Mitigate authentication attack risk on cancelable biometrics by leveraging attacker knowledge

According to the EU’s General Data Protection Regulation, cancelable biometrics (CB) are essential for protecting biometric templates by combining three important criteria: irreversibility, revocability, and unlinkability. Unfortunately, many works have demonstrated that the distance preserving property, inherent to CB transforms, has permitted to initiate similarity-based attack (SA). Similarity-based attack takes the information leakage between the original distance and the transformed distance and aims at reconstructing a nearby biometric feature, used to gain illegal access to the system. In this paper, we propose to mitigate the SA by mastering the attacker’s knowledge that can lead to its success. For the sake of generality, we reformulate SA for unordered set templates and propose a generalized particle swarm optimization strategy to launch the attack. We pointed out that the weak point allowing the SA to operate is the distance score provided by the matching module. To limit the amount of attacker’s knowledge, we propose a new matching strategy adapted to all template formats based on similarity ratio score. We have performed experiments and different comparisons on two common databases, from fingerprints and faces, and have proved at each time, the efficiency of the given countermeasure to the threatening SA. Furthermore, the security is discussed when the attacker’s knowledge is expanded by additional information as synthetic biometric features, which meant to approximate the initial research space. Recommendations are then given to alleviate such risks at the design level.