Cloud-based biometrics processing for privacy-preserving identification

With the increasing number of users enrolled, biometric identification requires more computing resources to scan all records of a database and locate the best match. As such, database owners are willing to delegate user biometric information (in encrypted state) to the cloud to enroll and identify users, while preserving privacy. Wang et al. proposed a cloud-based privacy-preserving biometric scheme, a.k.a. CloudBI, in ESORICS 2015, but their security assumption does not capture practical aspects of real world attacks. In this paper, we show how an attack enrolls fake biometric data and then manipulates them to recover encrypted an identification request in CloudBI. Next, we propose an effective security patch to CloudBI, which is secure against enrollment-level attackers. Experimental results show that the proposed security patch bring about little performance degradation to CloudBI.