Feature correlation attack on biometric privacy protection schemes

Privacy protection techniques are an important supplementary of biometric systems. Their main purpose is to prevent security leakages in common biometric systems and to preserve the user's privacy. However, when cryptographic functions are used in the algorithms, randomness of biometric features is strictly required from the security point of view. This randomness is hard to achieve in many feature extraction algorithms, especially for those using the local information of biometric modality. In this paper we discuss privacy protection based on a fuzzy extractor. We show that the security of the algorithm is strongly reduced when statistical properties of biometric features as well as the details of the algorithm are known. An attack exploiting feature correlation is demonstrated.