Hiding Biometric Data for Secure Transmission

Yongwha Chung1, Daesung Moon2, Kiyoung Moon2, and Sungbum Pan3

1
Department of Computer and Information Science, Korea University, Korea
ychungy@korea.ac.kr
2
Biometrics Technology Research Team, ETRI, Daejeon, Korea
{daesung,kymoon}@etri.re.kr
3
Division of Information and Control Measurement Engineering,
Chosun University, Korea
sbpan@chosun.ac.kr

Abstract. In this paper, we describe biometric watermarking techniques for se-

cure user verification on the remote, multimodal biometric system employing
both fingerprint and face information, and compare their effects on verification
accuracy quantitatively. To hide biometric data with watermarking techniques,
we first consider possible two scenarios. In the Scenario 1, we use a fingerprint
image as a cover work and hide facial features into it. On the contrary, we hide
fingerprint features into a facial image in the Scenario 2. Based on the experi-
mental results, we confirm that the Scenario 2 is superior to the Scenario 1 in
terms of the verification accuracy of the watermarked image.
Keywords: Biometrics, Biometric Watermarking, Multimodal Biometric Sys-
tem

1 Introduction
Traditionally, verified users have gained access to secure information systems, build-
ings, or equipment via multiple PINs, passwords, smart cards, and so on. However,
these security methods have important weakness that can be lost, stolen, or forgotten.
In recent years, there is an increasing trend of using biometrics, which refers the
personal biological or behavioral characteristics used for verification[1].
In general, biometric verification/identification system can be divided into two
modes: a unimodal biometric system which uses only a single biometric characteris-
tic and a multimodal biometric system which uses multiple biometric characteristics.
Building multimodal biometric systems has become an important research trend to
overcome several limitations of unimodal biometric systems such as unacceptable
performance in large-scale applications[1-5]. In this paper, both fingerprint and face
are chosen as the biometric characteristics for our multimodal biometric system. In
fact, there are many examples of multimodal biometric systems(such as border con-
trol[5]) employing both fingerprint and face information because fingerprint can pro-
vide a cost-effective, reasonable accurate solution and face can provide a non-
intrusive solution.
Another issue in using biometrics in remote applications is how to protect the
biometric information securely from unauthorized accesses. As mentioned above,
biometric techniques have inherent advantages over traditional personal verification
techniques. However, if biometric data(biometric raw data or biometric feature data)
have been compromised, a critical problem about confidentiality and integrity of the

R. Khosla et al. (Eds.): KES 2005, LNAI 3683, pp. 1049–1057, 2005.
© Springer-Verlag Berlin Heidelberg 2005
1050 Yongwha Chung et al.

individual biometric data can be raised. For verification systems based on physical
tokens, a compromised token can be easily canceled and the user can be assigned a
new token. Similarly, user IDs and passwords can be changed as often as required. On
the contrary, the biometric data cannot be changed easily since the user only has a
limited number of biometric features such as one face and ten fingers.
To provide secrecy and privacy of the biometric data in remote applications, sev-
eral techniques are possible such as cryptography and digital watermarking. The
straightforward approach to guarantee the confidentiality/integrity of the biometric
data is to employ the standard cryptographic techniques[6]. The biometric data is
encrypted prior to be transmitted to the server, and the server can execute the verifica-
tion procedure after decrypting the transmitted biometric data. The encrypted data is
secured since it would be useless to a pirate without an appropriate key. Unfortu-
nately, encryption does not provide secrecy once data is decrypted. In other words,
cryptography can protect biometric data in transit, but once decrypted, biometric data
has no further protection.
Digital watermarking can be considered as method for complement to cryptogra-
phy. Digital watermarking places information, called watermark, within the content,
called cover work. A watermark is never removed during normal usage and can be
designed to survive various attacks such as decryption, re-encryption, compression,
digital-to-analog conversion, and file format changes. Since watermarking involves
embedding information into the host data itself, it can provide secrecy even after de-
cryption. The watermark, which resides in the biometric data itself and is not related
to encryption-decryption operations, provides another line of defense against illegal
utilization of the biometric data[7]. For example, it can provide a tracking mechanism
for identifying the origin of the biometric data. Also, searching for the correct de-
coded watermark information during authentication can render the modification of the
data by a pirate useless, assuming that the watermark embedding-decoding system is
secure. Furthermore, encryption can be applied to the watermarked data, combining
the advantages of watermarking and encryption into a single system. As in [7], we
will focus on watermarking only in the remaining of this paper.
In general, traditional digital watermarking techniques considered for many copy
prevention and copyright protection applications may degrade the quality of the con-
tent, regardless of the difference between the original and watermarked versions of
the cover work. Since watermarking techniques used to increase the security of the
biometric data affects the verification accuracy of the biometric system due to that
quality degradation, the effects on biometric verification accuracy need to be consid-
ered in applying the watermarking techniques.
In this paper, we consider possible two scenarios and evaluate the effects of each
scenario on biometric verification accuracy. In the Scenario 1, we use the fingerprint
image as the cover work and hide the facial information(e.g., eigen-face coefficients)
into it. On the contrary, we hide the fingerprint information into the facial image in
the Scenario 2. After implementing each scenario, we measure the effects of water-
marking on biometric verification accuracy with various parameters.
The rest of the paper is structured as follows. Section 2 explains the overview of
multimodal biometric systems, the attack points in remote applications, and previous
biometric watermarking techniques. Section 3 describes the two scenarios considered
to provide the secrecy in the multimodal biometric system, and the results of perform-
 Hiding Biometric Data for Secure Transmission 1051

ance evaluation are described in Section 4. Finally, conclusions are given in Sec-
tion 5.

2 Background
2.1 Multimodal Biometric Systems
A biometric verification/identification system can be divided into two modes: a uni-
modal biometric system which uses only a single biometric characteristic and a mul-
timodal biometric system which uses multiple biometric characteristic. The multimo-
dal system could be, for instance, a combination of fingerprint verification, face rec-
ognition, voice verification or any other combination of biometrics.
The multimodal biometrics has become an important research trend to overcome
several limitations of the unimodal biometric system such as unacceptable perform-
ance and inability to operate on a large user population[8].
Multimodal biometric systems can be designed to operate in five integration sce-
narios : 1) multiple sensors, 2: multiple biometrics, 3) multiple units of the same bio-
metric, 4) multiple snapshots of the same biometric, 5) multiple representations and
matching algorithms for the same biometric[8].
Information presented by multiple traits may be consolidated at various levels. At
the feature extraction level, the data obtained from each sensor is used to compute a
feature vector. Integration at the feature extraction level is expected to perform better
than fusion at two other levels. However, this is not always the best solution. The
feature shapes of multiple biometrics may not be compatible and even if they are
compatible there is still a problem of combining the feature set. Concatenation could
result in a feature vector with a very large dimensionality. Fusion at the decision level
is considered to be rigid due to the availability of limited information.
In this paper, we integrate two different biometric characteristics, face and finger-
print, to identify people.

3 5
2 4 7
Biometric
Feature
Data Matcher System DB
Extractor
Acquisition

1 8 6

True/False
Sensor Client Server

Fig. 1. Illustration of the Attack Points[6].

2.2 Attack Points

As shown in Fig. 1, many of the possible attacks in the biometric verification system
were identified[2]: 1 attack at the sensor, 2 attack on the channel between the sensor
and the feature extractor, 3 attack on the feature extractor, 4 attack on the channel
between the feature extractor and the matcher, 5 attack on the matcher, 6 attack on
the system database, 7 attack on the channel between the system database and the
matcher, 8 attack on the channel between the matcher and the application requesting
verification. Details of these attacks are explained in [2].
1052 Yongwha Chung et al.

Note that the attacks 2,4,7 and 8 are launched against communication channels;
they are also similar in nature and can be collectively called “replay” attacks[2]. In
this paper, we focus on replay attack in the unsecure link of the multimodal biometric
system.

2.3 Biometric Watermarking

Traditionally, Digital watermarking is a technique that hides a secret digital pattern,
called a digital watermark, in a digital image, called cover work, or data.
Yeung and Pankanti[9] proposed a fragile invisible digital watermarking of finger-
print images based on a verification key that does not affect the recognition or re-
trieval accuracy in a fingerprint identification system. The fingerprints captured by
the scanner are watermarked by the scanner and any tampering of the image data can
be detected by the server using this method. Gunsel, Uludag and Tekalp[10] proposed
a robust invisible watermarking of fingerprint images where the watermark can be
verified even if the fingerprint image is cropped. Jain and Uludag[7] argued that when
the feature extractor sends the fingerprint features to the matcher over an unsecure
link, it may hide the fingerprint features in a cover work whose only purpose is to
carry the fingerprint feature data.
As mentioned above, most previous researches about biometric watermarking use
fingerprint image as cover work in order to increase integrity of the fingerprint image
or hide a fingerprint feature data into unrelated cover work to guarantee the confiden-
tiality of the fingerprint image.
In addition to capability of the watermarking technique, biometric watermarking
must consider that verification performance based on watermarked images may not be
inferior to the original non-watermarked images since embedding the watermark may
change the inherent characteristics of the host image.
Ideal solutions of a digital watermark have been proposed in many papers. Each
different watermarking technique has specific algorithm for the watermark embed-
ding, but a general form of the watermark embedding algorithm is according to fol-
lowing equation
IWM ( x, y ) = I ( x, y ) + k *W , (1)
where IWM ( x, y ) and I ( x, y ) are values of the watermarked and original pixels at
location ( x, y ) , respectively. The value of watermark bit is denoted as W and water-
mark embedding strength is denoted as k.

3 Hiding Biometric Data for Multimodal Biometric Systems

To hide biometric data using a fingerprint and a face, we first consider possible two
scenarios. Then, we evaluate the performance of each scenario.
In the Scenario 1, we use a fingerprint image as the cover work and hide the facial
information(e.g., eigen-face coefficients) into the fingerprint image. On the contrary,
we hide the fingerprint information into the facial image in the Scenario 2. That is,
in the equation (1), W is minutiae of the fingerprint image in the Scenario 1 and
eigenface coefficients of the facial image in the Scenario 2.
 Hiding Biometric Data for Secure Transmission 1053

3.1 Hiding Facial Features into Fingerprint Images

In the multimodal biometric system considered, two biometric data(fingerprint and
facial images) are acquired from biometric sensors and the facial features(e.g., eigen-
face coefficients) are extracted to be used as watermarks. Finally, the embeddding site
embeds the facial features into the fingerprint image. After detecting the facial fea-
tures from the received watermarked fingerprint image, the detecting site calculates a
similarity between the facial features stored and the facial features extracted. The
detecting site also executes the fingerprint verification module with the watermarked
fingerprint image received. The results of face and fingerprint verification modules
can be consolidated by various fusion techniques such as majority voting to improve
the verification accuracy of unimodal biometric systems.
Note that, in the Scenario 1, the accuracy of the face verification module is not
affected by watermarking, whereas the accuracy of the fingerprint verification module
can be affected by watermarking. To minimize the degradation of the accuracy of the
fingerprint verification module, we use the embedding method proposed by Jain and
Uludag[7]. That is, possible pixel locations for embedding are determined first by
considering either minutiae or ridge information of the fingerprint image. Then, a bit
stream obtained from the eigenface coefficients is embedded into the fingerprint im-
age according to the possible pixel locations. This watermarking method, however,
has several disadvantages. Because it is a type of informed watermarking, the minu-
tiae or the ridge information is also needed in the detecting site.
We use our fingerprint verification algorithm[11] to evaluate the effects on finger-
print verification accuracy with the watermarked fingerprint image, and the result of
evaluation will be described in section 4.

Watermarked
Fingerprint Image
(Cover Work)

Watermark Watermark Multimodal

Embedder Detector Verification

Facial Image Facial Feature

(Watermark)

Facial Feature
(Watermark)

Fingerprint Image
Embedding Site (Cover Work) Detecting Site

Fig. 2. Diagram of Scenario 1

3.2 Hiding Fingerprint Features into Facial Images

In the Scenario 2, shown Fig. 3, the fingerprint features(e.g., minutiae) used as wa-
termarks are extracted at the embedding site. Then, the minutiae are embedded into a
facial image(cover work). After extracting the minutiae from the received water-
marked image, the detecting site calculates a similarity between the minutiae stored
and the minutiae extracted. The detecting site also executes the face verification mod-
ule with the received facial image.
1054 Yongwha Chung et al.

Watermarked
Facial Image
(Cover Work)

Watermark Watermark Multimodal

Embedder Detector Verification

Fingerprint Image Fingerprint Feature

(Watermark)

Fingerprint Feature
(Watermark)
Facial Image
(Cover Work)

Embedding Site Detecting Site

Fig. 3. Diagram of Scenario 2

To evaluate the effects on face verification accuracy with the watermarked facial
image, two face verification algorithms are used: Principal Component Analy-
sis(PCA)[12] and our face verification algorithm[13]. The PCA for face recognition is
known as a global method[12] since it extracts facial features by using the bases de-
scribing a whole face. The bases are eigenvectors of the covariance matrix of the face
images and can be regarded as face models, called eigenfaces. By projecting a face
image onto the eigenfaces, the linear combination weights for eigenfaces are calcu-
lated. Then, these weights are used as a representation of the face. Although PCA
method is simple and fast, there are some limitations in recognition under illumination
and pose variations.
Our face verification method, called Composite Template, is based on Local Fea-
ture Analysis(LFA). LFA is known as a local method for face recognition since it
constructs kernels detecting local structures of a face. However, LFA itself addresses
image representation only and has some problems for recognition. By modifying
LFA, we can get a new feature extraction method. Our method consists of three steps.
After extracting local structures using LFA, we select a subset of them which is effi-
cient for recognition. Then, the local structures are combined to represent them into a
more compact form.
The result of evaluation that evaluates the effects on face verification accuracy
with the watermarked facial image also will be described in the next section.

4 Performance Evaluation
To evaluate the effects on verification accuracy with watermarked images, we meas-
ure the accuracy of face and fingerprint verification with watermarked and non-
watermarked biometric data. For the purpose of evaluating of the fingerprint verifica-
tion accuracy, a data set of 4,272 fingerprint images composed of four fingerprint
images per one finger was collected from 1,068 individuals by using the optical fin-
gerprint sensor[14]. The resolution of the sensor was 500dpi, and the size of captured
fingerprint images was 248×292.
 Hiding Biometric Data for Secure Transmission 1055

As explained in section 3, we considered both minutiae and ridge information of

the fingerprint image to decide the pixel locations for embedding. Fig. 4(a) represents
an input fingerprint image and and 4(d) represents a fingerprint image with overlaid
minutiae. Fig. 4(b) and 4(e) correspond to the ridge-based watermarking. That is, the
input image shown in Fig. 4(a) is watermarked without changing the pixels shown in
black in Fig. 4(b). Fig. 4(c) and 4(f) correspond to the minutiae-based watermarking.
That is, the input image in Fig. 4(a) is watermarked without changing the pixels
shown in black in Fig. 4(c). In the Scenario 1, the strength k in the equation (1) was
selected as 0.06 because it is the most proper value for invisible watermarking as an
experiment. Thus, human’s eyes cannot distinguish any change of the fingerprint
image caused by embedding watermarks.

(a) (b) (c) (d) (e) (f)

Fig. 4. Embedding Facial features to a fingerprint image: (a) an input fingerprint image, (b)
fingerprint features based on the ridges, (c) fingerprint features based on the minutiae, (d) an
input fingerprint image with overlaid minutiae, (e) a watermarked fingerprint image with over-
laid minutiae generated from considering the ridge information of (b), (f) a watermarked fin-
gerprint image with overlaid minutiae generated from considering the minutiae information of
(c).

Fig. 5 shows four ROC(Receiver Operating Characteristic) curves for fingerprint

verification. As shown Fig. 5, either the minutiae-based(represented as “Min Mask”
in Fig. 5) or the ridge-based(represented as “Ridge Mask” in Fig. 5) watermarking
methods introduce some degradation from the fingerprint verification accuracy of the
non-watermarked case(represented as “Original” in Fig. 5) Note that both methods
provided better accuracy than a method which did not consider the fingerprint fea-
tures(represented as “No Mask” in Fig. 5).

100%

95%

90%
GAR

85%
O riginal

No Mask
80% Min Mask

Ridge Mask

75%

70%
0.00% 0.30% 0.60% 0.90% 1.20% 1.50%

FAR

Fig. 5. ROC curves for the fingerprint verification performance

1056 Yongwha Chung et al.

(a) input face image (b) k=0.06 (c) k=0.12 (d) k=0.24
Fig. 6. Facial images embedding the fingerprint features with various strength k

100% 100%

90% 90%

80% 80%

70% 70% Non- Watermarked

GAR
GAR

0.06
60% Non- Watermarked 60%
0. 06 0.09

50% 0. 09 50% 0.12

0. 12
40% 0. 25 40% 0.25

30% 30%

20% 20%
0% 10% 20% 30% 40% 50% 60% 70% 0% 10% 20% 30% 40% 50% 60% 70%

FAR FAR

(a) (b)
Fig. 7. ROC curves for the face verification: (a) Composite Template using watermarked facial
images with various strength k, (b) PCA using watermarked facial images with various
strength k.

For the purpose of evaluating the face verification accuracy, a data set was col-
lected from 55 people and composed of 20 facial images per one individual. The im-
ages from 20 people were used to construct bases for feature extraction, and the im-
ages from the rest were used for training(gallery) and test(probe). The size of images
was 64×64, a simple Euclidean distance was adopted for computing a similarity.
To evaluate the effects on face verification accuracy with and without watermark-
ing, we embedded the fingerprint feature into the facial image with various strength k
explained in section 2. Fig. 6(a) represents an input facial image, and Fig. 6(b), 6(c)
and 6(d) represent watermarked image with k=0.06, 0.12 and 0.24, respectively. With
larger k(shown in Fig. 6(d)), a serious distortion of image quality can be found.
Fig. 7 shows ROC curves for face verification. In spite of serious distortion of im-
age quality, the effects on verification accuracy with the PCA method are negligible.
This is because the PCA method uses global information of face images. On the con-
trary, the Composite Template method using both local & global information of face
images showed some degradation. However, the amount of degradation may be ac-
ceptable compared to the Scenario 1.

5 Conclusions
Biometrics are expected to be widely used in conjunction with other techniques such
as the cryptography and digital watermarking on the network. For large-scale, remote
user authentication services, the verification accuracy issue as well as the secu-
rity/privacy issue should be managed. In this paper, the effects of watermarking on
biometric verification accuracy were examined where both fingerprint and face char-
acteristics were used simultaneously for accurate verification.
 Hiding Biometric Data for Secure Transmission 1057

We first defined scenarios of the watermarking in the multimodal biometric sys-

tem. Then, we analyzed the effects of watermarking in each scenario on the verifica-
tion accuracy with various parameters. The experimental results show that the biomet-
ric features used as the watermark can be detected accurately in each scenario and the
biometric verification accuracy is not affected by the detected biometric features.
However, the verification accuracy of the biometric data used as the cover work may
be degraded. Especially, the fingerprint verification accuracy in the Scenario 1 can
be affected more sensitively than the face verification accuracy in the Scenario 2.

Acknowledgement
This research was supported by the MIC (Ministry of Information and Communica-
tion), Korea, under the Chung-Ang University HNRC-ITRC (Home Network Re-
search Center) support program supervised by the IITA(Institute of Information
Technology Assessment

References
1. A. Jain, R. Bole, and S. Panakanti, Biometrics: Personal Identification in Networked Soci-
ety, Kluwer Academic Publishers, 1999.
2. D. Maltoni, et al., Handbook of Fingerprint Recognition, Springer, 2003.
3. R. Bolle, J. Connell, and N. Ratha, “Biometric Perils and Patches,” Pattern Recognition,
Vol. 35, pp. 2727-2738, 2002.
4. B. Schneier, “The Uses and Abuses of Biometrics,” Communications of the ACM, Vol. 42,
No, 8, pp. 136, 1999.
5. P. Verga, "DoD Biometrics and Homeland Defense," Proc. of Biometric Consortium Con-
ference, 2004
6. W. Stallings, Cryptography and Network Security, Pearson Ed. Inc., 2003.
7. Jain A.K., Uludag U., and Hsu R.L., “Hiding a Face in a fingerprint Image,” Proc. of Int.
Conf. On Pattern Recognition, vol. 3, pp. 756-759, 2002.
8. A. Ross and A. K. Jain, "Multimodal Biometrics: An Overview," Proc. of 12th European
Signal Processing Conference (EUSIPCO), pp. 1221-1224, 2004.
9. Yeung M. and Pankanti S., “Verification Watermarks on fingerprint Recognition and Re-
trieval,” Journal of Electronic Imaging, vol. 9, no. 4, pp. 468-476, 2000.
10. Gunsel B., Uludag B., and Tekalp A.M., “Robust Watermarking of Fingerprint Image,”
Pattern Recognition, vol. 35, no. 12, pp. 2739-2748, 2002.
11. S. Pan, et al., “A Memory-Efficient Fingerprint Verification Algorithm using A Multi-
Resolution Accumulator Array for Match-on-Card,” ETRI Journal, Vol. 25, No. 3, pp. 179-
186, 2003.
12. Turk, M.A., Petland, A.P., “Face recognition using eigenface,” Proc. of IEEE Conf. on
Computer Vision and Pattern Recognition, Maui, Hawaii (1991)
13. Y. Lee, et al., “Local and Global Feature Extraction for Face Recognition,” To be published
on Proc. of Int'l Conf on Audio- and Video-Based Person Authentication 2005(AVBPA),
New York, USA, July 20-22, 2005
14. NiGen, http://www.nitgen.com