Towards Enhancing Security and Accuracy of Iris ... - Semantic Scholar
Towards Enhancing Security and Accuracy of Iris Recognition Systems∗ Christian Rathgeb Multimedia Signal Processing and Security Lab (WaveLab) Department of Computer Sciences, University of Salzburg, Austria [email protected]
Abstract: The intricate structure of the iris constitutes a powerful biometric characteristic utilized by iris recognition algorithms to extract discriminative biometric templates. Iris recognition is field-proven but consequential issues, e.g. privacy protection or recognition in unconstrained environments, still to be solved, raise the need for further investigations. In this paper different improvements focused on template protection and biometric comparators are presented. Experimental evaluations are performed on a public dataset confirming the soundness of proposed enhancements.
1
Introduction
Existing approaches to iris recognition reveal practical performance on diverse test sets, reporting impressive recognition rates above 99% and equal error rates (EERs) of less than 1% [BHF07]. The majority of iris recognition algorithms extract binary templates, i.e. iris-codes, applying the fractional Hamming distance (HD) to calculate (dis-)similarity scores, providing (1) a rapid authentication and (2) a compact storage of biometric templates. Numerous feature extraction techniques have been proposed in literature, while potential improvements in comparison procedures are commonly neglected. In addition, unprotected storage of the biometric data leads to serious vulnerabilities, e.g. identity theft or cross-matching. Biometric template protection techniques [RU11] offer solution to these privacy and security risks. In this work diverse enhancements to iris-based template protection and comparators are proposed. Fig. 1 illustrates the target points within a generic iris recognition system which emphasis is put on. Proposed enhancements are evaluated for iris-based feature vectors but can be incorporated to any existing biometric recognition system utilizing binary templates, without re-enrollment of registered subjects. The remainder of this paper is organized as follows: in Sect. 2 introduces biometric template protection and according improvements are proposed. Sect. 3 is focused on comparison techniques presenting two advanced binary biometric comparators. Experimental evaluations are described in Sect. 4. Finally, conclusions are drawn in Sect. 5. ∗ Contents
of this paper have been presented at international conferences, see [RUW11a, RUW11b, RUW12].
+Security
Acquisition
Preprocessing
Feature extraction
+Accuracy
Advanced fuzzy commitment
Advanced comparator
Binary template
Biometric comparator
Binary template
Figure 1: Iris recognition processing chain: target points for enhancing security and accuracy.
2
Iris Biometric Template Protection
Biometric template protection schemes, which are commonly categorized as biometric cryptosystems and cancelable biometrics are designed to meet major requirements of biometric information protection (ISO/IEC FCD 24745) in particular, irreversibility and unlinkability. While techniques to generate cancelable iris biometrics have been suggested (e.g. in [ZRC08]), best performing approaches are based on the fuzzy commitment scheme (FCS) [JW99], implementing biometric cryptosystems (e.g. in [HAD06]). In FCSs keys prepared with error correction information are bound to binary biometric feature vectors, i.e. variance is overcome by means of error correction. In the following subsection a reliability-based bits fusion (RBF ) [RUW11a] is introduced which is designed to rearrange binary biometric templates in a way that error correction capacities are exploited more effectively within FCSs, yielding improvement with respect to key-retrieval rates. 2.1
Reliability-based Bits Fusion
In general, bits of feature vectors are not ordered according to their reliability, i.e. the probability that the i-th bit comparison of the corresponding feature vectors IK , IL correctly indicate whether believed K and observed L identities are equal. With respect to FCSs a balanced reliability distribution is a desirable property, since error correction can be performed more effectively if a relatively fixed amount of errors within chunks of iris-codes can be expected. For a distinct feature extraction method the corresponding reliability is approximated in a separate training stage from a set A = {(IK , IL )|K = L} of genuine feature vector samples and B = {(IK , IL )|K 6= L} of impostors: k {(IK , IL ) ∈ A |IK [i] = IL [i]} k k {IK , IL ∈ B |IK [i] 6= IL [i]} k 1 + . R(i) = · 2 kAk kBk (1) In other words, reliable bits match for genuine comparisons and differ for impostor comparisons. Based on the estimated distribution of reliability given samples are ordered with respect to global reliability R(i) by selecting σ ∈ P (Nn is the index set {1, 2, . . . , n}): P = {σ : Nn → Nn | ∃σ −1 ∧ ∀i < j : R(σ(i)) ≥ R(σ(j))}. Subsequently, reliabilitybased bits fusion is performed for a given iris-code IK ∈ {0, 1}n , RBS(IK )[i] =
IK [σ(di/2e)] if i is even IK [σ(d(n − i)/2e)] otherwise.
(2)
RBF re-orders bits of a given feature vectors in a way that first bit blocks comprise bits expected to be most reliable as well as bits expected to be least reliable while last bit blocks
comprise bits exhibiting average reliability, i.e. bits, selected from the left and right end of the reliability-ordered template, are interleaved obtaining an average block-wise level of reliability.
3
Iris Biometric Comparators
In traditional iris recognition [BHF07], in order to obtain a comparison score indicating the (dis-)similarity between two iris-codes, the minimum HD over different bit shifts is calculated. Calculating HDs can be performed efficiently and circular shifts are performed to obtain a perfect alignment, i.e. to tolerate a certain amount of relative rotation. Existing comparators preserve the best match only, i.e. the minimum HD score, however, there is no evidence, that other computed HD scores can not contribute to an improved recognition accuracy. In the following subsection different advanced comparators are introduced. The shifting score fusion [RUW11b] comparator obtains slight improvement at negligible additional cost. The Gaussian score fitting [RUW12] comparator which gains significant improvement represents a more complex technique, highlighting a trade-off between computational effort and recognition accuracy. 3.1
Shifting Score Fusion
Since calculating HDs at different shifting positions is obligatory when comparing a single pair of iris-codes, it is interesting to analyze the shifting variation, i.e. difference between maximum and minimum obtained HD. Let s(I, m) denote an iris-code I shifted by m ∈ Mn = {z ∈ Z : |z| ≤ n} bits and HD(IK , IL ) be the HD of two iris-codes, then the shifting score fusion (SSF ) for two iris-codes IK , IL is defined as: SSF (IK , IL ) =
1 1 − max HD(IK , s(IL , m)) + min HD IK , s(IL , m) . (3) m∈Mn m∈Mn 2
That is, SSF corresponds to a score level fusion of the minimum (i.e. best) HD and one minus the maximum (i.e. worst) HD applying the sum rule. By combining “best” and “worst” observed HD scores the variation between these scores is tracked, which represents an advanced indicator for genuine and impostor classes. 3.2
Score Fitting under Gaussian Assumption
In order to model an average algorithm-dependent distribution of comparison scores at a certain alignment all genuine comparisons within the training set are performed. Once an optimal alignment is detected for each pair of iris-codes (of a single subject) the progression of scores with respect to the optimal alignment is tracked in an histogram. Distributions of comparison scores, in particular 1 − MinHD, at certain positions can be √ shifting −(k−i)2 /(2σ 2 ) approximated by a Gaussian function, G(k, i) = t + (1/σ 2π)e , where t represents the decision threshold of the system and i refers to the optimal shifting position. An adequate Gaussian can be established by manual fitting or any systematic approach, e.g. nonlinear least squares fitting.
(a) Acquisition
(b) Iris detection
(c) Iris texture and enhanced iris texture
Figure 2: Preprocessing: (a) image (b) detection of pupil and iris (c) unrolled and enhanced texture.
At authentication the deviation of comparison scores to the corresponding Gaussian (estimated at training stage) is measured at different shifting positions. For this purpose the function GaussFit is defined, which calculates the quadratic error of the comparison score between two iris-codes at a distinct shifting position k to a Gaussian G, 2 GaussF it(IK , IL , k) = 1 − HD IK , s(IL , k) −G(k, i) . (4) The deviation is estimated for distinct shifting positions m ∈ Mn based on the optimal shift Pni in order to calculate the final fitting score which is defined by GaussF it(IK , IL ) = || m=−n GaussF it(IK , IL , m)||, the sum of all quadratic errors which is normalized to the range [0, 1]. Normalization boundaries are estimated based on the applied training set, outliers are set to 0 or 1, respectively. The score level fusion of the resulting fitting score and the MinHD defines the proposed comparator, denoted by MinHD+GaussFit. Obviously, the proposed technique requires additional computational effort.
4
Experimental Studies
Experiments are carried out on the CASIA.v3-Interval iris database1 . The database consists of good quality 320×280 pixel NIR illuminated indoor images, a sample image is shown in Fig. 2 (a). The first 20 classes are applied for parameter estimation in according training stages. At preprocessing the iris of a given sample image is detected, see Fig. 2 (b), unrolled to a rectangular texture of 512 × 64 pixel, and lighting across the texture is normalized as shown in Fig. 2 (c). In the feature extraction stage a custom implementation of the algorithm of Masek [Mas03] is employed. The extracted texture is divided into 10 stripes to obtain 5 one-dimensional signals, each one averaged from the pixels of 5 adjacent rows. Subsequently, a row-wise convolution with a complex Log-Gabor filter is performed. The phase angle of the resulting complex value for each pixel is discretized into 2 bits. Applying 512 bits per signal, the final code consits of 512 × 20 = 10240 bits. Key binding and retrieval is performed according to the approach of Hao et al. [HAD06]. A 16 · 8 = 128 bit cryptographic key k is first prepared with a RS(16, 80) Reed-Solomon code which is capable of correcting (80 − 16)/2 = 32 block errors. Subsequently, the 80 8-bit blocks are Hadamard encoded resulting in 80 128-bit codewords (= 10240-bit) and bound to the iris-code by XORing both, where up to 25% of bit errors can be corrected. Since balanced reliability distributions are estimated based on a training set burst errors may still occur at key retrieval, i.e block level error correction remains essential. 1 The Center of Biometrics and Security Research, CASIA Iris Image Database, http://www.idealtest.org
Reliability
Original Reliability-based Bits Fusion
2
4
6
8 10 12 14 16 18 20 22 24 26 28 30 32 34 36 38 40 42 44 46 48 50 52 54 56 58 60 62 64 66 68 70 72 74 76 78 Number of 128-Bit Blocks
(a) Distributions of reliability within 128-bit blocks 100
80
100 False Rejection Rate False Acceptance Rate Threshold: FAR
Abstract: The intricate structure of the iris constitutes a powerful biometric characteristic utilized by iris recognition algorithms to extract discriminative biometric templates. Iris recognition is field-proven but consequential issues, e.g. privacy protection or recognition in unconstrained environments, still to be solved, raise the need for further investigations. In this paper different improvements focused on template protection and biometric comparators are presented. Experimental evaluations are performed on a public dataset confirming the soundness of proposed enhancements.
1
Introduction
Existing approaches to iris recognition reveal practical performance on diverse test sets, reporting impressive recognition rates above 99% and equal error rates (EERs) of less than 1% [BHF07]. The majority of iris recognition algorithms extract binary templates, i.e. iris-codes, applying the fractional Hamming distance (HD) to calculate (dis-)similarity scores, providing (1) a rapid authentication and (2) a compact storage of biometric templates. Numerous feature extraction techniques have been proposed in literature, while potential improvements in comparison procedures are commonly neglected. In addition, unprotected storage of the biometric data leads to serious vulnerabilities, e.g. identity theft or cross-matching. Biometric template protection techniques [RU11] offer solution to these privacy and security risks. In this work diverse enhancements to iris-based template protection and comparators are proposed. Fig. 1 illustrates the target points within a generic iris recognition system which emphasis is put on. Proposed enhancements are evaluated for iris-based feature vectors but can be incorporated to any existing biometric recognition system utilizing binary templates, without re-enrollment of registered subjects. The remainder of this paper is organized as follows: in Sect. 2 introduces biometric template protection and according improvements are proposed. Sect. 3 is focused on comparison techniques presenting two advanced binary biometric comparators. Experimental evaluations are described in Sect. 4. Finally, conclusions are drawn in Sect. 5. ∗ Contents
of this paper have been presented at international conferences, see [RUW11a, RUW11b, RUW12].
+Security
Acquisition
Preprocessing
Feature extraction
+Accuracy
Advanced fuzzy commitment
Advanced comparator
Binary template
Biometric comparator
Binary template
Figure 1: Iris recognition processing chain: target points for enhancing security and accuracy.
2
Iris Biometric Template Protection
Biometric template protection schemes, which are commonly categorized as biometric cryptosystems and cancelable biometrics are designed to meet major requirements of biometric information protection (ISO/IEC FCD 24745) in particular, irreversibility and unlinkability. While techniques to generate cancelable iris biometrics have been suggested (e.g. in [ZRC08]), best performing approaches are based on the fuzzy commitment scheme (FCS) [JW99], implementing biometric cryptosystems (e.g. in [HAD06]). In FCSs keys prepared with error correction information are bound to binary biometric feature vectors, i.e. variance is overcome by means of error correction. In the following subsection a reliability-based bits fusion (RBF ) [RUW11a] is introduced which is designed to rearrange binary biometric templates in a way that error correction capacities are exploited more effectively within FCSs, yielding improvement with respect to key-retrieval rates. 2.1
Reliability-based Bits Fusion
In general, bits of feature vectors are not ordered according to their reliability, i.e. the probability that the i-th bit comparison of the corresponding feature vectors IK , IL correctly indicate whether believed K and observed L identities are equal. With respect to FCSs a balanced reliability distribution is a desirable property, since error correction can be performed more effectively if a relatively fixed amount of errors within chunks of iris-codes can be expected. For a distinct feature extraction method the corresponding reliability is approximated in a separate training stage from a set A = {(IK , IL )|K = L} of genuine feature vector samples and B = {(IK , IL )|K 6= L} of impostors: k {(IK , IL ) ∈ A |IK [i] = IL [i]} k k {IK , IL ∈ B |IK [i] 6= IL [i]} k 1 + . R(i) = · 2 kAk kBk (1) In other words, reliable bits match for genuine comparisons and differ for impostor comparisons. Based on the estimated distribution of reliability given samples are ordered with respect to global reliability R(i) by selecting σ ∈ P (Nn is the index set {1, 2, . . . , n}): P = {σ : Nn → Nn | ∃σ −1 ∧ ∀i < j : R(σ(i)) ≥ R(σ(j))}. Subsequently, reliabilitybased bits fusion is performed for a given iris-code IK ∈ {0, 1}n , RBS(IK )[i] =
IK [σ(di/2e)] if i is even IK [σ(d(n − i)/2e)] otherwise.
(2)
RBF re-orders bits of a given feature vectors in a way that first bit blocks comprise bits expected to be most reliable as well as bits expected to be least reliable while last bit blocks
comprise bits exhibiting average reliability, i.e. bits, selected from the left and right end of the reliability-ordered template, are interleaved obtaining an average block-wise level of reliability.
3
Iris Biometric Comparators
In traditional iris recognition [BHF07], in order to obtain a comparison score indicating the (dis-)similarity between two iris-codes, the minimum HD over different bit shifts is calculated. Calculating HDs can be performed efficiently and circular shifts are performed to obtain a perfect alignment, i.e. to tolerate a certain amount of relative rotation. Existing comparators preserve the best match only, i.e. the minimum HD score, however, there is no evidence, that other computed HD scores can not contribute to an improved recognition accuracy. In the following subsection different advanced comparators are introduced. The shifting score fusion [RUW11b] comparator obtains slight improvement at negligible additional cost. The Gaussian score fitting [RUW12] comparator which gains significant improvement represents a more complex technique, highlighting a trade-off between computational effort and recognition accuracy. 3.1
Shifting Score Fusion
Since calculating HDs at different shifting positions is obligatory when comparing a single pair of iris-codes, it is interesting to analyze the shifting variation, i.e. difference between maximum and minimum obtained HD. Let s(I, m) denote an iris-code I shifted by m ∈ Mn = {z ∈ Z : |z| ≤ n} bits and HD(IK , IL ) be the HD of two iris-codes, then the shifting score fusion (SSF ) for two iris-codes IK , IL is defined as: SSF (IK , IL ) =
1 1 − max HD(IK , s(IL , m)) + min HD IK , s(IL , m) . (3) m∈Mn m∈Mn 2
That is, SSF corresponds to a score level fusion of the minimum (i.e. best) HD and one minus the maximum (i.e. worst) HD applying the sum rule. By combining “best” and “worst” observed HD scores the variation between these scores is tracked, which represents an advanced indicator for genuine and impostor classes. 3.2
Score Fitting under Gaussian Assumption
In order to model an average algorithm-dependent distribution of comparison scores at a certain alignment all genuine comparisons within the training set are performed. Once an optimal alignment is detected for each pair of iris-codes (of a single subject) the progression of scores with respect to the optimal alignment is tracked in an histogram. Distributions of comparison scores, in particular 1 − MinHD, at certain positions can be √ shifting −(k−i)2 /(2σ 2 ) approximated by a Gaussian function, G(k, i) = t + (1/σ 2π)e , where t represents the decision threshold of the system and i refers to the optimal shifting position. An adequate Gaussian can be established by manual fitting or any systematic approach, e.g. nonlinear least squares fitting.
(a) Acquisition
(b) Iris detection
(c) Iris texture and enhanced iris texture
Figure 2: Preprocessing: (a) image (b) detection of pupil and iris (c) unrolled and enhanced texture.
At authentication the deviation of comparison scores to the corresponding Gaussian (estimated at training stage) is measured at different shifting positions. For this purpose the function GaussFit is defined, which calculates the quadratic error of the comparison score between two iris-codes at a distinct shifting position k to a Gaussian G, 2 GaussF it(IK , IL , k) = 1 − HD IK , s(IL , k) −G(k, i) . (4) The deviation is estimated for distinct shifting positions m ∈ Mn based on the optimal shift Pni in order to calculate the final fitting score which is defined by GaussF it(IK , IL ) = || m=−n GaussF it(IK , IL , m)||, the sum of all quadratic errors which is normalized to the range [0, 1]. Normalization boundaries are estimated based on the applied training set, outliers are set to 0 or 1, respectively. The score level fusion of the resulting fitting score and the MinHD defines the proposed comparator, denoted by MinHD+GaussFit. Obviously, the proposed technique requires additional computational effort.
4
Experimental Studies
Experiments are carried out on the CASIA.v3-Interval iris database1 . The database consists of good quality 320×280 pixel NIR illuminated indoor images, a sample image is shown in Fig. 2 (a). The first 20 classes are applied for parameter estimation in according training stages. At preprocessing the iris of a given sample image is detected, see Fig. 2 (b), unrolled to a rectangular texture of 512 × 64 pixel, and lighting across the texture is normalized as shown in Fig. 2 (c). In the feature extraction stage a custom implementation of the algorithm of Masek [Mas03] is employed. The extracted texture is divided into 10 stripes to obtain 5 one-dimensional signals, each one averaged from the pixels of 5 adjacent rows. Subsequently, a row-wise convolution with a complex Log-Gabor filter is performed. The phase angle of the resulting complex value for each pixel is discretized into 2 bits. Applying 512 bits per signal, the final code consits of 512 × 20 = 10240 bits. Key binding and retrieval is performed according to the approach of Hao et al. [HAD06]. A 16 · 8 = 128 bit cryptographic key k is first prepared with a RS(16, 80) Reed-Solomon code which is capable of correcting (80 − 16)/2 = 32 block errors. Subsequently, the 80 8-bit blocks are Hadamard encoded resulting in 80 128-bit codewords (= 10240-bit) and bound to the iris-code by XORing both, where up to 25% of bit errors can be corrected. Since balanced reliability distributions are estimated based on a training set burst errors may still occur at key retrieval, i.e block level error correction remains essential. 1 The Center of Biometrics and Security Research, CASIA Iris Image Database, http://www.idealtest.org
Reliability
Original Reliability-based Bits Fusion
2
4
6
8 10 12 14 16 18 20 22 24 26 28 30 32 34 36 38 40 42 44 46 48 50 52 54 56 58 60 62 64 66 68 70 72 74 76 78 Number of 128-Bit Blocks
(a) Distributions of reliability within 128-bit blocks 100
80
100 False Rejection Rate False Acceptance Rate Threshold: FAR
