key, thus making the proposed method suitable for application to smartcards and mobile phones. 5. The length of the key fμn g affects the matching performance of the proposed algorithm. Specifically, a long key with a larger p degrades matching accuracy, as can be seen from the ROC curve in Section 4.1. The reason is that when μn and bn are circularly convolved, the sequence fμn g of longer duration causes a more aliased portion in fϕn g, which must be removed, resulting in a shorter vector ψ (transformed template). Relatively speaking, this lessens the impact of the binary string fbn g on ψ . But on the other hand, when more samples are removed from fϕn g,

We now turn to the matter of fingerprint matching, which compares a query fingerprint with the stored template of an enrolled fingerprint and returns a verdict. To protect the secrecy of original fingerprint biometrics, fingerprint matching in the proposed method is performed in the transformed domain. Let M ðQ Þ be the minutia set for a query fingerprint. We define l

Þ ðxk ; yk ; θk Þgk ¼ 1 , where all quantities involved are M ðQ Þ ¼ fM ðQ k defined analogously to (2). Note that the query fingerprint has l minutiae, which might not equal the number of minutiae of the stored template, even if they come from the same finger. The same steps specified in the algorithm in Section 3.2 are applied to the

query minutia set M ðQ Þ so that the transformed template ψ ðQ Þ for the query can be generated. For clarity, let ψ ðEÞ denote the stored (transformed) template of the enrolled fingerprint. Then, the distance between ψ ðEÞ and ψ ðQ Þ is described by dðψ ðEÞ ; ψ ðQ Þ Þ ¼

J ψ ðEÞ  ψ ðQ Þ J 2 J ψ ðEÞ J 2 þ J ψ ðQ Þ J 2

where J  J 2 denotes the 2-norm [34]. We remark that the Euclidean metric is chosen since it is inherently adapted to measurement variations in biometric signals [35]. Therefore, the (normalized) matching score between the transformed templates of the enrolled and query fingerprints in the transformed domain is given by sðψ ðEÞ ; ψ ðQ Þ Þ ¼ 1  dðψ ðEÞ ; ψ ðQ Þ Þ ¼ 1 

J ψ ðEÞ  ψ ðQ Þ J 2 J ψ ðEÞ J 2 þ J ψ ðQ Þ J 2

ð12Þ

The matching score sðψ ðEÞ ; ψ ðQ Þ Þ ranges between 0 and 1 with 1 meaning most similar and 0 least similar. The value of sðψ ðEÞ ; ψ ðQ Þ Þ indicates the degree of similarity between the enrolled and query fingerprints. More specifically, the larger the value of sðψ ðEÞ ; ψ ðQ Þ Þ, the more similar the enrolled and the query and vice versa. The enrolled and query fingerprints are declared as a “matching pair” if the calculated sðψ ðEÞ ; ψ ðQ Þ Þ is greater than a threshold, which is usually determined through experiments.

4. Experimental results and analysis We have carried out extensive testing to evaluate the proposed cancelable fingerprint template design. Three databases (DB1, DB2 and DB3) of FVC2002 [12] were used in our experiments. Fingerprint images in these databases cover a wide spectrum in terms of quality with FVC2002 DB3 having the lowest quality images. Each database contains 100 fingers with eight impressions available for each finger. We have conducted partial dataset testing as well as full dataset testing. Partial dataset testing was conducted over FVC2002 DB1, DB2 and DB3 using the first two impressions of each finger, while in full dataset testing all eight impressions of each finger in FVC2002 DB2 were used. The commercial fingerprint recognition software VeriFinger SDK [36] was employed to extract minutiae points from each impression image in the three databases. The proposed cancelable fingerprint template design is local minutiae based. In our experiments on the three databases, the minutiae points from fingerprint images, extracted by VeriFinger SDK [36], were paired up to form pair-minutiae vectors, which were subsequently quantized and bin-indexed to generate the

Please cite this article as: S. Wang, J. Hu, Design of alignment-free cancelable fingerprint templates via curtailed circular convolution, Pattern Recognition (2013), http://dx.doi.org/10.1016/j.patcog.2013.10.003i

S. Wang, J. Hu / Pattern Recognition ∎ (∎∎∎∎) ∎∎∎–∎∎∎

associated figures shown below are all based on N ¼15. To assess whether the proposed method fulfills the requirements of a biometric template protection scheme, we focus on the following aspects:

 Lost key attack.  Revocability.  Security analysis.

4.1. Lost key attack Losing a user-specific key or token represents the worst-case scenario in practice where a user's key is stolen and known by an adversary. We simulated this scenario by assigning the same key to all subjects in a database. Both genuine testing and impostor testing were conducted under this same key setting with a random key fμn g of length p generated beforehand. To demonstrate the overall performance of the proposed algorithm under lost key attack, we investigated the Receiver Operating Characteristic (ROC) over FVC2002 DB1, DB2 and DB3. When all users in each database have the same key of length p ¼128, the ROC curves for all three databases are illustrated in Fig. 2. It is shown in Fig. 2 that the performance of the proposed method is comparable between FVC2002 DB1 and DB2 with marginally better performance for FVC2002 DB1. In comparison, the performance of the proposed method is worst for FVC2002 DB3. This is due to the poor image quality of this database with spurious and missing minutiae. We also plotted in Fig. 3 both genuine and impostor distributions under the same key scenario for FVC2002 DB1, DB2 and DB3 with p ¼128. With the cancelable templates obtained for each database using the same key of length p¼ 128, the EER results for FVC2002 DB1, DB2 and DB3 are 2%, 3% and 6.12%, respectively. By and large, these EER results are satisfactory. What is worth

Genuine Accpetance Rate (GAR)

0.95 0.9 0.85 0.8 0.75 0.7 FVC2002 DB1 FVC2002 DB2 FVC2002 DB3

0.65 0.6 10−4

10−3

10−2

10−1

False Acceptance Rate (FAR) Fig. 2. ROC curves for FVC2002 DB1, DB2 and DB3. For each database, all subjects are assigned the same key with p ¼ 128.

Distribution (%)

to generate the binary string fbn ; n ¼ 0; 1; …; 2N  1g, it was observed in our testing that matching performance of the proposed method varies with the bit length chosen for quantizing Vij in (3). A small bit length N [see (6)] cannot sufficiently distinguish pair-minutiae vectors whereas choosing too many bits increases sensitivity to slight distortions in different acquisitions of the same finger. This phenomenon was also noted in [22] and [25]. We found from our testing that N ¼15 was a suitable choice, resulting from nlij ¼ nαi ¼ nβj ¼ 5; refer to (6). The experimental results with

1

FVC2002 DB1

50

Genuine (same key) Imposter (same key)

40 30 20 10 0

0

0.1

0.2

0.3

0.4

0.5

0.6

0.7

0.8

Normalised Score Distribution (%)

binary string fbn g, upon which the resulting cancelable template was built through the non-invertible transformation. As can be seen, in all our experiments, no image pre-alignment was required, thus making the proposed method immune from inaccurate singular point detection. The performance measures adopted in our experiments were the Equal Error Rate (EER), False Acceptance Rate (FAR) and False Rejection Rate (FRR), which is related to the Genuine Acceptance Rate (GAR) by GAR þ FRR ¼ 1. FAR is the probability of mistaking biometric measurements from two different fingers to be from the same finger. FRR is the probability of mistaking two biometric measurements from the same finger to be from two different fingers. EER denotes the error rate when the FAR and the FRR are equal. The values of these performance indexes were collected from genuine testing and impostor testing. Genuine testing refers to matching an impression of each finger with other impressions of the same finger, whereas impostor testing involves comparing an impression of each finger against the impressions of all other different fingers. In addition, the parameter key fμn ; n ¼ 0; 1; …; p  1g was randomly generated. As quantization is a necessary step in the proposed algorithm

FVC2002 DB2

40

Genuine (same key) Imposter (same key)

30 20 10 0

0

0.1

0.2

0.3

0.4

0.5

0.6

0.7

0.8

Normalised Score Distribution (%)

6

FVC2002 DB3

50

Genuine (same key) Imposter (same key)

40 30 20 10 0

0

0.1

0.2

0.3

0.4

0.5

0.6

0.7

0.8

Normalised Score Fig. 3. Genuine and impostor distributions for FVC2002 DB1, DB2 and DB3. For each database, all subjects are assigned the same key with p ¼ 128.

mentioning is that considering poor image quality in FVC2002 DB3, the new method achieved an EER of 6.12% for this database, which is better than the EER of 27% and 7.5% in [28] and [30], respectively. The EER comparison of the proposed method with some existing alignment-free cancelable fingerprint template design is reported in Table 1. The length p of the key fμn g impacts on the performance of the proposed method. The experiment was conducted over FVC2002 DB2. The ROC curves for different values of p are drawn in Fig. 4 and the genuine and impostor distributions for the corresponding values of p are shown in Fig. 5. For each different value of p, all subjects in the database were assigned the same key. It can be seen from Fig. 4 that a key with a shorter length yields better matching performance because it makes the influence of the binary string fbn g on the transformed template more prominent. Also, a key of a shorter length saves memory space when stored.

Please cite this article as: S. Wang, J. Hu, Design of alignment-free cancelable fingerprint templates via curtailed circular convolution, Pattern Recognition (2013), http://dx.doi.org/10.1016/j.patcog.2013.10.003i

S. Wang, J. Hu / Pattern Recognition ∎ (∎∎∎∎) ∎∎∎–∎∎∎

However, a short key weakens the security strength of the proposed method, as analyzed in Section 4.3.

Table 1 Equal error rate (EER) comparison in percentage. Alignment-free cancelable

FVC2002

FVC2002 DB2

template design methods

DB1

Partial data

Full data

DB3

Tulyakov et al. [20] Ahmad et al. [28] Jin et al. [26] Das et al. [29] Wang and Hu [30] Proposed method

3 9 1.19 2.27 3.5 2

– 6 – – 4 2.3

– – 6.94 3.79 5 3

– 27 – – 7.5 6.12

FVC2002

Genuine Accpetance Rate (GAR)

1 0.95 0.9 0.85 0.8 p=128 p=1024 p=4096

0.75 0.7 10−4

10−2

10−3

7

10−1

False Acceptance Rate (FAR) Fig. 4. ROC curves for different key lengths evaluated over FVC2002 DB2 under the same key scenario.

4.2. Revocability and diversity Revocability and diversity are somewhat related. Revocability is an essential requirement for a cancelable fingerprint template scheme. It is required that if a stored template is compromised, a new template can be issued and the new template should be uncorrelated to the compromised template although they come from the same biometric data. As for diversity, it is important for a template protection scheme that multiple differently transformed templates should not match so as to prevent cross-matching over various applications. Revocability and diversity tests measure how different the reissued templates are compared to the old one and whether transformed templates that originate from the same fingerprint are correlated. Testing was performed over FVC2002 DB2 by generating 100 transformed templates from a single impression of each finger and then matching the transformed templates against the existing ones. The length of the key used in this testing was 4096. To show clear comparison, the pseudo-impostor distribution is illustrated in Fig. 6, together with the genuine and impostor distributions when each user in the database has a different key. It can be observed that the pseudo-impostor distribution looks similar to the impostor distribution. The mean and standard derivation of the pseudo-impostor distribution are 0.2939 and 0.0207, respectively, compared with 0.2827 (mean) and 0.0222 (standard derivation) of the impostor distribution. The results show that new transformed templates are different to the compromised template and that although transformed templates are generated from the same fingerprint, they are distinct from one another. 4.3. Security analysis

40

Genuine (same key) Imposter (same key)

30 20 10 0

0

0.1

0.2

0.3

0.4

0.5

0.6

0.7

0.8

Distribution (%)

Normalised Score FVC2002 DB2 with p=1024

40

40

Genuine (same key) Imposter (same key)

30 20

35

10

30

0

0

0.1

0.2

0.3

0.4

0.5

0.6

0.7

0.8

Normalised Score

Distribution (%)

protecting the binary string fbn ; n ¼ 0; 1; …; 2N  1g. As to the vulnerability of the binary string fbn g and what security threats may arise if it is compromised, a detailed analysis is given in [30]. In the proposed cancelable template scheme, protection of the binary string fbn g is accomplished by the curtailed circular convolution. It is readily seen that tackling fbn g would be successful if the attacker could acquire its L-point DFT sequence fBk g. Let us revisit the main equation (10). The values of Bk, k ¼ 0; 1; …; L  1, can be

FVC2002 DB2 with p=4096

40

Genuine (same key) Imposter (same key)

30

Distribution (%)

Distribution (%)

The security effort of the proposed method centers around FVC2002 DB2 with p=128

25 20 15

20

10

10

5

0

0

0.1

0.2

0.3

0.4

0.5

0.6

0.7

0.8

Normalised Score Fig. 5. Genuine and impostor distributions for FVC2002 DB2 with different key lengths.

Genuine (with different keys) Imposter (with different keys) Pseudo−imposter

0

0

0.1

0.2

0.3

0.4

0.5

0.6

0.7

0.8

Normalised Score Fig. 6. Genuine, impostor and pseudo-impostor distributions for FVC2002 DB2.

Please cite this article as: S. Wang, J. Hu, Design of alignment-free cancelable fingerprint templates via curtailed circular convolution, Pattern Recognition (2013), http://dx.doi.org/10.1016/j.patcog.2013.10.003i

S. Wang, J. Hu / Pattern Recognition ∎ (∎∎∎∎) ∎∎∎–∎∎∎

8

obtained by point-wise division of

Φk by Uk, i.e., Bk ¼ Φk =U k . It

means that to have Bk, the attacker needs to know Φk and Uk for each k ¼ 0; 1; …; L  1. Uk is the L-point DFT of the key fμn ; n ¼ 0; 1; …; p  1g. It follows that Uk, k ¼ 0; 1; …; L  1, can be derived if the sequence fμn g is stolen by the attacker, because the length p of fμn g is less than the DFT size L. But the disclosure of fμn g does not threaten the security of the binary string fbn g since they are totally uncorrelated.

Φk, k ¼ 0; 1; …; L  1, the attacker has to know its time-domain sequence fϕn ; n ¼ 0; 1; …; L  1g as Φk is the L-point DFT of fϕn g. However, there is no easy way to find the full sequence of fϕn g because the transformed template ψ in (11) only stores the last L p þ 1 elements of fϕn g. If the attacker obtains ψ and wants to guess the first p  1 entries of fϕn g through brute force attack, there are αp-1 possibilities for him/her to try, where α denotes the number of possible values taken by an entry of fϕn g. It follows from (8) that the vector ϕ, or equivalently the sequence fϕn g, is integer-valued if the sequence fμn g is made up of randomly To determine

generated integers, which is most likely to be the case. Let us assume α ¼ 3, which is obviously a rather conservative estimate on the number of values that an entry of fϕn g is likely to take. Then for p ¼128, the attacker must make 3127 attempts in order to reconstruct fϕn g in full. We can see that the security strength of the proposed method increases exponentially with p. So a longer key makes our cancelable template more secure. However, a longer key has an adverse effect on matching performance. Therefore, there is a trade-off between security and matching accuracy. From an LTI system's input–output point of view, the input– output mapping of a normal convolution process [see (1)] is invertible. A relevant explanation is that the length of the circular convolution that can be used to implement (1) is extended. But we take a contrary approach to our cancelable template design. The curtailed circular convolution applied in the proposed algorithm shrinks the output (the transformed template ψ ) to a length shorter than that of the input, the binary string fbn g. It is tremendously difficult for the attacker to restore the output to its full length even for a moderate value of p. Thus, knowledge of ψ and the key fμn g does not permit the recovery of fbn g. From the above analysis, we conclude that the transform designed in the proposed method is one-way. That is, the binary string fbn g is secure even when the key fμn g and the transformed template ψ are both compromised. As fbn g is secure, the attacker has no way to figure out quantized pair-minutiae vectors V ijðbÞ , so that the essential information about raw minutiae is invulnerable. Hence, the new method overcomes the security weakness in [24,25,27], where the quantized minutiae locations are at risk once the binary string (cancelable template) and the permutation matrix (serving as the user-specific key) are revealed.

5. Conclusion Cancelable biometrics provide enhanced safeguard against privacy and security threats to biometric systems. In this paper we have proposed the design of alignment-free cancelable fingerprint templates via curtailed circular convolution. By quantizing and binindexing pair-minutiae vectors, a binary string is generated. The proposed method features a one-way transform, which protects the input binary string in such a way that it cannot be retrieved from the convolved, output vector of shortened length. We have also analyzed the non-invertibility of our cancelable template from an LTI system's input–output viewpoint. The proposed scheme has strong security in that the binary string is secure even when both the transformed template and parameter key are compromised. With the binary

string secure, original fingerprint data will not be revealed. Evaluation of the proposed scheme over FVC2002 DB1, DB2 and DB3 shows that the new method demonstrates satisfactory performance compared to the existing alignment-free cancelable template schemes. Applying effective DSP techniques in the treatment of minutiae feature sets opens up new opportunities in the design of cancelable fingerprint templates. We will make more investigations along this direction. Also, it remains our future work as to how to find a good representation for local minutia information such that appropriate DSP techniques are applicable. Moreover, there is a potential to incorporate the finger vein biometric [37] into the proposed cancelable template to establish a multimodal biometric system. Fusion of different modality data [38,39] is a key issue for multimodal biometric systems, which we should direct more attention to.

Conflict of interest statment None declared.

Acknowledgment The research is sponsored by ARC projects LP110100602, LP100200538, LP100100404 and DP0985838. References [1] R. Cappelli, D. Lumini, D. Maio, D. Maltoni, Fingerprint image reconstruction from standard templates, IEEE Transactions on Pattern Analysis and Machine Intelligence 29 (9) (2007) 1489–1503. [2] J. Feng, A. Jain, Fingerprint reconstruction: from minutiae to phase, IEEE Transactions on Pattern Analysis and Machine Intelligence 33 (2) (2011) 209–223. [3] Y. Wang, J. Hu, Global ridge orientation modeling for partial fingerprint identification, IEEE Transactions on Pattern Analysis and Machine Intelligence 33 (1) (2011) 72–87. [4] N.K. Ratha, J.H. Connell, R.M. Bolle, Enhancing security and privacy in biometrics-based authentication systems, IBM Systems Journal 40 (3) (2001) 614–634. [5] R.M. Bolle, J.H. Connell, N.K. Ratha, Biometrics perils and patches, Pattern Recognition 35 (12) (2002) 2727–2738. [6] A.K. Jain, K. Nandakumar, A. Nagar, Biometric template security, EURASIP Journal on Advances in Signal Processing (2008) (Article ID 579416). [7] N.K. Ratha, S. Chikkerur, J.H. Connell, R.M. Bolle, Generating cancelable fingerprint templates, IEEE Transactions on Pattern Analysis and Machine Intelligence 29 (4) (2007) 561–572. [8] D. Maltoni, D. Maio, A.K. Jain, S. Prabhakar, Handbook of Fingerprint Recognition, 2nd ed., Springer, 2009. [9] M.K. Sain, J.L. Massey, Invertibility of linear time-invariant dynamical systems, IEEE Transactions on Automatic Control 14 (1969) 141–149. [10] S. Wang, J. Hu, Blind channel estimation for single-input multiple-output OFDM systems: zero padding based or cyclic prefix based, Wireless Communications and Mobile Computing 13 (2013) 204–210. [11] S. Wang, J. Cao, J. Hu, A frequency domain subspace blind channel estimation method for trailing zero OFDM systems, Journal of Network and Computer Applications 34 (1) (2011) 116–120. [12] Fingerprint Verification Competition. 〈http://bias.csr.unibo.it/fvc2002/〉, 2002. [13] Y. Wang, J. Hu, D. Philip, A fingerprint orientation model based on 2D Fourier Expansion (FOMFE) and its application to singular-point detection and fingerprint indexing, Special Issue on Biometrics: Progress and Directions: IEEE Transactions on Pattern Analysis and Machine Intelligence 29 (4) (2007) 573–585. [14] T.E. Boult, W.J. Scheirer, R. Woodworth, Revocable fingerprint biotokens: accuracy and security analysis, in: Proceedings of IEEE Conference on Computer Vision and Pattern Recognition, 2007, pp. 1–8. [15] H. Yang, X. Jiang, A.C. Kot, Generating secure cancelable fingerprint templates using local and global features, in: IEEE International Conference on Computer Science and Information Technology, 2009, pp. 645–649. [16] B. Yang, C. Busch, P. Bours, D. Gafurov, Non-invertible geometrical transformation for fingerprint minutiae template protection, in: Proceedings of the 1st International Workshop on Security and Communication Networks (IWSCN), 2009, pp. 1–7. [17] A. Nagar, S.D. Rane, A. Vetro, Alignment and bit extraction for secure fingerprint biometrics, in: Proceedings of SPIE Conference on Electronic Imaging, 2010 (Special Collection), vol. 7541, 75410N.

Please cite this article as: S. Wang, J. Hu, Design of alignment-free cancelable fingerprint templates via curtailed circular convolution, Pattern Recognition (2013), http://dx.doi.org/10.1016/j.patcog.2013.10.003i

S. Wang, J. Hu / Pattern Recognition ∎ (∎∎∎∎) ∎∎∎–∎∎∎ [18] S. Chikkerur, N. Ratha, J. Connell, R. Bolle, Generating registration-free cancelable fingerprint templates, in: Second IEEE International Conference on Biometrics: Theory, Applications and Systems, 2008, pp. 1–6. [19] C. Lee, J.-Y. Choi, K.-A. Toh, S. Lee, Alignment-free cancelable fingerprint templates based on local minutiae information, IEEE Transactions on Systems, Man, and Cybernetics, Part B 37 (4) (2007) 980–992. [20] S. Tulyakov, F. Farooq, P. Mansukhani, V. Govindaraju, Symmetric hash functions for secure fingerprint biometric systems, Pattern Recognition Letters 28 (2007) 2427–2436. [21] B. Yang, C. Busch, Parameterized geometric alignment for minutiae-based fingerprint template protection, in: IEEE International Conference on Biometrics: Theory, Applications, and Systems, 2009, pp. 1–6. [22] F. Farooq, R. Bolle, J. Tsai-Yang, N. Ratha, Anonymous and revocable fingerprint recognition, in: IEEE Conference on Computer Vision and Pattern Recognition, 2007, pp. 1–7. [23] A.O. Thomas, N. Ratha, J. Connell, R. Bolle, Comparative analysis of registration based and registration free methods for cancelable fingerprint biometrics, in: 19th International Conference on Pattern Recognition, 2008, pp. 1–4. [24] Z. Jin, A. Teoh, T.S. Ong, C. Tee, Generating revocable fingerprint template using minutiae pair representation, in: The Second International Conference on Education Technology and Computer (ICETC), 2010, pp. V5/251–255. [25] Z. Jin, A. Teoh, T.S. Ong, C. Tee, A revocable fingerprint template for security and privacy preserving, KSII Transactions on Internet and Information Systems 4 (6) (2010) 1327–1341. [26] Z. Jin, A.B.J. Teoh, T.S. Ong, C. Tee, Fingerprint template protection with minutiae-based bit-string for security and privacy preserving, Expert Systems with Applications 39 (2012) 6157–6167. [27] C. Lee, J. Kim, Cancelable fingerprint templates using minutiae-based bitstrings, Journal of Network and Computer Applications 33 (3) (2010) 236–246. [28] T. Ahmad, J. Hu, S. Wang, Pair-polar coordinate-based cancelable fingerprint templates, Pattern Recognition 44 (10–11) (2011) 2555–2564.

9

[29] P. Das, K. Karthik, B.C. Garai, A robust alignment-free fingerprint hashing algorithm based on minimum distance graphs, Pattern Recognition 45 (9) (2012) 3373–3388. [30] S. Wang, J. Hu, Alignment-free cancelable fingerprint template design: a densely infinite-to-one mapping (DITOM) approach, Pattern Recognition 45 (12) (2012) 4129–4137. [31] A.V. Oppenheim, R.W. Schafer, Discrete-Time Signal Processing, 2nd ed., Prentice-Hall, 1999. [32] J.H. Manton, W.D. Neumann, Totally blind channel identification by exploiting guard intervals, Systems and Control Letters 48 (2003) 113–119. [33] J.G. Proakis, D.G. Manolakis, Digital Signal Processing: Principles, Algorithms, and Applications, 3rd ed., Prentice-Hall, Inc., 1996. [34] G.H. Golub, C.F. Van Loan, Matrix Computations, 3rd ed., Johns Hopkins University Press, 1996. [35] J.D. Golic, M. Baltatu, Entropy analysis and new constructions of biometric key generation Systems, IEEE Transactions on Information Theory 54 (5) (2008) 2026–2040. [36] Neurotechnology, VeriFinger SDK (〈http://www.neurotechnology.com/mega matcher.html〉). [37] D. Mulyono, S.J. Horng, A study of finger vein biometric for personal identification, in: International Symposium on Biometrics and Security Technologies, 2008, pp. 1–8. [38] M. He, S.J. Horng, P. Fan, R.S. Run, R.J. Chen, J.L. Lai, M.K. Khan, K.O. Sentosa, Performance evaluation of score level fusion in multimodal biometric systems, Pattern Recognition 43 (5) (2010) 1789–1800. [39] S.J. Horng, Y.H. Chen, R.S. Run, R.J. Chen, J.L. Lai, K.O. Sentosal, An improved score level fusion in multimodal biometric systems, in: International Conference on Parallel and Distributed Computing, Applications and Technologies, 2009, pp. 239–246.

Song Wang is a senior lecturer in the Department of Electronic Engineering, La Trobe University, Australia. She obtained her PhD degree from the Department of Electrical and Electronic Engineering, University of Melbourne, Australia. Her research areas are biometric security, blind system identification and wireless communications.

Jiankun Hu is a full professor of Cyber Security at the School of Engineering and Information Technology, the University of new South Wales at the Australian Defence Force Academy (UNSW@ADFA), Australia. His major research interest is in computer networking and computer security, especially biometric security. He has been awarded six Australia Research Council Grants. He served as Security Symposium Co-Chair for IEEE GLOBECOM '08 and IEEE ICC '09. He was Program Co-Chair of the 2008 International Symposium on Computer Science and its Applications. He served and is serving as an Associate Editor of the following journals: Journal of Network and Computer Applications, Elsevier; Journal of Security and Communication Networks, Wiley; and Journal of Wireless Communication and Mobile Computing, Wiley. He is the leading Guest Editor of a 2009 special issue on biometric security for mobile computing, Journal of Security and Communication Networks, Wiley. He received a Bachelor's degree in Industrial Automation in 1983 from Hunan University, PR China, a PhD degree in engineering in 1993 from the Harbin Institute of Technology, PR China, and a Master's degree for research in computer science and software engineering from Monash University, Australia, in 2000. In 1995 he completed his postdoctoral fellow work in the Department of Electrical and Electronic Engineering, Harbin Shipbuilding College, PR China. He was a research fellow of the Alexander von Humboldt Foundation in the Department of Electrical and Electronic Engineering, Ruhr University, Germany, during 1995–1997. He worked as a research fellow in the Department of Electrical and Electronic Engineering, Delft University of Technology, The Netherlands, in 1997. Before he moved to RMIT University Australia, he was a research fellow in the Department of Electrical and Electronic Engineering, University of Melbourne, Australia.

Please cite this article as: S. Wang, J. Hu, Design of alignment-free cancelable fingerprint templates via curtailed circular convolution, Pattern Recognition (2013), http://dx.doi.org/10.1016/j.patcog.2013.10.003i