How to Evaluate Transformation Based Cancelable Biometric Systems

The concept of cancelable biometrics has been defined for the first time in the pioneering article [17]. It is aimed at enhancing privacy protection and template security, as detailed in the recent reference [8]. Two main approaches can be distinguished dealing with cancelable biometrics. On the one hand, biometric cryptosystems or secure sketches, such as those presented in [9], [7], [24], [6], [5], [2], resort to cryptography. On the other hand, we find feature transformations approaches. The BioHashing algorithm is one of the most popular technique and is based on biometric data salting. It has been developed for different biometric modalities such as those presented in [23], [3], [18]. In order to validate their proposition, authors generally provide some experimental results based on performance evaluation (EER value, ROC curves, etc.) and sometimes through a security analysis by considering different scenarios [19]. None standard methodology has been defined in order to qualify these privacy by design biometric systems [21] even if some previous research works have been proposed recently [15]. We intend in this paper to clearly define the properties that are requested for the evaluation of cancelable biometric systems, and we propose different attacks that can be simulated to assess how the targeted system fulfills these properties. The plan of the paper is the following. Section 2 first gives an overview of definitions. We then list security and privacy properties in the state of the art for the evaluation of cancelable biometric systems. We present different attacks from the impostor point of view in order to assess the previous properties. Some measures are also given to complete this security and privacy analysis of a transformation based cancelable biometric system. We conclude and give some perspectives in section 4.