Biometrics-based cryptographic key generation system and method

• US 7,804,956 B2
• Filed: 03/11/2005
• Issued: 09/28/2010
• Est. Priority Date: 10/15/2004
• Status: Active Grant

• Current Assignee: A10 Networks Incorporated
• Original Assignee: Industrial Technology Research Institute
• Inventors: Chen, Tsu-Han, Zhang, Wen-De, Chang, Yao-Jen
• Primary Examiner(s): Orgad; Edan
• Assistant Examiner(s): SHAW, YIN CHEN
• Application Number:
  US11/077,014
• Publication Number:
  US 20060083372A1
• Time in Patent Office: 2,027 Days
• Field of Search: 380/44, 382/100, 382115-119, 704/230, 704/231, 704/237, 713/186
• US Class Current: 380/44
• CPC Class Codes: H04L 9/0866 involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics

Abstract

The present invention provides a biometrics-based cryptographic key generation system and method. A user-dependent distinguishable feature transform unit provides a feature transformation for each authentic user, which receives N-dimensional biometric features and performs a feature transformation to produce M-dimensional feature signals, such that the transformed feature signals of the authentic user are compact in the transformed feature space while those of other users presumed as imposters are either diverse or far away from those of the authentic user. A stable key generation unit receives the transformed feature signals to produce a cryptographic key based on bit information respectively provided by the M-dimensional feature signals, wherein the length of the bit information provided by the feature signal of each dimension is proportional to the degree of distinguishability in the dimension.

Claims

1. A biometrics-based cryptographic key generation system including a cryptographic key generation mechanism implemented on a computer by a set of instructions stored in a non-transitory computer-readable medium, said cryptographic key generation mechanism comprising:

a user-dependent distinguishable feature transform unit included in said key generation mechanism for providing each authentic user a specific feature transformation trained with biometric features from both authentic user and non-authentic users, and receiving N-dimensional biometric features for performing the feature transformation to produce M-dimensional feature signals according to a cascaded linear discriminant analysis (CLDA) obtained by repeating a linear discriminant analysis multiple times, such that the transformed feature signals of the authentic user are compact in a transformed feature space while the transformed feature signals of non-authentic users presumed as imposters are diverse and far from the transformed feature signals of the authentic user; and

a stable key generation unit included in said key generation mechanism for receiving the transformed feature signals to produce a cryptographic key based on bit information respectively provided by the M-dimensional feature signals, wherein a length of the bit information provided by the feature signal of each dimension is proportional to a degree of distinguishability determined by a compactness of a feature distribution of the authentic user with respect to a diversity of global feature distribution of all users in a corresponding dimension.

2. The system as claimed in claim 1, wherein the stable key generation unit produces the cryptographic key by cascading the bit information provided by the M-dimensional feature signals.

3. The system as claimed in claim 1, wherein the user-dependent distinguishable feature transform unit transforms the N-dimensional biometric features to M-dimensional feature signals according to a generalized symmetric max minimal distance in subspace (GSMMS) criterion.

4. A biometrics-based cryptographic key generation method implemented on a computer that includes a key generation mechanism, said method comprising:

a user-dependent distinguishable feature transform step implemented by a user-dependent distinguishable feature transform unit of the key generation mechanism for providing each authentic user a specific feature transformation trained with biometric features from both the authentic user and non-authentic users, and receiving N-dimensional biometric features for performing the feature transformation to produce M-dimensional feature signals according to a cascaded linear discriminant analysis (CLDA) obtained by repeating a linear discriminant analysis multiple times, such that the transformed feature signals of the authentic user are compact in a transformed feature space while the transformed feature signals of non-authentic users presumed as imposters are diverse and far from the transformed feature signals of the authentic user; and

a stable key generation step implemented by a stable key generation unit of the key generation mechanism for receiving the transformed feature signals to produce a cryptographic key based on bit information respectively provided by the M-dimensional feature signals, wherein a length of the bit information provided by the feature signal of each dimension is proportional to a degree of distinguishability determined by a compactness of a feature distribution of the authentic user with respect to a diversity of global feature distribution of all users in a corresponding dimension.

5. The method as claimed in claim 4, wherein the user-dependent distinguishable feature transform step transforms the N-dimensional biometric features to M-dimensional feature signals according to a generalized symmetric max minimal distance in subspace (GSMMS) criterion.

6. A biometrics-based cryptographic key generation method implemented on computer including a key generation mechanism, said method comprising:

a user-dependent distinguishable feature transform step implemented by a user-dependent distinguishable feature transform unit of the key generation mechanism for providing each authentic user a specific feature transformation trained with biometric features from both the authentic user and non-authentic users, and receiving N-dimensional biometric features for performing the feature transformation to produce M-dimensional feature signals, such that the transformed feature signals of the authentic user are compact in a transformed feature space while the transformed feature signals of imposters are diverse and far from the transformed feature signals of the authentic user; and

a stable key generation step implemented by a stable key generation unit of the key generation mechanism for receiving the transformed feature signals to produce a cryptographic key based on bit information respectively provided by the M-dimensional feature signals, the stable key generation step including;

a setting step for setting a left boundary and a right boundary of a feature signal distribution in each dimension, and defining an authentic region of an authentic feature signal distribution,

a distinguishing step for dividing at least one segment between the left boundary and the right boundary in a corresponding dimension according to an authentic region, where a length of each segment is proportional to the authentic region,

an index specifying step for specifying the segment with an index thereby obtaining authentic bit information provided by the feature signal in a corresponding dimension, and

a cascading step for cascading the bit information provided by the feature signal in each corresponding dimension for obtaining a cryptographic key,

wherein a length of the bit information provided by the feature signal of each dimension is proportional to a degree of distinguishability in the corresponding dimension and the setting step sets the left boundary of the feature signal distribution in each dimension as LB=min(m_g−

k_gσ

_g,m_a−

k_aσ

_a,), and sets the right boundary as RB=max(m_g+k_gσ

_g,m_a+k_aσ

_a,), where m_a and σ

_a are mean and standard deviation of an authentic feature signal distribution in the corresponding dimension, m_g and σ

_g are mean and standard deviation of a global feature signal distribution in the corresponding dimension, k_a and k_g are parameters, and (m_a−

k_aσ

_a,m_a+k_aσ

_a) is specified as the authentic region.

7. The method as claimed in claim 6, wherein k_g is a fixed value parameter.

8. The method as claimed in claim 6, wherein k_a is a fixed value parameter for each dimension.

9. The method as claimed in claim 6, wherein k_a is defined as different parameters for different dimensions.

10. The method as claimed in claim 9, wherein k_a is defined according to a receiver operation characteristic (ROC) curve optimization.

11. The method as claimed in claim 6, wherein in the distinguishing step, LS=┌

(m_a−

k_aσ

_a−

LB)/(2 k_aσ

_a)┐

segments of the same size as the authentic region are divided between the left boundary of the feature signal distribution and the left boundary (m_a−

k_aσ

_a) of the authentic region, and RS=┌

(RB−

m_a−

k_aσ

_a)/(2k_aσ

_a)┐

segments of the same size as the authentic region are divided between the right boundary (m_a+k_aσ

_a) of the authentic region and the right boundary of the feature signal distribution, such that (LS+RS+1) segments are divided between the left boundary and the right boundary of the feature signal distribution.

12. The method as claimed in claim 11, wherein the index specifying step assigns each segment with the index according to ┌

log₂ (LS+RS+1)┐

bits.

13. A biometrics-based cryptographic key generation system including a cryptographic key generation mechanism implemented on a computer by a set of instructions stored in a non-transitory computer-readable medium, said cryptographic key generation mechanism, comprising:

a user-dependent distinguishable feature transform unit implemented in said key generation mechanism for providing each authentic user a specific feature transformation trained with biometric features from both authentic user and non-authentic users, and receiving N-dimensional biometric features for performing the feature transformation to produce M-dimensional feature signals, such that the transformed feature signals of the authentic user are compact in a transformed feature space while the transformed feature signals of non-authentic users presumed as imposters are diverse and far from the transformed feature signals of the authentic user; and

a stable key generation unit implemented in said key generation mechanism for receiving the transformed feature signals to produce a cryptographic key based on bit information respectively provided by the M-dimensional feature signals, wherein a length of the bit information provided by the feature signal of each dimension is proportional to a degree of distinguishability determined by a compactness of a feature distribution of the authentic user with respect to a diversity of global feature distribution of all users in a corresponding dimension,

wherein the stable key generation unit divides at least one segment between a left boundary and a right boundary of a feature space in each dimension according to the authentic region of the authentic feature signal distribution, and specifies the segment with an index, thereby obtaining the authentic bit information provided by the feature signal in the corresponding dimension, where the left boundary of is defined as LB=min(m_g−

k_gσ

_g,m_a−

k_aσ

_a), the right boundary is defined as RB=max(m_g+k_gσ

_g, m_a+k_aσ

_a), and the authentic region is defined as (m_a−

k_aσ

_a, m_a+k_aσ

_a), for m_a and σ

_aare the mean and standard deviation of the authentic feature signal distribution in the corresponding dimension, m_g and σ

_g are the mean and standard deviation of a global feature signal distribution in the corresponding dimension, and k_a and k_g are parameters.

14. A biometrics-based cryptographic key generation method implemented on a computer device having a key generating mechanism, comprising:

a user-dependent distinguishable feature transform step implemented by a user-dependent distinguishable feature transform unit of the key generation mechanism for providing each authentic user a specific feature transformation trained with biometric features from both the authentic user and non-authentic users, and receiving N-dimensional biometric features for performing the feature transformation to produce M-dimensional feature signals, such that the transformed feature signals of the authentic user are compact in a transformed feature space while the transformed feature signals of non-authentic users presumed as imposters are diverse and far from the transformed feature signals of the authentic user; and

a stable key generation step implemented by a stable key generation unit of the key generation mechanism for receiving the transformed feature signals to produce a cryptographic key based on bit information respectively provided by the M-dimensional feature signals, wherein a length of the bit information provided by the feature signal of each dimension is proportional to a degree of distinguishability determined by a compactness of the feature distribution of the authentic user with respect to a diversity of global feature distribution of all users in a corresponding dimension,

wherein the stable key generation step comprises;

a setting step for setting a left boundary and a right boundary of the feature signal distribution in each dimension as LB+min (m_g−

k_gσ

_g, m_a−

k_aσ

_a) and RB=max(m_g+k_gσ

_g, m_a+k_aσ

_a) respectively, where m_a and σ

_a are mean and standard deviation of the authentic feature signal distribution in the corresponding dimension, m_g and σ

_g are mean and standard deviation of a global feature signal distribution in the corresponding dimension, k_a and k_g are parameters, and (m_a−

k_aσ

_a, m_a+k_aσ

_a) is specified as an authentic region;

a distinguishing step for dividing at least one segment between the left boundary and the right boundary in the corresponding dimension according to the authentic region, wherein a length of each segment is proportional to the length of the authentic region;

an index specifying step for specifying each segment with an index thereby obtaining authentic bit information provided by the feature signal in the corresponding dimension, wherein the length of bit information is proportional to a degree of distinguishability in the dimension; and

a cascading step for cascading the bit information provided by the feature signal in each corresponding dimension for obtaining a cryptographic key.

15. The method as claimed in claim 14, wherein the cascading step cascades the bit information provided by the M-dimensional feature signals.