0 An Overview on Privacy Preserving Biometrics

The Internet has consolidated itself as a very powerful platform that has changed the communication and business way. Nowadays, the number of users navigating through Internet is about 1,552 millions according to Internet World Stats. This large audience demands online commerce, e-government, knowledge sharing, social networks, online gaming . . . which grew exponentially over the past few years. The security of these transactions is very important considering the number of information that could be intercepted by an attacker. Within this context, authentication is one of the most important challenges in computer security. Indeed, the authentication step is often considered as the weakest link in the security of electronic transactions. In general, the protection of the message content is achieved by using cryptographic protocols that are well known and established. The well-known ID/password is far the most used authentication method, it is widely spread despite its obvious lack of security. This is mainly due to its implementation ease and to its ergonomic feature: the users are used to this system, which enhances its acceptance and deployment. Many more sophisticated solutions exist in the state of the art to secure logical access control (one time passwords tokens, certificates . . . ) but none of them are used by a large community of users for a lack of simplicity usage (O’Gorman, 2003). Among the different authentication methods of an individual, biometrics is often presented as a promising solution. Few people know that biometrics has been used for ages for identification or signature purposes. Fingerprints were already used as a signature for commercial exchanges in Babylon (-3000 before JC). Alphonse Bertillon proposed in 1879 to use anthropometric information for police investigation. Nowadays, all police forces in the world use this kind of information to solve crimes. The first prototypes of terminals providing an automatic processing of the voice and digital fingerprints have been defined in the middle of the years 1970. Today, a large number of biometric systems are used for logical and physical access control applications. This technology possesses many favorable properties. First, there is a strong link between the user and its authenticator. As for example, it is not possible to loose its fingerprint as it could be the case for a token. Second, this solution is very usable: indeed, it is very convenient for a user to authenticate himself/herself by putting his/her finger on a sensor or making a capture of the face. Last, biometrics is an interesting candidate to be a unique user’s authenticator. A study done by NTA group in 2002 (Monitor, 2002) on 500 users showed that there was approximately 21 passwords per user, 81% of them use 4