Identification Based on Encrypted Biometric Data

• US 20100281269A1
• Filed: 12/19/2008
• Published: 11/04/2010
• Est. Priority Date: 12/21/2007
• Status: Active Grant

• Current Assignee: IDEMIA Identity and Security France SAS (Advent International Corporation)
• Original Assignee: Morpho (Advent International Corporation)
• Inventors: Bringer, Julien, Kindarji, Bruno, Chabanne, Hervé
• Granted Patent: US 8,700,912 B2
• Time in Patent Office: Days
• US Class Current: 713/182
• CPC Class Codes: G06V 40/10 Human or animal bodies, e.g. vehicle occupants or pedestrians; Body parts, e.g. hands
• CPC Class Codes: G06V 40/1365 Matching; Classification
• CPC Class Codes: G06V 40/18 Eye characteristics, e.g. of the iris
• CPC Class Codes: G06V 40/53 Measures to keep reference information secret, e.g. cancellable biometrics
• CPC Class Codes: H04L 2209/805 Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
• CPC Class Codes: H04L 9/3231 Biological data, e.g. fingerprint, voice or retina network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861
• CPC Class Codes: H04L 9/3236 using cryptographic hash functions

Abstract

A database comprising biometric data stored in encrypted form is managed by a management unit. It comprises a set of filters respectively associated with filter identifiers. A biometric data item is received at a management unit; next, said biometric data item is stored in an encrypted form at a given address in the database. Then keywords are obtained on the basis of a first set of hash functions and of the biometric data item. A subset of indexing filters is associated with each keyword by selecting, for each keyword, filters as a function of the respectively associated filter identifiers, of said keywords, and of a second set of hash functions; and the given address is associated with each of the filters of the subset of filters.

Claims

1. A management process for a database comprising biometric data stored in encrypted form,

said database comprising a set of filters (B1, . . . , Bm) respectively associated with filter identifiers;

wherein said process comprises the following steps at a management unit;

/1/receiving a biometric data item;

/2/storing, at a given address in the database, said biometric data item in encrypted form;

/3/obtaining keywords based on a first set of hash functions and on said biometric data item;

/4/associating a subset of indexing filters with each keyword by selecting filters for each keyword as a function of the respectively associated filter identifiers, of said keywords, and of a second set of hash functions; and

/5/associating said given address in encrypted form with each of the filters in the subset of indexing filters.

2. A management process according to claim 1, wherein step /3/is implemented by the following steps:

obtaining respective first hash values by applying the first set of hash functions to the biometric data item;

obtaining said keywords by respectively combining said first hash values with respective identifiers of the hash functions in the first set.

3. A management process according to either of claim 1, wherein step /4/is implemented by the following steps:

obtaining second hash values by respectively applying the second set of hash functions to the keywords;

selecting each filter from the subset of indexing filters with which is associated a filter identifier which corresponds to said second hash values.

4. A management process according to claim 1, wherein a first family and a second family of hash functions are initially determined, and wherein the first set and the second set of hash functions are respectively a subpart of said first family and second family of hash functions.

5. A management process according to claim 1, wherein step /4/is also implemented on the basis of an error limit.

6. A management process according to claim 1, wherein the first set of hash functions is of the LSH type and the second set of hash functions is of the cryptographic type.

7. A management process according to claim 1, wherein the filters in the set of filters are Bloom filters.

8. An identification process for identifying biometric data in a database managed by a management process according to any one of the above claims, said database comprising a structure based on filters (B1, . . . , Bm);

wherein said process comprises the following steps at an identification unit (13) which has access to the database;

/i/ receiving a query indicating hashed keywords;

/ii/ in the database, determining filters associated with said hashed keywords;

/iii/ obtaining a list of database addresses in encrypted form which are respectively associated with said determined filters;

/iv/ deciding that the keywords have a correspondence in the database, when a same address in said list of addresses is associated with at least a determined number of filters.

9. An identification process for a database according to claim 8, wherein the hashed keywords are received from a transmitter, said transmitter having obtained the hashed keyword by the following steps:

capturing a biometric data item;

obtaining hash values by respectively applying a third set of hash functions to said captured biometric data item;

obtaining the keywords by respectively combining said first hash values with respective identifiers of hash functions in the third set; and

obtaining hashed keywords by applying a fourth set of hash functions to said keywords.

10. An identification process according to claim 9, wherein the first and third sets of hash functions come from a first family of hash functions and the second and fourth sets of hash functions come from a second family of hash functions.

11. A database management unit adapted to implement a database management process according to claim 1.

12. An identification unit adapted to implement an identification process according to claim 8.

13. An identification system comprising a database management unit according to claim 11, a database, and an identification unit.