Achieving unlinkability in fingerprint templates via k-anonymity and random projection

Biometric template protection schemes are designed to provide specific security guarantees to biometric traits. However, most of these schemes do not address the unlinkability requirement (viz., multiple biometric templates should be independent of each other) from the theoretical vantage point. This study proposes a mechanism for storing fingerprint templates in an unlikable manner by hiding them within fixed-sized groups. The core of our model is based on the notion of k-anonymity, which guarantees that the biometric template of a particular subject remains concealed among the templates of other \(k-1\) subjects. The resulting anonymized features ensure that the identity of the subject does not get revealed under any circumstance, thereby preventing cross-matching or linking-based attacks within different applications. We have formally analyzed our model by quantifying the degree of anonymization of the fingerprint templates in the form of a metric having range [0, 1]. The entire scheme remains non-invertible due to the generalization of the fingerprint features. We have performed extensive empirical evaluations of our model over four benchmark fingerprint databases, for which we obtained EERs that are comparable to that in the stolen-token scenario. Hence our work introduces an approach for securing biometric databases in a provable manner.