In this chapter we analyze the performance of biometric authentication systems in terms of their typical performance measures, i.e., false rejection rate (FRR) and false acceptance rate (FAR). In biometric authentication systems the goal is to reliably authenticate individuals based on their biometric information. Recently, however, it was also concluded that biometric information itself has to be protected in these systems, due to privacy concerns. This gave rise to the development of biometric systems with template protection. In this work we analyze four types of biometric systems, i.e., traditional authentication systems, authentication systems with storage constraints, secret-based authentication systems, and secret-based authentication systems with privacy protection. For all these systems we present the fundamental limits on the false acceptance exponent. Moreover, for the last system we determine the tradeoff between the false acceptance exponent and the amount of information that the exchanged message leaks about the biometric sequence (privacy leakage).

Introduction

Nowadays, securing and regulating access to various systems and services relies heavily on passwords. However, password-based access control systems have a number of drawbacks. From the usability perspective, these systems are not user friendly, since users have to remember a large number of passwords. The latter, in its turn, results in weak security guarantees, since users tend to choose passwords that are easy to remember, and thus also easy to guess, as well as to reuse them in different applications.With the recent advances in biometric technologies, biometric information that uniquely characterizes individuals is a promising alternative to passwords. Biometric authentication is the process of establishing the identity of an individual using measurements of his/her biological characteristics, such as irises, fingerprints, face, etc.

The attractive property of uniqueness of biometrics also introduces privacy concerns related to their use in various access control systems. Unlike passwords, biometric data cannot be easily canceled and substituted with new biometrics, as they are unique for individuals and, moreover, individuals have limited resources of biometric information. Therefore secure storage and communication of biometric information in the corresponding access control systems becomes crucial. The corresponding biometric systems are called systems with template protection.