Privacy & Security Issues Related to Match Scores

Security and privacy issues remains a major hurdle in wide deployment of biometric based authentication system. For example, unauthorized access or regeneration of face templates has serious implications on the privacy of the concerned users. For robust and practical implementation of such system it is necessary to identify and explore the possible ways by which reconstruction of template is feasible. In this paper, we show that even match scores carries sufficient information for reconstruction of the original face templates. We propose a novel non-iterative scheme to reconstruct face templates from match scores. We use an affine transformation of the images to approximate the behavior of a given face recognition system using an independent set of face templates termed as "break-in" set. Selected templates from the break-in set are matched only once with the enrolled template of the target account and match scores are recorded. These scores are then embedded in the approximating affine space along with break-in set templates to compute the co-ordinates of the target template. The inverse transformation is used to reconstruct the original target template. We present the reconstruction of templates for a commercial off the shelf (COTS) face recognition system. The COTS system is set to operate at 1% False Acceptance Rate and 99% True Acceptance Rate with 100 enrollments. We observed that with proposed scheme, at most 450 attempts are required to achieve a 0.93 probability of break into the COTS face recognition system by choosing a random gallery target.