Generating Registration-Free Cancelable Fingerprint Templates Based onMinutia Cylinder-Code Representation

Ning Zhang†, Xin Yang†, Yali Zang, Xiaofei Jia, Jie Tian*Institute of Automation, Chinese Academy of Science

Beijing, China†These authors contribute equally to this paper. *corresponding author: tian@ieee.org

Abstract

Cancelable biometrics has become an indispensabletechnique during biometric authentication. There have beenseveral prior attempts to construct cancelable fingerprinttemplates. However, existing schemes have not provided asatisfying trade off between performance and security. Inthis paper, we proposed two novel approaches to constructregistration-free cancelable fingerprint templates based onMinutia Cylinder Code, which is the state of the art localrepresentation for fingerprint. And experiments show thatthe two approaches provide good results in terms of threecriteria: performance, unlinkability and irreversibility.

1. Introduction

Biometrics such as fingerprint, iris, face provide a con-venient way to identity authentication. However, biomet-ric attacks can cause severe problems to legitimate user-s. Recently biometrics template protection have becomean indispensable technique during the deployment of bio-metric authentication system. Biometric cryptosystems andcancelable biometrics are two main categories of biometrictemplate protection [10]. Biometric cryptosystems extractstable helper data from biometrics during enrollment. Thehelper data helps to recover the secret data during authen-tication while it does not reveal any information about theoriginal biometrics. The original biometric template is dis-carded or concealed after the helper data extraction. Fuzzyvault and Fuzzy commitment [8] are two representative ap-proaches of biometric cryptosystems [10] [6]. In cancelablebiometrics, the original biometric is transformed through anirreversible transformation, which is controlled by a seriesof parameters (user’s key). New pieces of biometric tem-plates can be issued by varying keys [10].

In this paper, we focus on cancelable fingerprint tem-plate. Various cancelable fingerprint template schemes havebeen proposed previously. Ratha et al. proposed several

non-invertible transformations in [9]. Their experimentsshowed that the Functional transformation gives the bestperformance, and the Cartesian transformation performsworst. The author demonstrated how to construct the trans-formation functions in detail, and two examples of transfor-mation functions were given. However, as minutiae loca-tions and orientations are used to construct templates in thisscheme, rigorous registration of fingerprint images is need-ed before authentication, which inevitably lead to degrada-tion in performance or even lead to failure when the singularpoints are absent. Chikkerur and Ratha introduced an ap-proach to generate registration-free cancelable fingerprinttemplates [3], in which rare occurred patches are used forverification. However, the performance and security of thismethod on public data sets are unclear.

As the state of the art local minutiae representationfor fingerprint, Minutia Cylinder Code (MCC) [1] pro-vides a noteworthy performance. However, Matteo Fer-rara and Davide Maltoni successfully reconstructed the o-riginal minutiae template from binarized MCC representa-tions [4]. They also gave a protection scheme by carry-ing on binary-KL transformation to original MCC, whichwas named P-MCC. Though non-invertible it is, P-MCC isnot cancelable. In this paper, we proposed two approach-es to generate registration-free cancelable fingerprint tem-plates based on MCC. The first approach protects the MCCtemplate by combining the original MCC with a designedcombo plate [12]. And in the second approach, we conductFunctional transformation [9] to the MCC. Instead of ap-plying the transformation to global features as [9] did, wework on local features.

The rest of this paper is organized as follows: Section2 briefly describes the MCC representations. Section 3 in-troduces the two approaches of generating cancelable tem-plates for MCC. Section 4 presents the experimental resultson public databases. Section 5 gives the conclusion.

(a)

(b)

Figure 1. Example of a minutiae cylinder: (a) minutiae involved inthe cylinder base, which has been rotated to align the direction ofminutiae m, (b) cell values: lighter areas represent higher values,gray areas in corners denote invalid.

2. Minutiae Cylinder-Code

The minutiae cylinder-code representation associates alocal structure to each minutia [1]. Let T be a ISO/IEC19794-2 minutiae template [5]. For each minutiae m in Twith sufficient number of neighbors, a cylinder with radiusR and height 2π is created. The cylinder base is related tothe spatial information, and the height corresponds to direc-tions of range [−π, π].

As shown in Figure 1, the cylinder is enclosed insid-e a cuboid whose base is aligned according to minutia m,the cuboid is discretized into NS ×NS ×ND cells, whichmeans NS × NS grids on the base and ND sections alongthe height. A numerical value is calculated for each cel-l by accumulating the spatial and directional contributionsfrom minutiae in a certain neighborhoBiohashod. The M-CC can be stored as float or binary values (see equation(4),(19) in [1]). Cappelli et al. proposed a set of optimal pa-rameters for MCC construction in 2010 (see table 2 in [2]),where NS = 16 and Nd = 5. We use the same parametersin this paper.

3. Our Approaches

3.1. Combo Plate Transformation

This method protects the MCC template by XOR eachsection of original MCC with a combo plate (XOR denotesthe exclusive or operation). As little entropy loses duringthis process, this approach can be viewed as a realizationof biometric salting [11]. Here we take the binarized MCCas input, which can be denoted by a two-bit vector, the for-

Figure 2. The Sketch of Combo Plate Transformation for MCC.

mer storing the cell values and the latter denoting the cellvalidity. The sketch of the Combo Plate transformation isillustrated in Figure 2. First pre-combo plates are generat-ed,namely PCP . PCP is a cylinder with Nd sections, andeach section is divided into NS × NS cells. Each PCP isalso denoted by a two-bit vector pcp, ˆpcp ∈ {0, 1}NS , theformer denoting the cell values and the latter denoting thecell validity. Each section of the PCP is generated by com-bining different parts of the original MCC together. Takethe first section of PCP for example, we partition this sec-tion into several blocks, and each block is labeled by a digit,as shown in Figure 2. The cells in block i are assigned val-ues using the corresponding block i in the original MCC.we can see that the block 2, 5, 8, 9 in PCP are assigned thesame values as block 2, 5, 8, 9 in the Original MCC, whilethe blocks 1, 3, 4, 6, 7, 10 in PCP are assigned values sym-metrical to blocks 1, 3, 4, 6, 7, 10 in original MCC, it looksjust like that we extract different parts of each section in o-riginal MCC, and then combine them together. The othersections in PCP are generated in the same way. For dif-ferent minutia cylinders, different PCP s are created. Sec-ond, the PCP created is XORed with random generatedplates, the random plates (RP ) are generated using a user’skey. The generation of RP is special designed to guaranteethe template security and preserve its discriminative featuremeanwhile, which will be explained in next paragraph indetail. After the above two steps, combo plates are gener-

ated, namely CP , CP is also denoted by a two-bit vectorcp, cp ∈ {0, 1}NS , then each section in the minutia cylinderis XORed with the corresponding section of CP . Repeatthe above procedures for all the minutia cylinders in a fin-gerprint template, then the Combo Plate transformed MCCtemplate is got. Different pieces of templates for one fin-gerprint can be issued by varying keys. Note that this is justa sketch of this idea, in reality, there could be various waysof partition and combo. For minutiae cylinder with 32× 32cells or more in each section, we can partition the plate intomore blocks.

Though we can get different pieces of transformed MC-C by selecting different ways of partition and combo, thechangeability of templates [7] is limited. So we use user-specific keys to generate the random plates(RP ), and thencombine RP to the PCP , thus the changeability is easi-ly achieved. However, as the MCC is a series of binarybits where the number of “0” is much larger than “1”, ifthe generation of RP is completely random, the occurrenceprobability of “1” is 1/2. If we combine this RP into M-CC, the original structures of MCC will be destroyed or beoverwhelmed by the random string. In this case it is thesecret keys, not the fingerprint features, that mainly con-tribute to the matching. Once an attacker obtains legitimateusers’ keys, he will be viewed as legitimate users with greatprobability, which goes against with the original intentionof biometrics. Besides, in MCC the “1”s appear in bunch,as shown in Figure 1(b). However, “1”s in random stringappear much scattered. An attacker can filter out many ran-dom bits by removing the separate “1”s, which will degradethe security of the transformed template.

To avoid the above problems, we design an algorithmto generate CP from PCP , as demonstrated in Algorithm1. The parameter h in Algorithm 1 denotes proportionalitycoefficient, which is selected as 0.3 by experience.

3.2. Functional Transformation

As the MCC representation is constructed through acylinder of ND sections with NS × NS cells in each sec-tion. We consider each section in the cylinder as a surface,then shift the cells on this surface using a technique analo-gous to surface folding [9]. Finally values of each cell canbe recalculated through a designed method.

Surface folding is a kind of functional transformationproposed in [9], in which the authors pointed out that thetransformation function should be locally smooth but glob-ally non-smooth. The local smoothness ensures that a smallchange in input leads to a small change in output, and theglobal non-smoothness ensures that the transformation can-not be inverted easily. Transformation functions based onelectric potential field and mixture of Gaussian kernels aregiven in [9] in detail.

In this paper, the transformation function is constructed

Algorithm 1 Generating combo plates from pre-comboplatesInput:

-Pre-combo plates PCP ;-user’s key;

Output:-Combo plates CP ;

Initialize the combo plates’ values cp and cp with corre-sponding pcp and ˆpcp;Initialize the random bit generator with user’s key;//Calculate the occurrence probability of “1” in the random//plate, which is in proportion to that of the pre-combo plate.

pone = h× ‖pcp AND ˆpcp‖‖ ˆpcp‖ ;

//AND denotes the bit-wise AND operation.

for each i, j ∈ {0, 1, · · · , NS − 2}, k ∈ {0, · · · , Nd − 1} doif cp(i, j, k) == TRUE then//randgenerator is a random bit generator, which//outputs one bit at a time, and “1” is generated with a//probabilityof pone;randbit = randgenerator(pone);if randbit == 1 then

for each (r, s) ∈ (i, j), (i+ 1, j), (i, j + 1) docp(r, s, k) = NOT cp(r, s, k);//NOT denotes the negation operationcp(r, s, k) = TRUE;

end fori = i+ 2, j = j + 2;

end ifend if

end for

based on a mixture of Gaussian kernels. Here we adapt Nindependent Gaussians with random distributed centers.

F (x, y) =∑Ni=1

τi2πσxσy

exp

(1

2

((x− ui)2

σ2xi

+(y − vi)2

σ2yi

)).(1)

Here, (x, y) represents the coordinates of the cell’s center,and N is the total number of Gaussians; (ui, vi) representsthe center of i th Gaussian; σxi

, σyiare the corresponding

standard deviations and τi is the corresponding weight. E-quation (1) gives the magnitude of translation, and the di-rection of translation is given as follows:

ΦF (x, y) = arg(∇−−−−→F (x, y)

). (2)

Then the transformation can be given by

X = x+ k(|−−−−→F (x, y)|+ t) cos(ΦF (x, y)), (3)

Y = y + k(|−−−−→F (x, y)|+ t) sin(ΦF (x, y)). (4)

Figure 3. Cells’ centers before and after shift, the magnitude anddirection of shift is controlled by a series of random keys.

Figure 4. The Minutiae Cylinder Code before and after Functionaltransformation. (a) The original MCC. (b) The Functional trans-formed MCC.

Here, (x, y) is the original position of the cell’s center.(X,Y ) is the corresponding translated position of a cell’scenter, and t is the additional offset and k is the scale coef-ficient.

Here we take the float-value MCC as input, and transfor-m it according to the following procedures.

1) Given a cylinder Cm, establish a coordinate systemwhich is aligned with the direction of minutia m.

2) For each cell(i, j) in section s, its central point po-sition, denoted by ctri,j,s, can be calculated as: ((i +1/2)celllength, (j + 1/2)celllength). And the translatedposition ctr

′

i,j,s can be computed using equation (3) and (4).For the convenience of subsequent processing, we associatea validity value for ctr

′

i,j,s as follows:

ξ(ctr′

i,j,s) =

{invalid if Cm(i, j, s) = invalidvalid otherwise. (5)

3) Check each cell in section s, and reassign each cell’svalue as follows.

C′m(r, c, s) =

∑(i,j)∈γ(i,j) Cm(i, j, s) if γ(i, j) 6= Ø

0 if γ(i, j) = Ø andCm(r, c, s) 6= invalid

invalid otherwise.(6)

Here, γ(i, j) = {(i, j) | ctr′

i,j,s ∈ cell(r, c, s) andξ(ctr

′

i,j,s) = valid}.

4) Binarize the cells’ values as follows, then we get theFunctional transformed MCC.

fcm(r, c, s) =

{1 if C

′

m(r, c, s) > ψ0 otherwise,

(7)

f cm(r, c, s) =

{1 if C

′

m(r, c, s) 6= invalid0 otherwise.

(8)

Here, fcm denotes the cell values, and f cm ∈ {0, 1}Ns

denotes the cell validity.As shown in Figure 3, we embed the original cells’ cen-

tral points into a sheet, and then crumple it. We can seefrom Figure 3, after crumpling, most of the points’ posi-tions are altered and no longer in the cells they belonged tobefore. And some different points maybe mapped into onecell, which makes the transformation non-invertible.

Figure 4 illustrates a minutia cylinder code and its corre-sponding transformed version using section-different keys.We can see that the transformed template reveals little struc-tural information of the original minutiae template, and boththe spatial and directional values are scattered, which makesthe reconstruction impractical.

The Functional transformation is controlled by severalparameters. Typically, we choose 6 Gaussians all with thesame isotropic standard deviation of 15 pixels. The center-s of Gaussian are generated randomly in the rectangular of150×150 where a cylinder base resides. And each Gaussianis given a weight of either +1 or -1. Therefore, the key forsuch a transformation consists of 102 bits (6× (8 + 8 + 1)).To strengthen the security, we apply different parameters todifferent sections of a cylinder. For a cylinder with 5 sec-tions, the key consists of 510 bits. In this paper, parametersk = 35875, t = 4/10000, psi = 0.5 are selected by experi-ence.

The two approaches proposed in this paper transform M-CC in different ways. As they work on local features, regis-tration is not needed. In order to compare the similarity be-tween two templates, we compute local similarities first (us-ing equation(21) in [1]), and then combine them into globalscores using techniques such as LSS, LSA, LGS [1] [2].

4. Experiments and Analysis

We evaluate the two proposed approaches according totwo criteria (performance and security). For performance,we compare the matching accuracy of the templates be-fore and after transformation when different transform ap-proaches are used. For security, the following two aspectsare considered: unlinkability and irreversibility [10]. Theunlinkability is evaluated by testing whether the originaltemplate and its transformed version are correlated, andwhether the different transformed versions are correlated.

Figure 5. Comparison of matching performance without transfor-mation and with transformations of two approaches. The perfor-mance of using user-specific keys and user-common keys are post-ed respectively.

The irreversibility is given by theoretically deriving the ap-proximate brute force strength against an invertibility at-tack. The experiments are conducted on FVC2006DB2,which contains 1680 fingerprints from 140 fingers (12 im-pressions per finger). The ISO/IEC 19794-2 templates areextracted in advance [5]. We use the same set of parametersin our experiment as that in [2] to construct MCC, and thetransformation parameters have been given in Section 3.1and Section 3.2. Finally, the LGS technique [2] is adaptedfor global matching.

4.1. Performance

The following testing protocol is adopted to get the FalseNon Match Rate (FNMR) and False Match Rate(FMR).Each fingerprint template is compared against the remain-ing ones of the same finger, so the total number of genuinetests is

(122

)× 140 = 9240; And the first minutiae template

of one finger is compared against the first template of theremaining fingers in the data set. So the total number ofimposter tests is

(1402

)= 9730.

Using the above protocol, we generate ROC curves forthe original, Combo Plate transformed and Functional trans-formed MCC templates respectively. In reality, differentusers are assigned different keys (user-specific keys). How-ever, to get an objective performance of the different trans-formed templates, we use the same key for all the tem-plates transformations (user-common keys are used), thusthe inter-class differences caused by keys are removed. Fig-ure 5 illustrates the effects that the two transformation meth-ods have on the overall accuracy of the matcher system.From Figure 5, we can see that when user-specific keysare used, the EERs of transformed templates are much low-er than that of the original MCC; And when user-commonkeys are used, the EERs degrade a little compared to the o-

(a)

(b)

Figure 6. Matching score distributions under different scenarios.(a) Test results of Combo Plate transformation. (b) Test results ofFunctional transformation.

riginal MCC, so even if an attacker obtains legitimate user-s’ keys, he won’t be viewed as a legitimate user with a bitmore probabilities, as long as he doesn’t present the correctfingerprints. Note that the Combo Plate approach providesnearly the same EER with the Functional approach whenuser-common keys are used, while the former provides alower FMR1000 than the latter.

4.2. Unlinkability

To evaluate the unlinkability, we conduct two types ofexperiments [7] as follows.

A. Original MCC Templates Versus Transformed Tem-plates. This experiment is to verify whether the originaltemplate correlates with its transformed versions. Usingtwelve fingerprint templates of the same finger, the first tem-

plate of each finger is chosen to be transformed and reg-istered, ten different transformed templates are generatedby varying keys. The remaining eleven templates(originalMCC templates) of this finger are compared with the tenregistered templates. Repeat the above steps for all thefingers in data set, So the total number of type A tests is140× (11× 10) = 15400.

B. Transformed Templates Versus Transformed Tem-plates. This experiment is to verify whether the differenttransformed templates of the same finger are correlated. Allthe twelve templates of a same finger are transformed us-ing different keys. Each template is compared against theremaining ones of the same finger. So the total number oftype B tests is

(122

)× 140 = 9240.

We conduct the above two experiments to the ComboPlate transformed templates and the Functional transformedtemplates respectively. The matching scores distributionof these experiments are shown in Figure 6. For compari-son, the distribution of imposter tests and genuine tests withuser-common keys are also posted. From Figure 6(a) and(b), we can see that the distribution curves of both type-s attacks are left to the distribution curves of the impostertests, which means both the transformed templates possessgood unlinkability. Templates transformed with differen-t keys will be viewed as coming from different fingers, andtemplates with and without transformation are uncorrelated.

4.3. Irreversibility Analysis

A. Combo Plate Transformation. The Combo plate trans-formations are controlled by keys, if an attacker gets a legit-imate user’s key but don’t have legitimate fingerprint, whathe will get is an approximative random generated plate, butthe original MCC template and the pre-combo plate is un-known, brute-force attack is unfeasible in this case. If theattacker obtains both the transformed template CPMCCand the keys, he is able to get the random generated platesRP . From section 3.1, we know XOR(CPMCC,RP ) =XOR(MCC,PCP ), where XOR is the exclusive or op-eration, PCP is the pre-combo plate. What the attackercould get finally isXOR(MCC,PCP ), as the original M-CC is unknown, and the pre-combo plate is unknown either,(20830

)≈ 2100 times attempts are needed if the attacker tries

to guess the pre-combo templates.B. Functional Transformation. In Functional transfor-

mation, the cells in MCC are shifted and some of themare folded, In our experiment, about 74% cells’ locationsare changed, and 34% cells are folded. So even if the at-tack knows both the original MCC and transformation keys.there are 34% cells cannot be recovered. For a 16× 16× 5minutiae cylinder, there are about 208 × 5 × 34% ≈ 354cells’ values are unknown. Here brute-force attack is unfea-sible.

5. ConclusionWe proposed two approaches to construct registration-

free cancelable fingerprint templates based on MCC. TheCombo Plate transformation protect the template by XORthe original MCC with a designed combo plate. The Func-tional approach transform the original MCC template usingan non-invertible function. Both the approaches providegood performance as well as satisfying unlinkability. Asfuture work, we will investigate the security of the two ap-proaches thoroughly, and then propose more sophisticatedprotection methods.

References[1] R. Cappelli, M. Ferrara, and D. Maltoni. Minutia cylinder-

code: A new representation and matching technique for fin-gerprint recognition. Pattern Analysis and Machine Intelli-gence, IEEE Transactions on, 32(12):2128 –2141, 2010.

[2] R. Cappelli, M. Ferrara, D. Maltoni, and M. Tistarelli. M-cc: A baseline algorithm for fingerprint verification in fvc-ongoing. In Control Automation Robotics Vision (ICARCV),2010 11th International Conference on, pages 19–23, 2010.

[3] S. Chikkerur, N. Ratha, J. Connell, and R. Bolle. Generatingregistration-free cancelable fingerprint templates. In Biomet-rics: Theory, Applications and Systems, 2008. BTAS 2008.2nd IEEE International Conference on, pages 1–6, 2008.

[4] M. Ferrara, D. Maltoni, and R. Cappelli. Noninvertibleminutia cylinder-code representation. IEEE Transactions onInformation Forensics and Security, 7(6):1727–1737, 2012.

[5] ISO/IEC19794-2:2005. Information technology-biometricdata interchange formats-part 2: Finger minutiae data. 2005.

[6] A. K. Jain, K. Nandakumar, and A. Nagar. Biometric tem-plate security. EURASIP J. Adv. Signal Process, 2008:113:1–113:17, 2008.

[7] C. Lee, J.-Y. Choi, K.-A. Toh, and S. Lee. Alignment-freecancelable fingerprint templates based on local minutiae in-formation. Trans. Sys. Man Cyber. Part B, 37(4), 2007.

[8] P. Li, X. Yang, H. Qiao, K. Cao, E. Liu, and J. Tian. An ef-fective biometric cryptosystem combining fingerprints witherror correction codes. Expert Systems with Applications,39(7):6562 – 6574, 2012.

[9] N. K. Ratha, S. Chikkerur, J. H. Connell, and R. M. Bolle.Generating cancelable fingerprint templates. IEEE Trans.Pattern Anal. Mach. Intell., 29(4):561–572, 2007.

[10] C. Rathgeb and A. Uhl. A survey on biometric cryptosys-tems and cancelable biometrics. EURASIP Journal on Infor-mation Security, 2011(3):1–25, 2011.

[11] A. B. Teoh, A. Goh, and D. C. Ngo. Random multispacequantization as an analytic mechanism for biohashing ofbiometric and random identity inputs. IEEE Transactionson Pattern Analysis and Machine Intelligence, 28(12):1892–1901, 2006.

[12] J. Zuo, N. Ratha, and J. Connell. Cancelable iris biometric.In Pattern Recognition, 2008. ICPR 2008. 19th InternationalConference on, pages 1–4, 2008.