Identification, Secrecy, Template, and Privacy-Leakage of Biometric Identification System Under Noisy Enrollment

TL;DR

This paper analyzes the fundamental trade-offs among identification, secrecy, template, and privacy-leakage rates in biometric identification systems with noisy enrollment channels, introducing a novel capacity region characterization.

Contribution

It introduces a new capacity region characterization for biometric systems with noisy enrollment, using a novel technique with two auxiliary random variables, extending prior noiseless models.

Findings

Capacity region characterized for noisy enrollment channels

Reduction to previous models in special cases

Novel technique with two auxiliary variables

Abstract

In this study, we investigate fundamental trade-off among identification, secrecy, template, and privacy-leakage rates in biometric identification systems. Ignatenko and Willems (2015) studied this system assuming that the channel in the enrollment process of the system is noiseless and they did not consider the template rate. In the enrollment process, however, it is highly considered that noise occurs when bio-data is scanned. In this paper, we impose a noisy channel in the enrollment process and characterize the capacity region of the rate tuples. The capacity region is proved by a novel technique via two auxiliary random variables, which has never been seen in previous studies. As special cases, the obtained result shows that the characterization reduces to the one given by Ignatenko and Willems (2015) where the enrollment channel is noiseless and there is no constraint on the template rate, and it also coincides with the result derived by G\"unl\"u and Kramer (2018) where there is only one individual.

Figures

Equations

$$P_{A^n|B^n}(a^n|b^n)=\frac{P_{A^n{B}^n}(a^n,b^n)}{P_{B^n}(b^n)}$$

$$(\forall a^n\in {\mathcal{A}}^n,\forall b^n\in {\mathcal{B}}^n\mathrm{such}\mathrm{that}{P}_{B^n}(b^n)>0).$$

$$P_{X_i^n}(x_i^n):=\mathrm{Pr}[X_i^n=x_i^n]=\prod _{\begin{array}{c}k=1\end{array}}^n{P}_X(x_{ik}).$$

$$P_{Y_i^n|X_i^n}(y_i^n|x_i^n)=\prod _{\begin{array}{c}k=1\end{array}}^n{P}_{Y|X}(y_{ik}|x_{ik})$$

$$(J(i),S(i))=f(Y_i^n)(i\in \mathcal{I}),$$

$$P_{Z^n|X_w^n}(z^n|x_w^n)=\prod _{\begin{array}{c}k=1\end{array}}^n{P}_{Z|X}(z_k|x_{wk}).$$

$${\max }_{\begin{array}{c}i\in \mathcal{I}\end{array}}\mathrm{Pr}\{(\hat{W},\widehat{S(W)})$$

$$\frac{1}{n}\log M_I$$

$${\min }_{\begin{array}{c}i\in \mathcal{I}\end{array}}\frac{1}{n}H(S(i))$$

$$\frac{1}{n}\log M_J$$

$${\max }_{\begin{array}{c}i\in \mathcal{I}\end{array}}\frac{1}{n}I(S(i);J(i))$$

$${\max }_{\begin{array}{c}i\in \mathcal{I}\end{array}}\frac{1}{n}I(X_i^n;J(i))$$

$$\mathcal{R}={\mathcal{A}}_1,$$

$${\mathcal{A}}_1=\bigcup _{P_{U|X}}\{(R_I,$$

$$R_J\ge I(Y;U)-I(Z;U)+R_I,$$

$$R_L\ge I(X;U)-I(Z;U)+R_I,$$

$$R_I\ge 0,R_S\ge 0\},$$

$${\mathcal{A}}_2=\bigcup _{P_{U|X},P_{V|U}}\{(R_I,$$

$$0\le$$

$$R_J\ge I(Y;U)-I(Z;U)+I(Z;V),$$

$$R_L\ge I(X;U)-I(Z;U)+I(Z;V)\},$$

$${\mathcal{A}}_1={\mathcal{A}}_2$$

$$\underset{\begin{array}{c}w\in \mathcal{I}\end{array}}{\max }\mathrm{Pr}\{(\hat{W},\widehat{S(W)})\ne (W,S(W))|W=w\}$$

$$=\mathrm{Pr}\left\{{\mathcal{E}}_1\cup {\mathcal{E}}_2\cup {\mathcal{E}}_3\cup {\mathcal{E}}_4\right\}$$

$$\stackrel{(\mathrm{a})}{\le }\mathrm{Pr}\left\{{\mathcal{E}}_1\right\}+\mathrm{Pr}\left\{{\mathcal{E}}_2|{\mathcal{E}}_1^c\right\}+\mathrm{Pr}\left\{{\mathcal{E}}_3\right\}+\mathrm{Pr}\left\{{\mathcal{E}}_4\right\},$$

$$\underset{\begin{array}{c}w\in \mathcal{I}\end{array}}{\max }\mathrm{Pr}\{(\hat{W},\widehat{S(W)})\ne (W,S(W))|W=w\}\le 4\delta$$

$$P_e(i)\le \mathrm{Pr}\{(\hat{W},\widehat{S(W)})\ne (W,S(W))|W=i\}\le 4\delta ,$$

$$H(S(i)|Z_i^n,J(i),{\mathcal{C}}_n)\stackrel{(\mathrm{b})}{\le }H(S(i)|\widehat{S(i)})\stackrel{(\mathrm{c})}{\le }n{\delta }_n,$$

$$\frac{1}{n}H(Y^n|U^n,{\mathcal{C}}_n)\le H(Y|U)+{\delta }_n^{\prime },$$

$$\frac{1}{n}H(Y^n|X^n,U^n,{\mathcal{C}}_n)\le H(Y|X,U)+{\delta }_n^{\prime },$$

$$\frac{1}{n}H(Y_i^n|J(i),S(i),{\mathcal{C}}_n)\le H(Y|U)+{\delta }_n^{\prime },$$

$$\frac{1}{n}H(S(i)|{\mathcal{C}}_n)$$

$$\frac{1}{n}H(J(i)|{\mathcal{C}}_n)$$

$$\frac{1}{n}H(S(i)|{\mathcal{C}}_n)$$

$$\displaystyle~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}-H(Y^{n}_{i}|J(i),S(i),{\mathcal{C}_{n}})\Big{\}}$$

$$\displaystyle\overset{\mathrm{(d)}}{\geq}\frac{1}{n}\Big{\{}H(Y^{n}_{i})-H(J(i)|\mathcal{C}_{n})$$

$$\displaystyle~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}-H(Y^{n}_{i}|J(i),S(i),{\mathcal{C}_{n}})\Big{\}}$$

$$\stackrel{(\mathrm{e})}{\ge }H(Y)-(I(Y;U)-I(Z;U)+I(Z;V)+3\delta )$$

$$-(H(Y|U)+{\delta }_n^{\prime })$$

$$=I(Z;U)-I(Z;V)-3\delta -{\delta }_n^{\prime }$$

$$\stackrel{(\mathrm{f})}{=}{R}_S-2\delta -{\delta }_n^{\prime },$$

Full text

I Introduction

Biometric security is a security mechanism used to identify an individual on the basis of his/her physical characteristics. Biometric technology enables us to recognize the individual by matching the unique feature with biological data (bio-data) already stored in the system database. Some well-known technologies of this kind of security are fingerprint-based identification, iris-based identification, voice recognition, etc. Nowadays many applications make use of this technology like homeland checking at land port, mobile payment with smartphone and so on.

O’Sullivan and Schmid [1] and Willems et al. [2] independently introduced the discrete memoryless biometric identification system (BIS). Basically, the BIS consists of two phases: (I) Enrollment Phase and (II) Identification Phase. In (I) Enrollment Phase, all individuals’ bio-data sequences are generated from a stationary memoryless source. The sequences are observed through a noisy discrete memoryless channel (DMC) and stored into system database. In (II) Identification Phase, a bio-data sequence of an unknown individual is observed via another noisy DMC, and an estimated value of the unknown individual is output.

There are many studies related to the BIS. We highlight some previous studies which are deeply connected to this study. Willems et al. [2] have clarified the identification capacity of the BIS, which is the maximum achievable rate of the number of individuals when the error probability converges to zero as the length of bio-data sequences goes to infinity. However, the system model in [2] assumes that bio-data sequences are stored in the system database in a plain form, leading to a critical privacy leakage threat. Tuncel [3] has extended their model by incorporating compression of bio-data sequences stored in the system database and clarified the capacity region of identification and coding rates (in this study, a codeword is called a template, and this coding rate is called the template rate). Later, Ignatenko and Willems [4] investigated the BIS model with secret data and template generation. Related to this work, the system with only secrecy estimation has been analyzed in [5]–[7]. In [4], the authors evaluated the amount of information leaked between a template stored in the database and its bio-data sequence, called the privacy-leakage rate, and clarified the fundamental trade-off among identification, secrecy and privacy-leakage rates in the BIS provided that the enrollment channel is noiseless. Recently, Yachongka and Yagi [8] introduced a constraint of the template rate to the model developed in [4] and clarified the fundamental trade-off among identification, secrecy, and template rates in the BIS.

An interesting observation given in [4] for the case where the secrecy rate is zero and in [8] for the case where the secrecy rate is positive indicates that the minimum required amount of the template rate is equal to the minimum required amount of the privacy-leakage rate when the enrollment channel is noiseless. Despite this insight, when bio-data is scanned and stored in the system database, it is highly considerable that bio-data sequences are subject to noise, as is assumed in [2], [3], and [9]. Actually, by treating a noisy enrollment channel, the problem becomes more challenging and interesting, especially, in the evaluation of the privacy-leakage rate. This motivates us to consider a noisy channel in the enrollment phase of the BIS.

In this paper, we aim to characterize the capacity region of identification, secrecy, template, and privacy-leakage rates in the BIS. In order to get closer to practical system, we analyze the region by imposing the following requirements:

there is a noisy channel in the enrollment phase, 2. 2)

we consider a scheme of both protecting privacy (as in [4]) and compressing template (as in [3] and [8]), 3. 3)

we analyze the capacity region provided that the prior distribution of an identified individual is unknown.

To handle the difficulties of bounding the privacy-leakage rate in the achievability proof, we introduce a virtual system with a partial decoder, which outputs only the secret data of individual. We show that there are two different ways to express the capacity region of the BIS. An expression uses a single auxiliary random variable (RV) and another requires two auxiliary RVs. Later, we will demonstrate that the two regions (regions with one and two auxiliary RVs) are technically identical in Remark 3. Although there are two different aspects, we provide the proof of our main result based on the one employing two auxiliary RVs. Some benefits of deriving via two auxiliary RVs are that the achievability proof can be done in a simpler form since each rate constraint is addressed individually. The characterization of the capacity region of the BIS is basically similar to the ones given in [4, Theorem 1], [6, Theorem 1], and [8]. As special cases, it can be checked that our characterization reduces to the one given by Ignatenko and Willems [4, Theorem 1] where the enrollment channel is noiseless and there is no constraint on the template rate, and it also coincides with the result derived by Günlü and Kramer [6, Theorem 1] where there is only one individual, and thus individual’s estimation is not necessary.

The rest of this paper is organized as follows. In Sect. II, we define notation used in this paper and describe the details of the system model. In Sect. III, we present our main result. Next, we provide the detailed proofs of the main result in Sect. IV. Finally, in Sect. V, we give some concluding remarks and future works.

II System Model

In this section, we define notation used in this paper and describe the details of the system model within information theoretic framework.

II-A Notation

Calligraphic $\mathcal{A}$ stands for a finite alphabet. Upper-case $A$ denotes a RV taking values in $\mathcal{A}$ and lower-case $a\in\mathcal{A}$ denotes its realization. $P_{A}(a)~{}\mathrel{\mathop{:}}=~{}\Pr[A=a]$, $a\in\mathcal{A}$, represents the probability distribution on $\mathcal{A}$, and $P_{A^{n}}$ represents the probability distribution of RV $A^{n}=(A_{1},\cdots,A_{n})$ in $\mathcal{A}^{n}$, the $n$th Cartesian product of $\mathcal{A}$. $P_{A^{n}B^{n}}$ represents the joint probability distribution of a pair of RVs $(A^{n},B^{n})$ and its conditional probability distribution $P_{A^{n}|B^{n}}$ is defined as

[TABLE]

The entropy of RV $A$ is denoted by $H(A)$, the joint entropy of RVs $A$ and $B$ is denoted by $H(A,B)$, and the mutual information between $A$ and $B$ is denoted by $I(A;B)$ [10]. Throughout this paper, logarithms are of base two. For integers $a$ and $b$ such that $a\leq b$, $[a,b]$ denotes the set $\{a,a+1,\cdots,b\}$. A partial sequence of a sequence $c^{n}$ from the first symbol to the $t$th symbol $(c_{1},\cdots,c_{t})$ is represented by $c^{t}$.

Here, we define the strong typicality property and use the same notation as in [10]. A sequence $x^{n}\in\mathcal{X}^{n}$ is said to be $\delta$-$strongly~{}typical$ with respect to a distribution $P_{X}$ on $\mathcal{X}$ if $|\frac{1}{n}N(a|x^{n})-P_{X}(a)|\leq\delta$ and $P_{X}(a)=0$ implies $\frac{1}{n}N(a|x^{n})=0$ for all $a\in\mathcal{X}$, where $N(a|x^{n})$ is the number of occurrences of $a$ in the sequence $x^{n}$, and $\delta$ is an arbitrary positive number. The set of sequences $x^{n}\in\mathcal{X}^{n}$ such that $x^{n}$ is $\delta$-strongly typical is called the strongly typical set and is denoted by $A^{(n)}_{\epsilon}(X)$. This concept is easily extended to joint distributions.

II-B Model Descriptions

The BIS model studied in this paper is shown in Fig. 1. It consists of two phases: (I) Enrollment Phase, and (II) Identification Phase. Next, we will explain the details of each phase.

(I) Enrollment Phase:

Let $\mathcal{I}=[1,M_{I}]$ and $\mathcal{X}$ be the sets of indexes of individuals and a finite source alphabet, respectively. For any $i\in\mathcal{I}$, we assume that $x^{n}_{i}=(x_{i1},\cdots,x_{in})\in\mathcal{X}^{n}$, an $n$-length bio-data sequence of individual $i$, is generated i.i.d. from a stationary memoryless source $P_{X}$. The generating probability for each sequence $x^{n}_{i}\in\mathcal{X}^{n}$ is

[TABLE]

Now let $\mathcal{J}=[1,M_{J}]$ and $\mathcal{S}=[1,M_{S}]$ be the sets of indexes of templates stored in database and individuals’ secret data, respectively. All bio-data sequences are observed via a stationary DMC $\{\mathcal{Y},P_{Y|X},\mathcal{X}\}$, where $\mathcal{Y}$ is a finite output-alphabet of $P_{Y|X}$. The corresponding probability that $x^{n}_{i}\in\mathcal{X}^{n}$ is observed as $y^{n}_{i}=(y_{i1},y_{i2},\cdots,y_{in})\in\mathcal{Y}^{n}$ via the DMC $P_{Y|X}$ is

[TABLE]

for all $i\in\mathcal{I}$. Afterwards, the observed bio-data sequence $Y^{n}_{i}$ is encoded into template $J(i)\in\mathcal{J}$ and secret data $S(i)\in\mathcal{S}$ as

[TABLE]

where $f:~{}\mathcal{Y}^{n}\longrightarrow\mathcal{J}\times\mathcal{S}$ denotes encoding function. The corresponding template $J(i)$ is a compressed version of sequence $Y^{n}_{i}$ and stored at position $i$ in the database, which can be accessed by the decoder. Contrarily, the secret data $s(i)$ is returned to individual $i$ and kept as confidential. We denote the database as $\mathcal{J}_{M_{I}}=\{J(1),\cdots,J(M_{I})\}$ for brevity purpose in the upcoming analyses.

(II) Identification Phase:

Bio-data sequence $x_{w}^{n}\ (w\in\mathcal{I})$ of an unknown $w$ (index of individual enrolled in the database) is observed via a DMC $\{\mathcal{Z},P_{Z|X},\mathcal{X}\}$, where $\mathcal{Z}$ is a finite output-alphabet of $P_{Z|X}$. The corresponding probability that $x^{n}_{w}\in\mathcal{X}^{n}$ is output as $z^{n}=(z_{1},z_{2},\cdots,z_{n})\in\mathcal{Z}^{n}$ via $P_{Z|X}$ is given by

[TABLE]

The decoder observers the identified sequence $Z^{n}$ and estimates the pair of index and secret data by comparing $Z^{n}$ with all templates $\mathcal{J}_{M_{I}}$ in the database $(\widehat{W},\widehat{S(W)})=g(Z^{n},\mathcal{J}_{M_{I}})$, where $g$ denotes decoding function.

Remark 1**.**

Note that the distribution of $P_{X}$, $P_{Y|X}$, and $P_{Z|X}$ are assumed to be known or fixed and RV $W$ is independent of $(X^{n}_{i},Y^{n}_{i},J(i),S(i),Z^{n})$ for all $i\in\mathcal{I}$ like previous studies. But, in this paper we assume neither that the identified individual index $W$ are uniformly distributed over $\mathcal{I}$ nor that there is a prior distribution of $W$.

The motivation to analyze performance of the BIS provided that the distribution of $I$ is unknown is that the identified frequencies of each individual are likely different. For example, it is hard to think that the frequencies of coming to use a bank teller of each individual are identical. For real applications, this assumption is important to take care of.

III Definitions and Main Results

The formal definition and main theorem of this study are given below.

Definition 1**.**

The tuple of an identification, secrecy, template, privacy-leakage rates $(R_{I},R_{S},R_{J},R_{L})$ is said to be achievable if for any $\delta>0$ and large enough $n$ there exist pairs of encoders and decoders that satisfy

[TABLE]

Moreover, the capacity region $\mathcal{R}$ is defined as the closure of the set of all achievable rate tuples.

In Definition 1, (6) is the condition of the error probability of an individual $i$, which is arbitrarily small. Equations (7)–(9) are the constraints related to identification, secrecy, and template rates, respectively. In term of the privacy protection perspective, we measure the information leakage of individual $i$ by (10) and (11). Condition (10) measures the secrecy-leakage between the template in the database and the secret data of individual $i$, and it requires that the maximum leaked amount is not greater than $\delta$. Condition (11) measures the amount of privacy-leakage of original bio-data $X^{n}_{i}$ from template $J(i)$ and its maximum value must be smaller than or equal to $R_{L}+\delta$.

Remark 2**.**

*In [4], a stronger requirement that the distribution of secret data of every individual must be almost uniform, i.e. ${\frac{1}{n}H(S(i))}+\delta\geq\frac{1}{n}\log M_{S}$, is included in (8). However, this requirement was not actually necessary in the general problem formulation. *

Theorem 1**.**

The capacity region for the BIS is given by

[TABLE]

where $\mathcal{A}_{1}$ is defined as

[TABLE]

where auxiliary RV $U$ takes values in a finite alphabet $\mathcal{U}$ with $|\mathcal{U}|\leq|\mathcal{Y}|+2$. ∎

Remark 3**.**

We define a region $\mathcal{A}_{2}$ as

[TABLE]

where auxiliary RVs $U$ and $V$ take values in some finite alphabets $\mathcal{U}$ and $\mathcal{V}$ with $|\mathcal{U}|\leq(|\mathcal{Y}|+2)(|\mathcal{Y}|+3)$ and $|\mathcal{V}|\leq|\mathcal{Y}|+3$. Then, it can be verified that

[TABLE]

for which the proof is given in Appendix A. In this paper, we will prove Theorem 1 based on the rate constraints of the region $\mathcal{A}_{2}$ instead of $\mathcal{A}_{1}$.

As we have previously mentioned, one can check that the characterization of Theorem 1 coincides with the region characterized by Ignatenko and Willems [4, Theorem 1] in two steps: first replace $Y$ by $X$ and then remove the constraint $R_{J}$ from (13). The obtained region is identical to the result in [4, Theorem 1] where the enrollment channel is noiseless ($X=Y$) and the template rate can be arbitrarily large. Also, this characterization corresponds to the region given by Günlü and Kramer [6, Theorem 1] with only one individual. It is easy to check this claim by just setting $R_{I}=0$. Moreover, it is worthy mentioning that Kittichokechai and Caire [11] studied a similar model. They analyzed the model in which the enrollment channel is noise-free and the presence of an adversary at the decoder is considered, and characterized the capacity region by using two RVs as well. In the case where there is no assumption of adversary, it can be confirmed that the characterization in this paper reduces to their result [11, Theorem 1] by similar arguments in the proof of (15) (Appendix A).

A numerical example of the rate region given by the right-hand side of (13) where $R_{S}=0$ is shown in Fig. 3. This is a three-dimensional figure of $R_{I}$ (z-axis) as a function of $R_{S}$ (x-axis) and $R_{J}$ (y-axis), and the figure was plotted under the following settings. We assume that alphabets $\mathcal{X}$, $\mathcal{Y}$, $\mathcal{Z}$, and $\mathcal{U}$ are binary. We fix source probability $P_{X}(0)=0.5$ and transition probability of channels $P_{Y|X}(0|0)=P_{Y|X}(1|1)=P_{Z|X}(0|0)=P_{Z|X}(1|1)=0.9$. The region below the curved surface of Fig. 3 is the achievable rate region, which is a convex region, and it stretches in the direction of blue arrow. Fig. 3 shows a projection of the rate region onto the $R_{J}R_{I}$ plane and the colored area represents the achievable area of the rate pair $(R_{J},R_{I})$. Apparently, the template rate $R_{J}$ (storage space of the database) increases as the value of the identification rate $R_{I}$ rises.

IV Proof of Theorem 1

We take a standard information theoretic approach; we divide the proof into the achievability (direct) part and the converse part.

IV-A Achievability (Direct) Part

First, we fix $\delta>0$ arbitrarily small, and a block length $n$. We also fix test channels $P_{U|Y}$ and $P_{V|U}$. We set11*1Due to the Markov chain $V-U-Z$, we have $I(Z;U)-I(Z;V)=I(Z;UV)-I(Z;V)=I(Z;V)+I(Z;U|V)-I(Z;V)=I(Z;U|V)$. In the proof, we use this fact without explanation. $R_{I}=I(Z;V)-\delta$, $R_{S}=I(Z;U|V)-\delta$, $R_{J}=I(Y;U)-I(Z;U)+I(Z;V)+3\delta$, and $R_{L}=I(X;U)-I(Z;U)+I(Z;V)+3\delta$. We also set $M_{I}=2^{nR_{I}}$, $M_{S}=2^{nR_{S}}$, and $M_{J}=2^{nR_{J}}$, respectively.

Random Code Generation:

Sequences $v^{n}_{m}$ are generated i.i.d. from $P_{V}$ for $m~{}{\in}~{}[1,N_{V}]$, where $N_{V}=2^{n\left(I(Y;V)+\delta\right)}$. For each $m$, sequences $u^{n}_{k|m}$ are generated from the memoryless channel $P_{U^{n}|V^{n}=v_{m}^{n}}$ for $k~{}{\in}~{}[1,N_{U}]$, where $N_{U}=2^{n\left(I(Y;U|V)+\delta\right)}$. Divide these sequences equally from the first index into $N_{B}={2^{n\left(I(Y;U|V)-I(Z;U|V)+2\delta\right)}}$ bins. That is, the first bin contains $\{u^{n}_{1|m},\cdots,u^{n}_{M_{S}|m}\}$, the second bin contains $\{u^{n}_{M_{S}+1|m},\cdots,u^{n}_{2M_{S}|m}\}$, and so on. Consequently, each bin contains exactly $M_{S}$ codewords. Bins are indexed by $b\in[1,N_{B}]$ and codewords inside a certain bin are indexed by $s\in\mathcal{S}$. Without loss of generality, there exists a one-to-one mapping between $k$ and the pair $(b,s)$.

Encoding (Enrollment):

When encoder $f$ observes the bio-data sequence $y^{n}_{i}$, the encoder looks for $(m,k)$ such that $(y^{n}_{i},v^{n}_{m},u^{n}_{k|m})\in A_{\epsilon}^{(n)}(YVU)$. In case there are more than one such pairs, the encoder picks one of them uniformly at random. Assume that the encoder found a corresponding pair $(m,k)=(m(i),k(i))$ satisfying the jointly typical condition above. We set the template $j(i)=(m(i),b(i))$ and the secret data to be the corresponding codeword’s index $s(i)$ in bin $b(i)$ 22*2Since there is a one-to-one mapping between $k$ and $(b,s)$, we identify $k(i)$ with $(b(i),s(i))$.. $j(i)$ is stored at position $i$ in the database and $s(i)$ is handed back to individual $i$. If there do not exist such $m$ and $k$, then we set $j(i)={(1,1)}$ and $s(i)=1$.

Decoding (Identification):

The decoder has access to all records in the database $\{(m(1),b(1)),\cdots(m(M_{I}),b(M_{I}))\}$. When decoder $g$ sees $z^{n}$, the noisy version of identified individual sequence $x^{n}_{w}$, it checks whether the codeword pair $(v^{n}_{m(i)},u^{n}_{b(i),s|m(i)})$ is jointly typical with $z^{n}$ or not for all $i\in\mathcal{I}$ with some $s\in\mathcal{S}$, i.e. $(z^{n},v^{n}_{m(i)},u^{n}_{b(i),s|m(i)})\in A_{\epsilon}^{(n)}(ZVU)$. If there exists a unique pair ${(i,s)}$ for which this condition holds, then the decoder outputs $(\widehat{w},\widehat{s(w)})={(i,s)}$ as the estimated index and secret data, respectively. Otherwise, the decoder outputs the index of the template $(1,1)$ as $\hat{w}$ and $\widehat{s(w)}=1$ if (i) there does not exist such a pair $(i,s)$, (ii) such a pair $(i,s)$ exists but there are some $s^{\prime}\neq{s}$ ($s^{\prime}\in\mathcal{S}$) such that $(z^{n},v^{n}_{{m(i)}},u^{n}_{{b(i)},s^{\prime}|{m(i)}})\in A_{\epsilon}^{(n)}(ZVU)$ satisfies, or (iii) such a pair $(i,s)$ exists but there are some $i^{\prime}\neq{i}$ such that the pair $(v^{n}_{m(i^{\prime})},u^{n}_{b(i^{\prime}),{s^{\prime}}|m(i^{\prime})})$ is jointly typical with $z^{n}$ for some $s^{\prime}\in\mathcal{S}$.

Analysis of Error Probability:

We evaluate the ensemble average of the error probability, where the average is taken over randomly chosen codebook $\mathcal{C}_{n}$, which is defined as the set $\{V_{m}^{n},U_{k|m}^{n}:m\in[1,N_{V}],k\in[1,N_{U}]\}$. Let the pair $(M(i),K(i))=(M(i),B(i),S(i))$ denote the RVs corresponding to the index pair $(m(i),k(i))=(m(i),b(i),s(i))$ of sequences $V_{m}^{n}$ and $U_{k|m}^{n}$ determined by the encoder for $Y^{n}_{i}$. For individual $W=w$, possible event of errors occurs at the encoder is:

1. $\mathcal{E}_{1}$:  {$(Y^{n}_{w},V^{n}_{m},U^{n}_{k|m})\notin A_{\epsilon}^{(n)}(YVU)$

       for all $m\in[1,N_{V}]$ and $k\in[1,N_{U}]$},

and those at the decoder are: 2. ${\mathcal{E}_{2}}$:  {$(Z^{n},V^{n}_{M(w)},U^{n}_{B(w),S(w)|M(w)})\notin A_{\epsilon}^{(n)}(ZVU)$}, 3. ${\mathcal{E}_{3}}$:  {$\exists s^{\prime}\neq S(w)$ s. t.

       $(Z^{n},V^{n}_{M(w)},U^{n}_{B(w),s^{\prime}|M(w)})\in A_{\epsilon}^{(n)}(ZVU)$}, 4. ${\mathcal{E}_{4}}$:  {$\exists i^{\prime}\neq w$ and $\exists s^{\prime}$ s. t.

       $(Z^{n},V^{n}_{M(i^{\prime})},U^{n}_{B(i^{\prime}),s^{\prime}|M(i^{\prime})})\in A_{\epsilon}^{(n)}(ZVU)$}.

Then, the error probability for $W=w$ can be bounded as

[TABLE]

where (a) follows because $\Pr\left\{\mathcal{E}_{1},\mathcal{E}_{2}\right\}=\Pr\left\{\mathcal{E}_{1}\right\}+\Pr\left\{\mathcal{E}_{2}\cap\mathcal{E}^{c}_{1}\right\}\leq\Pr\left\{\mathcal{E}_{1}\right\}+\Pr\left\{\mathcal{E}_{2}|\mathcal{E}^{c}_{1}\right\}$.

$\Pr\{\mathcal{E}_{1}\}$ can be made smaller than $\delta$ for large enough $n$ by utilizing the covering lemma [12, Lemma 3.3] because $\frac{1}{n}\log N_{V}=I(Y;V)+\delta~{}{>I(Y;V)}$ and $\frac{1}{n}\log N_{U}=I(Y;U|V)+\delta~{}{>I(Y;U|V)}$. For $\Pr\left\{{\mathcal{E}_{2}|\mathcal{E}^{c}_{1}}\right\}$, it can also be made smaller than $\delta$ by the Markov lemma [10, Lemma 15.8.1]. By applying the packing lemma [12, Lemma 3.1], $\Pr\left\{{\mathcal{E}_{3}}\right\}$ and $\Pr\left\{{\mathcal{E}_{4}}\right\}$ are arbitrarily small for large enough $n$ since ${\frac{1}{n}\log M_{S}=I(Z;U|V)-\delta<I(Z;U|V)}$ and ${\frac{1}{n}\log M_{I}+\frac{1}{n}\log M_{S}=I(Z;U)-2\delta<I(Z;UV)}$, respectively.

Therefore, the ensemble average of the error probability can be made that

[TABLE]

for large enough $n$.

Intermediate Steps:

We consider a virtual system, where a partial decoder $g_{i}$ is employed, for deriving the upper bound on the privacy-leakage rate. In this system, knowing index $i$ and seeing $Z^{n}_{i}$ (defined as the output sequence of $X^{n}_{i}$ via $P_{Z|X}$), the partial decoder $g_{i}$ estimates only the secret data of individual $i$ as $\widehat{S(i)}=g_{i}(Z^{n}_{i},J(i))$. Note that this system is just for analysis, and the partial decoder is not actually used during the decoding process.

For any given $i\in\mathcal{I}$, the partial decoder $g_{i}$ operates as follows: observing $z_{i}^{n}$ and the template $j(i)=(m(i),b(i))$ in the database, it looks for $s\in\mathcal{S}$ such that $(z^{n}_{i},v^{n}_{m(i)},u^{n}_{b(i),s|m(i)})\in A_{\epsilon}^{(n)}(ZVU)$. It sets $\widehat{s(i)}=s$ if there exists a unique $s$. Otherwise, it outputs $\widehat{s(i)}=1$. The potential events of error probability for this case are ${\mathcal{E}_{2}}$ and ${\mathcal{E}_{3}}$. Letting $P_{e}(i)$ be the error probability of $g_{i}$, we readily see that

[TABLE]

where the middle term in (18) denotes the error probability of $g$ (in the original BIS) for individual $W=i$.

The function of this partial decoder enables us to bound the following conditional entropy

[TABLE]

where

1. (b)

follows because conditioning reduces entropy, 2. (c)

follows because Fano’s inequality and (18) are applied, and ${\delta_{n}}=\frac{1}{n}\left(1+4\delta\log M_{S}\right)$.

Lemma 1**.**

(Kittichokechai et al. [13])

Assume that $(X^{n},Y^{n},U^{n})$ are $\epsilon$-strongly typical with high probability333It means that $\Pr\{(X^{n},Y^{n},U^{n})\in A^{(n)}_{\epsilon}(XYU)\}\rightarrow 1$ as $n\rightarrow\infty$, where $A^{(n)}_{\epsilon}(XYU)$ denotes the set of $\epsilon$-strongly typical sequences.. Then, it holds that*

[TABLE]

where $\delta^{\prime}_{n}$ is a positive value satisfying ${\delta^{\prime}_{n}}\downarrow 0$.

(Proof)    The proofs can be found in [13, Appendix C]. ∎

Lemma 2**.**

For any $i\in\mathcal{I}$, it holds that

[TABLE]

where $\delta^{\prime}_{n}>0$ and ${\delta^{\prime}_{n}}\downarrow 0$.

(Proof)    The proof is provided in Appendix B. ∎

Due to the fact that we set $M_{S}=2^{nR_{S}}$ and $M_{J}=2^{nR_{J}}$, the following inequalities hold

[TABLE]

with equality when $S(i)$ and $J(i)$ are uniformly distributed on $\mathcal{S}$ and $\mathcal{J}$, respectively, for any codebook $\mathcal{C}_{n}$.

Hereafter, we shall check the bounds of identification, secrecy, secrecy-leakage, template, and privacy-leakage rates averaged over randomly chosen codebook $\mathcal{C}_{n}$. In the following analyses, the index $i$ is arbitrarily fixed on $\mathcal{I}$ since we need to show that all conditions in Definition 1 are satisfied.

Analyses of Identification and Template Rates:

From the parameter settings of achievability scheme, it is straight-forward that the conditions (7) and (9) hold.

Analysis of Secrecy Rate:

The secrecy rate can be evaluated as follows:

[TABLE]

where

1. (d)

holds because $(J(i),S(i))$ is a function of $Y^{n}_{i}$, 2. (e)

follows because (24) and Lemma 2 are applied, 3. (f)

holds because we set $R_{S}=I(Z;U)-I(Z;V)-\delta$.

Analysis of Secrecy-Leakage:

The amount of leaked information about $S(i)$ from $J(i)$ can be expanded as

[TABLE]

where (g) follows because (23), (24), and Lemma 2 are applied.

Analysis of Privacy-Leakage Rate:

In view of (11), we start by expanding the privacy-leakage rate $\frac{1}{n}I(X^{n}_{i};J(i)|\mathcal{C}_{n})$ as

[TABLE]

where the inequality in (27) holds due to (24). Next, let us focus solely on the conditional entropy in (27). It can be evaluated as

[TABLE]

where

1. (h)

follows since $J(i)$ is a function of $Y^{n}_{i}$ and we have $J(i)=(M(i),B(i))$, 2. (i)

follows because $Y^{n}_{i}$ and $X^{n}_{i}$ are independent of $\mathcal{C}_{n}$, 3. (j)

follows because $U^{n}_{B(i),S(i)|M(i)}$ is denoted by $U^{n}_{i}$ and it is a function of the tuple $(M(i),B(i),S(i))$ for the second term, and the Markov chain $S(i)-(M(i),B(i),X^{n}_{i})-{Z^{n}_{i}}$ holds for a given codebook in the last term, 4. (k)

follows because conditioning reduces entropy, 5. (l)

follows as (21) in Lemma 1 and Fano’s inequality in (19) are applied, 6. (m)

holds since we have $H(U|Y,X)=H(U|Y)$ by the Markov chain $U-Y-X$.

From (27) and (28), we obtain

[TABLE]

for all sufficiently large $n$.

Finally, with a sufficiently small $\delta$ and by applying the selection lemma [14, Lemma 2.2] to all results shown above (i.e., Eqs. (17), (25), (26), and (29)), there exists a codebook satisfying all the conditions in Definition 1 for all large enough $n$. ∎

IV-B Converse Part

For the converse proof, we consider a more relaxed case where identified individual index $W$ is uniformly distributed over $\mathcal{I}$ and (6) is replaced with the average error criterion

[TABLE]

We shall show that the capacity region, which is not smaller than the original one $\mathcal{R}$, is contained in the right-hand side of (14).

We assume that a rate tuple $(R_{I},R_{S},R_{J},R_{L})$ is achievable so that there exists a pair of encoder and decoder $(f,g)$ such that all conditions in Definition 1 with replacing (6) by (30) are satisfied for any $\delta>0$ and large enough $n$.

Here, we provide other key lemmas used in this part. For $t\in[1,n]$, we define auxiliary RVs $U_{t}$ and $V_{t}$ as $U_{t}=(Z^{t-1},J(W),S(W))$ and $V_{t}=(Z^{t-1},J(W))$, respectively. We denote a sequence of RVs $X^{n}_{W}=(X_{1}(W),\cdots,X_{n}(W))$ and $Y^{n}_{W}=(Y_{1}(W),\cdots,Y_{n}(W))$.

Lemma 3**.**

The following Markov chains hold

[TABLE]

(Proof)    The proofs are given in Appendix C. ∎

Lemma 4**.**

There exist some RVs $U$ and $V$ which satisfy $Z-X-Y-U-V$ and

[TABLE]

(Proof)    The proofs are provided in Appendix D. ∎

In the subsequent analyses, we fix auxiliary RVs $U$ and $V$ specified in Lemma 4.

Analysis of Identification Rate:

Again note that we are considering the case where $W$ is uniformly distributed in the converse part, and we have

[TABLE]

where

(a) holds because $(\widehat{W},\widehat{S(W)})$ is function of $\mathcal{J}_{M_{I}}$ and $Z^{n}$,

(b) follows because conditioning reduces entropy.

Continue bounding the second term in (37),

[TABLE]

where

1. (c)

follows because $W$ is independent of other RVs, 2. (d)

follows because only $J(W)$ is possibly dependent on $Z^{n}$, 3. (e)

follows because conditioning reduces entropy, 4. (f)

follows because of (33) in Lemma 4.

Thus, from (7), (37), (38), and Fano’s inequality as in (19), we obtain

[TABLE]

where $\delta_{n}=\frac{1}{n}(1+\delta\log M_{I}M_{S})$ and44*4Willems et al. [2] characterized the identification capacity of the system, where the decoder estimates only the user index, and showed that $\frac{1}{n}\log M_{I}\leq I(Y;Z)+\delta$ for all sufficiently large $n$. Since the constraints imposed on the system addressed in this paper are more rigorous than the ones in [2], it is trivial that $\frac{1}{n}\log M_{I}$ for this system cannot be larger than $I(Y;Z)+\delta$. Moreover, it holds that $\frac{1}{n}\log M_{S}\leq\log|\mathcal{Y}|$ because $S(i)$ is a function of $Y^{n}_{i}$. Therefore, for large enough $n$, we have that $\delta_{n}=\frac{1}{n}+\frac{\delta}{n}\log M_{I}M_{S}\leq\frac{1}{n}+\delta(\log|\mathcal{Y}||\mathcal{Z}|+\delta)$, and it converges to zero when $n\rightarrow\infty$ and $\delta\downarrow 0$. $\delta_{n}\downarrow 0$ as $n\rightarrow\infty$ and $\delta\downarrow 0$.

Analysis of Secrecy Rate:

This analysis is similar to the analysis of identification rate, which we have already seen above. We begin by considering the entropy of secret data as follows:

[TABLE]

where (g) follows because bio-data sequence of each individual is generated independently so only $J(W),S(W)$, and $Z^{n}$ are possibly dependent on each other.

For the third term in (40),

[TABLE]

where

1. (h)

holds because each symbol of $Z^{n}$ is i.i.d, 2. (i)

holds due to (33) and (34) in Lemma 4.

Therefore, from (8), (10), (40), (41), and Fano’s inequality, we have

[TABLE]

Analysis of Template Rate:

It follows from (9) that

[TABLE]

Now let us focus on each term in (43) separately. For the first term,

[TABLE]

where

1. (j)

holds from (31) in Lemma 3 and $(S(W),J(W))$ is a function of $Y^{n}_{W}$, 2. (k)

follows because conditioning reduces entropy.

For the second term,

[TABLE]

For the last one,

[TABLE]

where

1. (l)

follows because conditioning reduces entropy, 2. (m)

follows due to Fano’s inequality.

Finally, substituting (44)–(46) into (43), the last terms in (44) and (45) cancel out each other, and we obtain

[TABLE]

where (47) follows due to (33)–(35) in Lemma 4.

Analysis of Privacy-Leakage Rate:

From (11), it follows that

[TABLE]

Likewise in the analysis of template rate, let us focus on each term in (48) separately. For the first term,

[TABLE]

where

1. (n)

follows because conditioning reduces entropy, 2. (o)

holds from (32) in Lemma 3, 3. (p)

follows because conditioning reduces entropy.

For the second term,

[TABLE]

and the last term can be bounded by the same quantity as seen in (46):

[TABLE]

Finally, substituting (49)–(51) into (48) and taking similar steps as in (47), we obtain

[TABLE]

where (52) follows due to (33), (34), and (36) in Lemma 4.

Eventually, letting $n\rightarrow\infty$ and $\delta\downarrow 0$ in (39), (42), (47), and (52), we can see that the capacity region is contained in the right-hand side of (14).

To complete the proof of Theorem 1, we discuss the bounds on the cardinalities of auxiliary RVs. For proving the bound on the cardinality of alphabet $\mathcal{U}$ in the region $\mathcal{A}_{1}$ (cf. (13)), we use the support lemma in [12, Appendix C] to show that RV $U$ should have $|\mathcal{Y}|-1$ elements to preserve $P_{Y}$ and add three more elements to preserve $H(Z|U)$, $H(Y|U)$, and $H(X|U)$. This implies that it suffices to take $|\mathcal{U}|\leq|\mathcal{Y}|+2$ for preserving $\mathcal{A}_{1}$. Similarly, to bound the cardinalities of alphabets $\mathcal{U}$ and $\mathcal{V}$ in the region $\mathcal{A}_{2}$ (cf. (14)), we also utilize the same lemma to show that $|\mathcal{V}|\leq|\mathcal{Y}|+3$ and $|\mathcal{U}|\leq(|\mathcal{Y}|+2)(|\mathcal{Y}|+3)$ suffice to preserve $P_{Y}$, $H(Z|V)$, $H(Z|U)~{}(=H(Z|U,V))$, $H(Y|U)$, and $H(X|U)$. ∎

V Conclusions and Future Works

In this paper, we deployed a method using two auxiliary RVs to characterize the capacity region of identification, secrecy, template, and privacy-leakage rates in the BIS. We demonstrated that the characterization using two auxiliary RVs reduce to the one using only an auxiliary RV. Compared to the model proposed in [3] and [4], what we newly imposed on our model are:

• •

treating a noisy channel in the enrollment phase,

• •

considering a scheme of both compressing template (as in [3] and [8]) and protecting privacy (as in [4]),

• •

analyzing the capacity region provided that the prior distribution of an identified individual is unknown.

As special cases, it can be checked that our characterization reduces to the one in [4, Theorem 1] where the enrollment channel is noiseless and there is no constraint on the template rate, and it also coincides with the one derived by Günlü and Kramer [6, Theorem 1] where there is only one individual. In a slightly different model in which the secret key is chosen independently of the bio-data sequences, known as chosen-secret BIS model [4],[6], the capacity region has not been discussed in this paper. However, it can be characterized via similar arguments for proving Theorem 1 by just adding a one-time pad operation. For the future works, as we have seen in Remark 3 about the relation between $\mathcal{A}_{1}$ and $\mathcal{A}_{2}$, this is a positive hint that Theorem 1 can be reproved by a scheme using only one auxiliary RV and now this task is under way. We also plan to analyze the capacity regions of the BIS under strong secrecy criterion regarding secrecy-leakage.

Appendix A Proof of Equation (15)

In the proof, we show the equivalence of $\mathcal{A}_{1}$ and $\mathcal{A}_{2}$ by removing the cardinality bounds of auxiliary RVs $U$ and $V$ from the two regions. Once the equivalence without the cardinality bounds is established, the cardinality bounds follow from the standard arguments (cf. [12, Appendix C]).

It is obvious that $\mathcal{A}_{2}\subseteq\mathcal{A}_{1}$, so we shall show that $\mathcal{A}_{2}\supseteq\mathcal{A}_{1}$. We assume that $(R_{I},R_{S},R_{J},R_{L})\in\mathcal{A}_{1}$, meaning that $(R_{I},R_{S},R_{J},R_{L})$ satisfies all conditions in (13) for some $P_{U|Y}$. Especially, we have $R_{I}+R_{S}\leq I(Z;U)$. We choose the test channel $P_{V|U}$ satisfying that

[TABLE]

Such $P_{V|U}$ always exists since $I(Z;U)\geq I(Z;V)\geq 0$ and $I(Z;V)$ is a continuous function of $P_{V|U}$. Under that condition, it is easy to check that $(R_{I},R_{S},R_{J},R_{L})$ is also an element lying in the region $\mathcal{A}_{2}$. ∎

Appendix B Proof of Lemma 2

In [4], a similar result of this lemma is used without the proof. Here, we will provide a proof for readers’ sake.

Note that $J(i)=(M(i),B(i))$. We start by considering the conditional entropy in the left-hand side of (22) as

[TABLE]

where

1. (a)

holds because we denote ${U^{n}_{B(i),S(i)|M(i)}}$ as $U^{n}_{i}$ for simplicity and the tuple $(M(i),B(i),S(i))$ determines $U^{n}_{i}$ for a given codebook, 2. (b)

follows because conditioning reduces entropy, 3. (c)

follows because $Y^{n}_{i}$ and $U^{n}_{i}$ are jointly typical with high probability and (20) in Lemma 1 is applied.

∎

Appendix C Proof of Lemma 3

First, we prove that (31) holds. The joint distribution among $Z^{t-1},Y^{t}(W),J(W)$, and $S(W)$ can be developed as

[TABLE]

[TABLE]

where

1. (d)

holds because $(J(W),S(W))$ is a function of $Y^{n}_{W}$, 2. (e)

follows because of the Markov chain $Z^{t-1}-Y^{t-1}(W)-(J(W),S(W))$.

Similarly, equation (32) can be shown as follows:

[TABLE]

where

1. (f)

holds because $(J(W),S(W))$ is a function of $Y^{n}_{W}$, 2. (g)

follows due to the i.i.d. property of each symbol and the Markov chain $Z^{t-1}-X^{t-1}(W)-Y^{t-1}(W)$, 3. (h)

follows because of the Markov chain $Z^{t-1}-X^{t-1}(W)-(J(W),S(W))$.

∎

Appendix D Proof of Lemma 4

We will prove only (33) by the well-known argument (cf. [10]). We introduce a timesharing variable $Q$ which is uniformly distributed over $\{1,2,\cdots,n\}$ and is independent of all other RVs. The left-hand side of (33) can be rewritten as

[TABLE]

By denoting $V=(V_{Q},Q)$ and $Z=Z_{Q}$, (33) obviously holds. The proof of (34)–(36) can be done similarly by setting $X=X_{Q}$ and $Y=Y_{Q}$.

To complete the proof, we need to verify that $Z_{t}-X_{t}(W)-Y_{t}(W)-U_{t}-V_{t}$ holds. We shall first check that $Z_{t}-X_{t}(W)-Y_{t}(W)-{U_{t}}$ holds for any $t\in[1,n]$. To prove this claim, we have to verify that

[TABLE]

Indeed, Eqs. (58) and (59) clearly hold so the remaining task is to check if the last one also holds. Before checking that, we show that the Markov chain ${Z_{t}-(Z^{t-1},X_{t}(W),Y_{t}(W))-(J(W),S(W))}$, which will be used to confirm (60), holds.

[TABLE]

where

1. (i)

follows because conditioning reduces entropy, 2. (j)

holds because $(J(W),S(W))$ is a function of $Y^{n}_{W}$, 3. (k)

holds because each symbol of bio-data sequences is i.i.d. and we have $Z_{t}-X_{t}(W)-Y_{t}(W)$.

From (61), it means that the conditional mutual information is zero and thus ${Z_{t}-(Z^{t-1},X_{t}(W),Y_{t}(W))-(J(W),S(W))}$ forms a Markov chain.

Equation (60) can be checked as follows:

[TABLE]

where

1. (l)

holds because every symbol of bio-data sequences is i.i.d. generated so the first and third terms in (62) cancel each other, 2. (m)

follows because ${Z_{t}-(Z^{t-1},X_{t}(W),Y_{t}(W))-(J(W),S(W))}$ holds (cf. (61)).

Thus, $Z_{t}-X_{t}(W)-Y_{t}(W)-U_{t}$ holds, and since $V_{t}$ is a function of $U_{t}$, it follows that $Z_{t}-X_{t}(W)-Y_{t}(W)-U_{t}-V_{t}$ also forms a Markov chain. ∎