Biometric identity verification using on-line & off-line signature verification

Biometrics is the utilization of biological characteristics (face, iris, fingerprint) or behavioral traits (signature, voice) for identity verification of an individual. Biometric authentication is gaining popularity as a more trustable alternative to password-based security systems as it is relatively hard to be forgotten, stolen, or guessed. Signature is a behavioral biometric: it is not based on the physical properties, such as fingerprint or face, of the individual, but behavioral ones. As such, one's signature may change over time and it is not nearly as unique or difficult to forge as iris patterns or fingerprints, however signature's widespread acceptance by the public, make it more suitable for certain lower-security authentication needs. Signature verification is split into two according to the available data in the input. Off-line signature verification takes as input the image of a signature and is useful in automatic verification of signatures found on bank checks and documents. On-line signature verification uses signatures that are captured by pressure-sensitive tablets and could be used in real time applications like credit card transactions or resource accesses. In this work we present two complete systems for on-line and off-line signature verification. During registration to either of the systems the user has to submit a number of reference signatures which are cross aligned to extract statistics describing the variation in the user's signatures. Both systems have similar verification methodology and differ only in data acquisition and feature extraction modules. A test signature's authenticity is established by first aligning it with each reference signature of the claimed user, resulting in a number of dissimilarity scores: distances to nearest, farthest and template reference signatures. In previous systems, only one of these distances, typically the distance to the nearest reference signature or the distance to a template signature, was chosen, in an ad-hoc manner, to classify the signature as genuine or forgery. Here we propose a method to utilize all of these distances, treating them as features in a two-class classification problem, using standard pattern classification techniques. The distances are first normalized, resulting in a three dimensional space where genuine and forgery signature distributions are well separated. We experimented with the Bayes classifier, Support Vector Machines, and a linear classifier used in conjunction with Principal Component Analysis, to classify a given signature into one of the two classes (forgery or genuine). Test data sets of 620 on-line and 100 off-line signatures were constructed to evaluate performances of the two systems. Since it is very difficult to obtain real forgeries, we obtained skilled forgeries which are supplied by forgers who had access to signature data to practice before forging. The online system has a 1.4% error in rejecting forgeries, while rejecting only 1.3% of genuine signatures. As an offine signature is easier to forge, the offine system's performance is lower: a 25% error in rejecting forgery signatures and 20% error in rejecting genuine signatures. The results for the online system show significant improvement over the state-of-the-art results, and the results for the offline system are comparable with the performance of experienced human examiners

Privacy protecting biometric authentication systems

As biometrics gains popularity and proliferates into the daily life, there is an increased concern over the loss of privacy and potential misuse of biometric data held in central repositories. The major concerns are about i) the use of biometrics to track people, ii) non-revocability of biometrics (eg. if a fingerprint is compromised it can not be canceled or reissued), and iii) disclosure of sensitive information such as race, gender and health problems which may be revealed by biometric traits. The straightforward suggestion of keeping the biometric data in a user owned token (eg. smart cards) does not completely solve the problem, since malicious users can claim that their token is broken to avoid biometric verification altogether. Put together, these concerns brought the need for privacy preserving biometric authentication methods in the recent years. In this dissertation, we survey existing privacy preserving biometric systems and implement and analyze fuzzy vault in particular; we propose a new privacy preserving approach; and we study the discriminative capability of online signatures as it relates to the success of using online signatures in the available privacy preserving biometric verification systems. Our privacy preserving authentication scheme combines multiple biometric traits to obtain a multi-biometric template that hides the constituent biometrics and allows the possibility of creating non-unique identifiers for a person, such that linking separate template databases is impossible. We provide two separate realizations of the framework: one uses two separate fingerprints of the same individual to obtain a combined biometric template, while the other one combines a fingerprint with a vocal pass-phrase. We show that both realizations of the framework are successful in verifying a person's identity given both biometric traits, while preserving privacy (i.e. biometric data is protected and the combined identifier can not be used to track people). The Fuzzy Vault emerged as a promising construct which can be used in protecting biometric templates. It combines biometrics and cryptography in order to get the benefits of both fields; while biometrics provides non-repudiation and convenience, cryptography guarantees privacy and adjustable levels of security. On the other hand, the fuzzy vault is a general construct for unordered data, and as such, it is not straightforward how it can be used with different biometric traits. In the scope of this thesis, we demonstrate realizations of the fuzzy vault using fingerprints and online signatures such that authentication can be done while biometric templates are protected. We then demonstrate how to use the fuzzy vault for secret sharing, using biometrics. Secret sharing schemes are cryptographic constructs where a secret is split into shares and distributed amongst the participants in such a way that it is constructed/revealed only when a necessary number of share holders come together (e.g. in joint bank accounts). The revealed secret can then be used for encryption or authentication. Finally, we implemented how correlation attacks can be used to unlock the vault; showing that further measures are needed to protect the fuzzy vault against such attacks. The discriminative capability of a biometric modality is based on its uniqueness/entropy and is an important factor in choosing a biometric for a large-scale deployment or a cryptographic application. We present an individuality model for online signatures in order to substantiate their applicability in biometric authentication. In order to build our model, we adopt the Fourier domain representation of the signature and propose a matching algorithm. The signature individuality is measured as the probability of a coincidental match between two arbitrary signatures, where model parameters are estimated using a large signature database. Based on this preliminary model and estimated parameters, we conclude that an average online signature provides a high level of security for authentication purposes. Finally, we provide a public online signature database along with associated testing protocols that can be used for testing signature verification system