Identification based on encrypted biometric data

• US 8,700,912 B2
• Filed: 12/19/2008
• Issued: 04/15/2014
• Est. Priority Date: 12/21/2007
• Status: Active Grant

• Current Assignee: IDEMIA Identity and Security France SAS (Advent International Corporation)
• Original Assignee: Morpho (Advent International Corporation)
• Inventors: Kindarji, Bruno, Chabanne, Herv, Bringer, Julien
• Primary Examiner(s): POWERS, WILLIAM S
• Application Number:
  US12/809,848
• Publication Number:
  US 20100281269A1
• Time in Patent Office: 1,943 Days
• Field of Search: None
• US Class Current: 713/186
• CPC Class Codes: G06V 40/10 Human or animal bodies, e.g. vehicle occupants or pedestrians; Body parts, e.g. hands
• CPC Class Codes: G06V 40/1365 Matching; Classification
• CPC Class Codes: G06V 40/18 Eye characteristics, e.g. of the iris
• CPC Class Codes: G06V 40/53 Measures to keep reference information secret, e.g. cancellable biometrics
• CPC Class Codes: H04L 2209/805 Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
• CPC Class Codes: H04L 9/3231 Biological data, e.g. fingerprint, voice or retina network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861
• CPC Class Codes: H04L 9/3236 using cryptographic hash functions

Abstract

A database comprising biometric data stored in encrypted form is managed by a management unit. It comprises a set of filters respectively associated with filter identifiers. A biometric data item is received at a management unit; next, said biometric data item is stored in an encrypted form at a given address in the database. Then keywords are obtained on the basis of a first set of hash functions and of the biometric data item. A subset of indexing filters is associated with each keyword by selecting, for each keyword, filters as a function of the respectively associated filter identifiers, of said keywords, and of a second set of hash functions; and the given address is associated with each of the filters of the subset of filters.

Claims

1. A management method for storing and indexing biometric data in a database in encrypted form, said database comprising a set of filters (B1, . . . , Bm) respectively associated with filter identifiers;

wherein said management method comprises the following steps at a management unit;

/1/ receiving a biometric data item;

/2/ storing, at a given address in the database, said biometric data item in encrypted form;

/3/ obtaining keywords based on a first set of hash functions and on said biometric data item;

/4/ associating a subset of indexing filters with each keyword by selecting filters for each keyword as a function of the respectively associated filter identifiers, of said keywords, and of a second set of hash functions; and

/5/ associating said given address in encrypted form with each of the filters in the subset of indexing filters.

2. The management method of claim 1, wherein step /3/ is implemented by the following steps:

obtaining respective first hash values by applying the first set of hash functions to the biometric data item;

obtaining said keywords by respectively combining said first hash values with respective identifiers of the hash functions in the first set of hash functions.

3. The management method of claim 1, wherein step /4/ is implemented by the following steps:

obtaining second hash values by respectively applying the second set of hash functions to the keywords;

selecting each filter from the subset of indexing filters with which is associated a filter identifier which corresponds to said second hash values.

4. The management method of claim 1, wherein a first family and a second family of hash functions are initially determined, and wherein the first set and the second set of hash functions are respectively a subpart of said first family and second family of hash functions.

5. The management method of claim 1, wherein step /4/ is also implemented on the basis of an error limit.

6. The management method of claim 1, wherein the first set of hash functions is of the LSH type and the second set of hash functions is of the cryptographic type.

7. The management method of claim 1, wherein the filters in the set of filters are Bloom filters.

8. An identification method for identifying biometric data in a database managed by the management method of claim 3, said database comprising a structure based on filters (B1, . . . , Bm);

wherein said identification method comprises the following steps at an identification unit which has access to the database;

/i/ receiving a query indicating hashed keywords;

/ii/ in the database, determining filters associated with said hashed keywords;

/iii/ obtaining a list of database addresses in encrypted form which are respectively associated with said determined filters;

/iv/ deciding that the keywords have a correspondence in the database, when a same address in said list of database addresses is associated with at least a determined number of filters.

9. The identification method of claim 8, wherein the hashed keywords are received from a transmitter, said transmitter having obtained the hashed keyword by the following steps:

capturing a biometric data item;

obtaining hash values by respectively applying a third set of hash functions to said captured biometric data item;

obtaining the keywords by respectively combining said first hash values with respective identifiers of hash functions in the third set; and

obtaining hashed keywords by applying a fourth set of hash functions to said keywords.

10. The identification method of claim 9, wherein the first and third sets of hash functions come from a first family of hash functions and the second and fourth sets of hash functions come from a second family of hash functions.

11. A database management unit adapted to implement the management method of claim 1.

12. An identification unit adapted to implement the identification method of claim 8.

13. An identification system comprising the database management unit of claim 11, a database, and an identification unit.