A New Fingerprint Authentication Scheme Based on Secret-Splitting for Enhanced Cloud Security

The number of commercially-available web-based services is growing rapidly nowadays. In particular, cloud computing provides an efficient and economic means of delivering information technology (IT) resources on demand, and is expected to find extensive applications as network bandwidth and virtualization technologies continue to advance. However, cloud computing presents the IT industry not only with exciting opportunities, but also with significant challenges since consumers are reluctant to adopt cloud computing solutions in the absence of firm guarantees regarding the security of their information. Two fundamental issues arise when users applying cloud computing to software as a service (SaaS). First, if enterprise data is to be processed in the cloud, it must be encrypted to ensure its privacy. As a result, efficient key management schemes are required to facilitate the encryption (and corresponding decryption) tasks. Second, as the sophistication of the tools used by malicious users continues to increase, the data processed in the cloud is at increasing risk of attack. Consequently, there is an urgent requirement for robust authentication schemes to ensure that the data can be accessed only by legitimate, authorized users. Network attacks such as phishing or man-in-the-middle (MITM) attacks present a serious obstacle to consumer acceptance of cloud computing services. According to reports released by privacy watchdog groups in the US, more than 148 identity theft incidents, affecting nearly 94 million identities, occurred in 2005 in the US alone (Mark, 2006). Identity theft is therefore one of the most severe threats to the security of online services. As a result, it is imperative that SaaS providers have the means to authenticate the identity of every user attempting to access the system. Due to the non-denial requirements of remote user identity authentication schemes, this is most commonly achieved using some form of biometricsbased method. The term “biometrics” describes a collection of methods for identifying individuals based upon their unique physiological or behavioral characteristics (Furnell et al. 2008). Generally speaking, the physiological characteristics include the individual’s fingerprint, vein pattern, DNA and shape of face, while the behavioral characteristics include the handwriting dynamics, voice and gait. Automated biometric recognition systems are now widely used