FLAME: Flexible and Lightweight Biometric Authentication Scheme in Malicious Environments

TL;DR

FLAME is a novel biometric authentication scheme that ensures privacy and security in malicious environments, offering high efficiency, flexibility, and robustness through hybrid cryptographic protocols and integrity checks.

Contribution

The paper introduces FLAME, a lightweight, flexible biometric authentication protocol designed for malicious settings, with innovative security features and significant performance improvements.

Findings

Achieves up to 110-fold communication reduction

Provides 2.7 to 8.5 times speedup over existing methods

Supports server-side authentication with multiple similarity metrics

Abstract

Privacy-preserving biometric authentication (PPBA) enables client authentication without revealing sensitive biometric data, addressing privacy and security concerns. Many studies have proposed efficient cryptographic solutions to this problem based on secure multi-party computation, typically assuming a semi-honest adversary model, where all parties follow the protocol but may try to learn additional information. However, this assumption often falls short in real-world scenarios, where adversaries may behave maliciously and actively deviate from the protocol. In this paper, we propose, implement, and evaluate $\sysname$, a \underline{F}lexible and \underline{L}ightweight biometric \underline{A}uthentication scheme designed for a \underline{M}alicious \underline{E}nvironment. By hybridizing lightweight secret-sharing-family primitives within two-party computation, $\sysname$ carefully designs a line of supporting protocols that incorporate integrity checks with rationally extra overhead. Additionally, $\sysname$ enables server-side authentication with various similarity metrics through a cross-metric-compatible design, enhancing flexibility and robustness without requiring any changes to the server-side process. A rigorous theoretical analysis validates the correctness, security, and efficiency of $\sysname$. Extensive experiments highlight $\sysname$'s superior efficiency, with a communication reduction by {$97.61\times \sim 110.13\times$} and a speedup of {$ 2.72\times \sim 2.82\times$ (resp. $ 6.58\times \sim 8.51\times$)} in a LAN (resp. WAN) environment, when compared to the state-of-the-art work.