Robust Biometric Authentication from an Information Theoretic Perspective ^†

Abstract

Robust biometric authentication is studied from an information theoretic perspective. Compound sources are used to account for uncertainty in the knowledge of the source statistics and are further used to model certain attack classes. It is shown that authentication is robust against source uncertainty and a special class of attacks under the strong secrecy condition. A single-letter characterization of the privacy secrecy capacity region is derived for the generated and chosen secret key model. Furthermore, the question is studied whether small variations of the compound source lead to large losses of the privacy secrecy capacity region. It is shown that biometric authentication is robust in the sense that its privacy secrecy capacity region depends continuously on the compound source.

1. Introduction

Biometric identifiers, such as fingerprints, iris and retina scans, are becoming increasingly attractive for the use in security systems because of their uniqueness and time invariant characteristics—for example, in authentication and identification systems. Conventional personal authentication systems usually use secret passwords or physical tokens to guarantee the legitimacy of a person. On the other hand, biometric authentication systems use the physical characteristics of a person to guarantee the legitimacy of the person to be authenticated.

Biometric authentication systems are decomposed into two phases: the enrollment and the authentication phase. A simple authentication approach is to gather biometric measurements in the enrollment phase, apply a one-way function and then store the results in a public database. In the authentication phase, new biometric measurements are gathered. The same one-way is applied and the outcome is then compared to the one stored in the database. Unfortunately, biometric measurements might be affected by noise. To deal with noisy data, error correction is needed. Therefore, helper data is generated during the enrollment phase as well based on the biometric measurements and then stored directly in the public database that will be then used in the authentication phase, which will then be used in the authentication phase to correct the noisy imperfections of the measurements.

Since the database containing the helper data is public, an eavesdropper can have access to the data if desired. How can we prevent an eavesdropper from gaining information about the biometric data from the publicly stored helper data? One is interested in encoding the biometric data into a helper data and a secret key such that the helper data does not reveal any information about the secret key. Cryptographic techniques are one approach to keeping the key secret. However, security on higher layers is usually based on the assumption of insufficient computational capabilities of eavesdroppers. Information theoretic security, on the contrary, uses the physical properties of the source to guarantee security independent from the computational capabilities of the adversary. This line of research was initiated by Shannon in [1] and has attracted considerable interest recently—cf., for example, recent textbooks [2,3,4] and references therein. In particular, Ahlswede and Csiszár in [5] and Maurer in [6] introduced a secret key sharing model. It consists of two terminals that observe the correlated sequences of a joint source. Both terminals generate a common key based on their observation and using public communication. The message transmitted over the public channel should not leak any amount of information about the common key.

Both works mentioned above use the weak secrecy condition as a measure of secrecy. Given a code of a certain blocklength, the weak secrecy condition is fulfilled if the mutual information between the key and the available information at the eavesdropper normalized by the code blocklength is arbitrarily small for large blocklengths. On the other hand, the strong secrecy condition is fulfilled if the un-normalized mutual information between the key and the available information at the eavesdropper is arbitrarily small for large blocklengths, i.e., the total amount of information leaked to the eavesdropper is negligible. The secret key sharing model satisfying the strong secrecy condition has been studied in [7].

One could model the biometric authentication similar to this secret key generation source model; however, this model does not take into account the amount of information that the public data (the helper data in the biometric scenario) leaks about the biometric measurement. The goal of biometric authentication is to perform a secret and successful authentication procedure without compromising the information about the user (privacy leakage). Compromised biometric information is unique and cannot be replaced, so once it is compromised, it is compromised forever, which might lead to an identity theft (see [8,9,10] for more information on privacy concerns). Since the helper data we use to deal with noisy data is a function of the biometric measurements, it contains information about the biometric measurement. Thus, if an attacker breaks into the data base, he could be able to extract information about the biometric measurement from where the helper data is stored. Hence, we aim to control the privacy leakage as well. An information theoretic approach of secure biometric authentication controlling the privacy leakage was studied in [11,12] under ideal conditions, i.e., with perfect source state information (SSI) and without the presence of active attackers.

In both references [11,12], the capacity results under the weak secrecy condition were derived. In [13], the capacity result for the sequential key-distillation with rate limited one-way public communication using the strong secrecy condition was shown.

For reliable authentication, SSI is needed; however, in practical systems, it is never perfectly available. Compound sources model a simple and realistic SSI scenario in which the legitimate users are not aware of the actual source realisation. Nevertheless, they know that it belongs to a known uncertainty set of sources and that it remains constant during the entire observation. This model was first introduced and studied in [14,15] in a channel coding context. Compound sources can also model the presence of an active attacker, who is able to control the state of the source. We are interested in performing an authentication process that is robust against such uncertainties and attacks. The secret key generation for source uncertainty was studied in [16,17,18,19]. In [16], the secret key generation using compound joint sources was studied and the key-capacity was established.

In [20], the achievability result of the privacy secrecy capacity region for generated secret keys for compound sources has been derived under the weak secrecy condition. In this work, we study robust biometric authentication in detail and extend this result in several directions. First, we consider a model where the legitimate users suffer from source uncertainty and/or attacks and derive achievability results under the strong secrecy conditions for both the generated and chosen secret key authentication. We then provide matching converses to obtain single-letter characterizations of the corresponding privacy secrecy capacity regions.

We further address the following question: can small changes of the compound source cause large changes in the privacy secrecy capacity region? Such a question has been first studied in [21] for arbitrarily varying quantum channels (AVQCs) showing that deterministic capacity has discontinuity points, while the randomness-assisted capacity is a continuous function of the AVQCs. This line of research is continued in [22,23], in which the classical compound wiretap channel, the arbitrarily varying wiretap channel (AVWC), and the compound broadcast channel with confidential messages (BCC) are studied. We study this for the biometric authentication problem at hand and show that the corresponding privacy secrecy capacity regions are continuous functions of the underlying uncertainty sets. Thus, small changes in the compound set lead to small changes in the capacity region only.

The rest of this paper is organized as follows. In Section 2, we introduce the biometric authentication model for perfect SSI and present the corresponding capacity results. In Section 3, we introduce the biometric authentication model for compound sources and show that secure, under the strong secrecy condition, and reliable authentication, under source uncertainty with positive rates, is possible deriving a single-letter characterization of the privacy secrecy capacity region for the chosen and generated secret key model. In Section 4, we show that the privacy secrecy capacity region for compound sources is a continuous function of the uncertainty set. Finally, the paper ends with a conclusion in Section 5.

Notation: Discrete random variables are denoted by capital letters and their realizations and ranges by lower case and script letters. $\mathcal{P}(\mathcal{X})$ denotes the set of all probability distributions on $\mathcal{X}$; $\mathbb{E}(·)$ denotes the expectation of a random variable; $Pr\{·\}$, $H(·)$ and $I(·;·)$ indicate the probability, the entropy of a random variable, and mutual information between two random variables; $D(·\parallel ·)$ is the information divergence; ${\parallel p-q\parallel }_{TV}$ is the total variation distance between p and q on $\mathcal{X}$ defined as ${\parallel p-q\parallel }_{TV}≔{\sum }_{x\in \mathcal{X}}|p(x)-q(x)|$. The set ${\mathcal{T}}_{p,\delta }^n$ denotes the set of $\delta –$typical sequences of length n with respect to the distribution p; the set ${\mathcal{T}}_{W,\delta }^n(x^n)$ denotes the set of $\delta –$conditional typical sequences with respect to the conditional distribution $W:\mathcal{X}\to \mathcal{P}(\mathcal{Y})$ and sequence $x^n\in {\mathcal{X}}^n$; $p_{x^n}$ denotes the empirical distribution of the sequence $x^n$.

2. Information Theoretic Model for Biometric Authentication

Let $\mathcal{X}$ and $\mathcal{Y}$ be two finite alphabets. Let $(x^n,y^n)\in {\mathcal{X}}^n\times {\mathcal{Y}}^n$ be a pair of biometric sequences of length $n\in \mathbb{N}$; then, the discrete memoryless joint-source is given by the joint probability distribution $Q^n(x^n,y^n)≔{\prod }_{i=1}^{n}Q(x_i,y_i)$. This models perfect SSI, i.e., all possible measurements are generated by the discrete memoryless joint-source source Q, which is perfectly known at both the enrollment and the authentication terminal.

2.1. Generated Secret Key Model

The information theoretic authentication model consists of a discrete memoryless joint-source Q, which represents the biometric measurement source, and two terminals: the enrollment terminal and the authentication terminal as shown in Figure 1. At the enrollment terminal, the enrollment sequence $X^n$ is observed and the secret key K and helper data $M^{\prime }$ are generated. At the authentication terminal, the authentication sequence $Y^n$ is observed. An estimate of the secret key $\widehat{K}$ is made based on the authentication sequence $Y^n$ and the helper data $M^{\prime }$. Since the helper data is stored in a public database, this should not reveal anything about the secret key K and also as little as possible about the enrollment measurement $X^n$. The distribution of the key must be close to uniform.

We consider a block-processing of arbitrary but fixed length n. Let ${\mathcal{M}}^{\prime }≔\{1,\dots ,M_n^{\prime }\}$ be the helper data set and $\mathcal{K}≔\{1,\dots ,K_n\}$ the secret key set.

Definition 1.

An $(n,M_n^{\prime },K_n)$-code for generated secret key authentication for joint-source $Q\in \mathcal{P}(\mathcal{X}\times \mathcal{Y})$ consists of an encoder f at the enrollment terminal with

$$\begin{array}{cc}\hfill f& :{\mathcal{X}}^n\to \mathcal{K}\times {\mathcal{M}}^{\prime }\hfill \end{array}$$

and a decoder ϕ at the authentication terminal

$$\phi :{\mathcal{Y}}^n\times {\mathcal{M}}^{\prime }\to \mathcal{K}.$$

Remark 1.

Note that the function f means that every $x^n$ is mapped into a $(k,m^{\prime })\in \mathcal{K}\times {\mathcal{M}}^{\prime }$, which implies that $|f(·)|=K_n{M}_n^{\prime }\le |{\mathcal{X}}^n|$.

Definition 2.

A privacy secrecy rate pair $(R_{PL},R_K)\in {\mathbb{R}}_{+}^2$ is called achievable for the generated secret key authentication for a joint-source Q, if, for any $\delta >0,$ there exist an $n(\delta )\in \mathbb{N}$ and a sequence of $(n,M_n^{\prime },K_n)$-codes such that, for all $n\ge n(\delta ),$ we have

$$\begin{array}{cc}\hfill Pr\{\widehat{K}\ne K\}& \le \delta ,\hfill \end{array}$$

(1a)

$$\begin{array}{cc}\hfill \frac{1}{n}H(K)+\delta \ge \frac{1}{n}log{K}_n& \ge R_K-\delta ,\hfill \end{array}$$

(1b)

$$\begin{array}{cc}\hfill \frac{1}{n}I(K;M^{\prime })& \le \delta ,\hfill \end{array}$$

(1c)

$$\begin{array}{cc}\hfill \frac{1}{n}I(X^n;M^{\prime })& \le R_{PL}+\delta .\hfill \end{array}$$

(1d)

Remark 2.

Condition (1b) requires the key distribution $p_K$ to be close to the uniform distribution $p_{\tilde{K}}$, where $\tilde{K}$ is a random variable uniformly distributed over the key set $\mathcal{K}$. By (1b), we have $\frac{1}{n}log{K}_n-\frac{1}{n}H(K)=D(K\parallel \tilde{K})\le \delta$; combined with Pinsker’s inequality, we have $\parallel p_K-p_{\tilde{K}}\parallel \le \sqrt{2ln2\delta }$. For small δ, we have that both distributions are close to each other.

Remark 3.

Condition (1a) stands for reliable authentication, the information about the key leaked by the helper data is negligible by (1c) and the information about the biometric measurements leaked by the helper data $\frac{1}{n}I(X^n;M^{\prime })$ is close to $R_{PL}$ by (1d).

Definition 3.

The set of all achievable privacy secrecy rate pairs for generated key authentication is called privacy secrecy capacity region and is denoted by ${\mathfrak{C}}_G(Q)$.

We next present the privacy secrecy capacity region for the generated key authentication for the joint-source Q, which was first established in [11,12].

To do so, for some U with alphabet $|\mathcal{U}|\le |\mathcal{X}|+1$ and $V:\mathcal{X}\to \mathcal{P}(\mathcal{U})$, we define the region $\mathcal{R}(Q,V)$ as the set of all $(R_{PL},R_K)\in {\mathbb{R}}_{+}^2$ satisfying

$$\begin{array}{cc}\hfill R_K& \le I(U;Y),\hfill \\ \hfill R_{PL}& \ge I(U;X)-I(U;Y),\hfill \end{array}$$

with $P_{UXY}(u,x,y)=V(u|x)Q(x,y)$.

Theorem 1

[11,12]. The privacy secrecy capacity region for generated key authentication is given by

$${\mathfrak{C}}_G(Q)=\bigcup _{V:\mathcal{X}\to \mathcal{P}(\mathcal{U})}\mathcal{R}(Q,V).$$

2.2. Chosen Secret Key Model

In this section, we study the authentication model for systems for which the secret key is chosen beforehand. At the enrollment terminal, a secret key K is chosen uniformly and independent of the biometric measurements. The secret key K is bound to the biometric measurements $X^n,$ and, based on this, the helper data $M^{\prime }$ is generated as shown in Figure 2. At the authentication terminal, the authentication measurement $Y^n$ is observed. An estimate of the secret key $\widehat{K}$ is made based on the authentication sequence $Y^n$ and the helper data $M^{\prime }$. Since the helper data is stored in a public database, this should not reveal anything about the secret key and minimize the information leakage about the enrollment sequence $X^n$. However, we should be able to reconstruct K. To achieve this, a masking layer based on the one-time pad principles is used.

The masking layer, which is another uniformly distributed chosen secret key K, is added to the top of the generated secret key authentication. At the enrollment terminal, a secret key $K_g$ and a helper data M are generated. The generated secret key is added modulo-$|\mathcal{K}|$ to the masking layer K and sent together with the helper data as additional helper data, i.e., $M^{\prime }=(M,K\oplus K_g)$. At the authentication terminal, an estimation of the generated secret key ${\widehat{K}}_g$ is made based on $Y^n$ and M and the estimation of masking layer is made $\widehat{K}=K\oplus K_g\ominus {\widehat{K}}_g$.

We consider a block-processing of arbitrary but fixed length n. Let ${\mathcal{M}}^{\prime }≔\{1,\dots ,M_n^{\prime }\}$ be the helper data set and $\mathcal{K}≔\{1,\dots ,K_n\}$ the secret key set.

Definition 4.

An $(n,M_n^{\prime },K_n)$-code for chosen secret key authentication for joint-source $Q\in \mathcal{P}(\mathcal{X}\times \mathcal{Y})$ consists of an encoder f at the enrollment terminal with

$$\begin{array}{cc}\hfill f& :\mathcal{K}\times {\mathcal{X}}^n\to {\mathcal{M}}^{\prime }\hfill \end{array}$$

and a decoder ϕ at the authentication terminal

$$\phi :{\mathcal{Y}}^n\times {\mathcal{M}}^{\prime }\to \mathcal{K}.$$

Definition 5.

A privacy secrecy rate pair $(R_{PL},R_K)\in {\mathbb{R}}_{+}^2$ for chosen secret key authentication is called achievable for a joint-source Q, if, for any $\delta >0,$ there exist an $n(\delta )\in \mathbb{N}$ and a sequence of $(n,M_n^{\prime },K_n)$-codes, such that, for all $n\ge n(\delta ),$ we have

$$\begin{array}{cc}\hfill Pr\{\widehat{K}\ne K\}& \le \delta ,\hfill \end{array}$$

(2a)

$$\begin{array}{cc}\hfill \frac{1}{n}log{K}_n& \ge R_K-\delta ,\hfill \end{array}$$

(2b)

$$\begin{array}{cc}\hfill \frac{1}{n}I(K;M^{\prime })& \le \delta ,\hfill \end{array}$$

(2c)

$$\begin{array}{cc}\hfill \frac{1}{n}I(X^n;M^{\prime })& \le R_{PL}+\delta .\hfill \end{array}$$

(2d)

Remark 4.

The difference between Definition 5 and 2 is that, in here, the uniformity of the key is already guaranteed.

Definition 6.

The privacy secrecy capacity region for chosen secret key authentication for the joint-source $Q\in \mathcal{P}(\mathcal{X}\times \mathcal{Y})$ is called privacy secrecy capacity region and is denoted as ${\mathfrak{C}}_C(Q)$.

We next present the privacy secrecy capacity region for chosen secret key authentication for the joint-source Q as showed in [11].

Theorem 2

 ([11]). The privacy secrecy capacity region for the chosen secret key authentication is given by

$${\mathfrak{C}}_C(Q)=\bigcup _{V:\mathcal{X}\to \mathcal{P}(\mathcal{U})}\mathcal{R}(Q,V).$$

3. Authentication for Compound Sources

Let $\mathcal{X}$ and $\mathcal{Y}$ be two finite sets and $\mathcal{S}$ a finite state set. Let $(x^n,y^n)\in {\mathcal{X}}^n\times {\mathcal{Y}}^n$ be a sequence pair of length $n\in \mathbb{N}$. For every $s\in \mathcal{S},$ the discrete memoryless joint-source is given by the joint probability distribution $Q_s^n(x^n,y^n)≔{\prod }_{i=1}^n{Q}_s(x_i,y_i)={\prod }_{i=1}^n{p}_s(x_i)W_s(y_i|x_i),$ with $p_s\in \mathcal{P}(\mathcal{X})$ a marginal distribution on $\mathcal{X}$ and $W_s:\mathcal{X}\to \mathcal{P}(\mathcal{Y})$ a stochastic matrix.

Definition 7.

The discrete memoryless compound joint-source ${\mathfrak{Q}}_{\mathcal{XY}}$ is given by the family of joint probabilities distributions on $\mathcal{X}\times \mathcal{Y}$ as

$${\mathfrak{Q}}_{\mathcal{X}\mathcal{Y}}≔\{Q_s\in \mathcal{P}(\mathcal{X}\times \mathcal{Y}):s\in \mathcal{S}\}.$$

We define the finite set of marginal distributions ${\mathfrak{Q}}_{\mathcal{X}}$ over the alphabet $\mathcal{X}$ from the compound joint-source ${\mathfrak{Q}}_{\mathcal{XY}}$ as

$$\begin{array}{c}\hfill {\mathfrak{Q}}_{\mathcal{X}}≔\left\{p_s\in \mathcal{P}(\mathcal{X}):s\in \mathcal{S},p_s(x)=\sum _{y\in \mathcal{Y}}{Q}_s(x,y)\mathrm{for}\mathrm{every}x\in \mathcal{X}\mathrm{and}{Q}_s\in {\mathfrak{Q}}_{\mathcal{X}\mathcal{Y}}\right\}.\end{array}$$

We define $\mathcal{L}$ as the index set of ${\mathfrak{Q}}_{\mathcal{X}}$. Note that $|\mathcal{L}|=|{\mathfrak{Q}}_{\mathcal{X}}|\le |{\mathfrak{Q}}_{\mathcal{XY}}|$.

For every $\ell \in \mathcal{L}$, we define the subset of the compound joint-source ${\mathfrak{Q}}_{\mathcal{XY}}$ with the same marginal distribution $p_{\ell }$ as

$$\begin{array}{c}\hfill {\mathfrak{Q}}_{\mathcal{XY},\ell }≔\left\{Q_s\in {\mathfrak{Q}}_{\mathcal{XY}}:Q_s(x,y)=p_{\ell }(x)W_s(y|x)\mathrm{for}\mathrm{every}(x,y)\in \mathcal{X}\times \mathcal{Y}\right\}.\end{array}$$

For every $\ell \in \mathcal{L}$, we define the index set ${\mathcal{S}}_{\ell }$ of ${\mathfrak{Q}}_{\mathcal{XY},\ell }$ as

$${\mathcal{S}}_{\ell }≔\{s\in \mathcal{S}:Q_s\in {\mathfrak{Q}}_{\mathcal{XY},\ell }\}.$$

Remark 5.

Note that, for every $\ell ,{\ell }^{\prime }\in \mathcal{L}$ with $\ell \ne {\ell }^{\prime }$, it holds that ${\mathfrak{Q}}_{\mathcal{XY},\ell }\cap {\mathfrak{Q}}_{\mathcal{XY},{\ell }^{\prime }}=\varnothing$, ${\mathcal{S}}_{\ell }\cap {\mathcal{S}}_{{\ell }^{\prime }}=\varnothing$, $\mathcal{S}={\bigcup }_{\ell \in \mathcal{L}}{\mathcal{S}}_{\ell }$ and ${\mathfrak{Q}}_{\mathcal{XY}}={\bigcup }_{\ell \in \mathcal{L}}{\mathfrak{Q}}_{\mathcal{XY},\ell }$.

3.1. Compound Generated Secret Key Model

In this section, we study the generated secret key authentication for finite compound joint-sources, which is a special class of sources that model a limited SSI, as shown in Figure 3.

We consider a block-processing of arbitrary but fixed length n. Let ${\mathcal{M}}^{\prime }≔\{1,\dots ,M_n^{\prime }\}$ be the helper data set and $\mathcal{K}≔\{1,\dots ,K_n\}$ the secret key set.

Definition 8.

An $(n,M_n^{\prime },K_n)$-code for generated secret key authentication for the compound joint-source ${\mathfrak{Q}}_{\mathcal{XY}}\subset \mathcal{P}(\mathcal{X}\times \mathcal{Y})$ consists of an encoder f at the enrollment terminal with

$$\begin{array}{cc}\hfill f& :{\mathcal{X}}^n\to \mathcal{K}\times {\mathcal{M}}^{\prime }\hfill \end{array}$$

and a decoder ϕ at the authentication terminal

$$\phi :{\mathcal{Y}}^n\times {\mathcal{M}}^{\prime }\to \mathcal{K}.$$

Definition 9.

A privacy secrecy rate pair $(R_{PL},R_K)\in {\mathbb{R}}_{+}^2$ is called achievable for generated secret key authentication for the compound joint-source ${\mathfrak{Q}}_{\mathcal{XY}}$, if, for any $\delta >0,$ there exist an $n(\delta )\in \mathbb{N}$ and a sequence of $(n,M_n^{\prime },K_n)$-codes, such that for all $n\ge n(\delta )$ and for every $s\in \mathcal{S},$ we have

$$\begin{array}{cc}\hfill Pr\{\widehat{K}\ne K\}& \le \delta ,\hfill \\ \hfill H(K)+\delta \ge \frac{1}{n}log{K}_n& \ge R_K-\delta ,\hfill \\ \hfill I(K;M^{\prime })& \le \delta ,\hfill \\ \hfill \frac{1}{n}I(X_s^n;M^{\prime })& \le R_{PL}+\delta .\hfill \end{array}$$

Consider the compound joint-source ${\mathfrak{Q}}_{\mathcal{XY}}$. For a fixed $\ell \in \mathcal{L}$, $V:\mathcal{X}\to \mathcal{P}(\mathcal{U})$ and for every $s\in {\mathcal{S}}_{\ell }$, we define the region $\mathcal{R}(V,\ell ,s)$ as the set of all $(R_{PL},R_K)\in {\mathbb{R}}_{+}^2$ that satisfy

$$\begin{array}{cc}\hfill R_K& \le I(U_{\ell };Y_s),\hfill \\ \hfill R_{PL}& \ge I(U_{\ell };X_{\ell })-I(U_{\ell };Y_s),\hfill \end{array}$$

with $P_{UXY,s}(u,x,y)=V(u|x)Q_s(x,y)$.

Theorem 3.

The privacy secrecy capacity region for generated secret key authentication for the compound joint-source ${\mathfrak{Q}}_{\mathcal{XY}}$ is given by

$${\mathfrak{C}}_G({\mathfrak{Q}}_{\mathcal{XY}})=\bigcap _{\ell \in \mathcal{L}}\bigcup _{\begin{array}{c}V:\mathcal{X}\to \mathcal{P}(\mathcal{U})\\ |\mathcal{U}|\le |\mathcal{X}|+|{\mathcal{S}}_{\ell }|\end{array}}\bigcap _{s\in {\mathcal{S}}_{\ell }}\mathcal{R}(V,\ell ,s).$$

Proof. 

The proof of Theorem 3 consists of two parts: achievability and converse. The achievability scheme uses the following protocol:

• Estimate the marginal distribution $p_{\widehat{\ell }}\in {\mathfrak{Q}}_{\mathcal{X}}$ from the observed sequence $X^n$ at the enrollment terminal via hypothesis testing.
• Compute the key K and a helper data M based on $X^n$, a common shared sequence $T=U^n$ by the enrollment and authentication terminal and using an extractor function $g:{\{0,1\}}^n\times {\{0,1\}}^d\to {\{0,1\}}^k$ with $N,d,k\in \mathbb{N}$ whose input are the shared sequence T and a sequence of d uniformly distributed bits $U_d$. The helper data M is equivalent to the helper data for the case with perfect SSI. The extended helper data in this case contains also the state of the marginal distribution and the uniformly distributed bits sequence, i.e., $M^{\prime }=(M,\widehat{L},U_d)$.
• Store the extended helper data $M^{\prime }$ in the public database.
• Estimate the key $\widehat{K}$ at the authentication terminal, based on the observations $M^{\prime }$ and $Y^n$, which can be seen as the outcome of one of the channels in ${\mathfrak{W}}_{\widehat{\ell }}≔\{W_s:\mathcal{X}\to \mathcal{P}(\mathcal{Y}):s\in {\mathcal{S}}_{\widehat{\ell }}\}$.

A detailed proof can be found in Appendix A. □

Remark 6.

Note that the authentication for compound source model is a generalization of the models studied by [11,12], i.e., $|\mathcal{S}|=1$. Furthermore, one can see that, for $|\mathcal{S}|=1$, the capacity region under the strong secrecy condition equals the capacity region under the weak secrecy condition showed by [11,12].

Remark 7.

As we already mentioned, we aim for strong secrecy, i.e., in contrast to the weak secrecy constraint in (1c), we now require the un-normalized mutual information between the key and the helper data to be negligibly small. It would be Ideal to show perfect secrecy and a perfectly uniformed key, i.e., $I(K;M^{\prime })=0$ and $H(K)=\frac{1}{n}log{K}_n$. It would be interesting to see how this constraint affects the achievable rate region. We suspect that the achievable rate region under perfect secrecy and perfectly uniformed key remains the same as in Theorem 3.

Remark 8.

From the protocol, note that once we have estimated the marginal distribution $p_{\widehat{\ell }}\in {\mathfrak{Q}}_{\mathcal{X}},$ we deal with a compound channel model without channel state information (CSI) at the transmitter (see [24]).

Remark 9.

The order of the set operations of the capacity region displays the fact that the marginal distribution is first estimated. This can be seen as partial state information, where the marginal distribution over $\mathcal{X}$ is known.

3.2. Compound Chosen Secret Key Model

In this section, we study chosen secret key authentication for finite compound joint-sources (see Figure 4).

We consider a $(n,M_n^{\prime },K_n)$-code of arbitrary but fixed length n.

Definition 10.

A privacy secrecy rate pair $(R_{PL},R_K)\in {\mathbb{R}}_{+}^2$ is called achievable for chosen secret key authentication for the compound joint-source ${\mathfrak{Q}}_{\mathcal{XY}}$, if for any $\delta >0$ there exist an $n(\delta )\in \mathbb{N}$ and a sequence of $(n,M_n^{\prime },K_n)$-codes, such that, for all $n\ge n(\delta )$ and for every $s\in \mathcal{S},$ we have

$$\begin{array}{cc}\hfill Pr\{\widehat{K}\ne K\}& \le \delta ,\hfill \end{array}$$

(3a)

$$\begin{array}{cc}\hfill \frac{1}{n}log{K}_n& \ge R_K-\delta ,\hfill \end{array}$$

(3b)

$$\begin{array}{cc}\hfill I(K;M^{\prime })& \le \delta ,\hfill \end{array}$$

(3c)

$$\begin{array}{cc}\hfill \frac{1}{n}I(X_s^n;M^{\prime })& \le R_{PL}+\delta .\hfill \end{array}$$

(3d)

Consider the compound joint-source ${\mathfrak{Q}}_{\mathcal{XY}}$. For a fixed $\ell \in \mathcal{L}$, $V:\mathcal{X}\to \mathcal{P}(\mathcal{U})$ and for every $s\in {\mathcal{S}}_{\ell }$, we define the region $\mathcal{R}(V,\ell ,s)$ as the set of all $(R_{PL},R_K)\in {\mathbb{R}}_{+}^2$ that satisfy

$$\begin{array}{cc}\hfill R_K& \le I(U_{\ell };Y_s),\hfill \\ \hfill R_{PL}& \ge I(U_{\ell };X_{\ell })-I(U_{\ell };Y_s),\hfill \end{array}$$

with $P_{UXY,s}(u,x,y)=V(u|x)Q_s(x,y)$.

Theorem 4.

The privacy secrecy capacity region for chosen secret key authentication for the compound joint-source ${\mathfrak{Q}}_{\mathcal{XY}}$ is given by

$${\mathfrak{C}}_C({\mathfrak{Q}}_{\mathcal{XY}})=\bigcap _{\ell \in \mathcal{L}}\bigcup _{\begin{array}{c}V:\mathcal{X}\to \mathcal{P}(\mathcal{U})\\ |\mathcal{U}|\le |\mathcal{X}|+|{\mathcal{S}}_{\ell }|\end{array}}\bigcap _{s\in {\mathcal{S}}_{\ell }}\mathcal{R}(V,\ell ,s).$$

Proof. 

The proof can be found in Appendix B. □

Remark 10.

Note that, as for generated secret key authentication for compound sources, chosen secret key authentication for compound sources is a generalization of the models studied by [11]. Furthermore, for perfect SSI, one can see that the capacity region under the strong secrecy condition equals the capacity region under the weak secrecy condition showed by [11].

Remark 11.

Note that the privacy secrecy capacity region for the generated key model equals the privacy secrecy capacity region for chosen secret key authentication, i.e., ${\mathfrak{C}}_G({\mathfrak{Q}}_{\mathcal{XY}})={\mathfrak{C}}_C({\mathfrak{Q}}_{\mathcal{XY}})$.

4. Continuity of the Privacy Secrecy Capacity Region for Compound Sources

We are interested in studying how small variations in the compound source affect the privacy secrecy capacity region. The question of whether the capacity or capacity region is a continuous function of a source or channel is not always clear, especially if the source or channel are complicated. In [22], one can find an example of AVWCs, whose uncertainty set consists of only two channels, which already shows discontinuity points in its unassisted secrecy capacity. For a detailed discussion, see [25]. In this section, we study the continuity of the privacy secrecy capacity region for compound sources. For this purpose, we introduce the distance between two compound sources and capacity regions, respectively.

4.1. Distance between Compound Sources

Definition 11.

Let ${\mathfrak{Q}}_{\mathcal{XY},1}$ and ${\mathfrak{Q}}_{\mathcal{XY},2}$ be two compound sources. We define

$$\begin{array}{cc}\hfill d_1({\mathfrak{Q}}_{\mathcal{XY},1},{\mathfrak{Q}}_{\mathcal{XY},2})& =\underset{s_2\in {\mathcal{S}}_2}{max}\underset{s_1\in {\mathcal{S}}_1}{min}{\parallel Q_{s_1}-Q_{s_2}\parallel }_{TV},\hfill \\ \hfill d_2({\mathfrak{Q}}_{\mathcal{XY},1},{\mathfrak{Q}}_{\mathcal{XY},2})& =\underset{s_1\in {\mathcal{S}}_1}{max}\underset{s_2\in {\mathcal{S}}_2}{min}{\parallel Q_{s_1}-Q_{s_2}\parallel }_{TV}.\hfill \end{array}$$

The Hausdorff distance $D_H({\mathfrak{Q}}_{\mathcal{XY},1},{\mathfrak{Q}}_{\mathcal{XY},2})$ between ${\mathfrak{Q}}_{\mathcal{XY},1}$ and ${\mathfrak{Q}}_{\mathcal{XY},2}$ is defined as

$$\begin{array}{c}\hfill D_H({\mathfrak{Q}}_{\mathcal{XY},1},{\mathfrak{Q}}_{\mathcal{XY},2})=max\left\{d_1({\mathfrak{Q}}_{\mathcal{XY},1},{\mathfrak{Q}}_{\mathcal{XY},2}),d_2({\mathfrak{Q}}_{\mathcal{XY},1},{\mathfrak{Q}}_{\mathcal{XY},2})\right\}.\end{array}$$

Definition 12.

Let ${\mathcal{R}}_1,$ and ${\mathcal{R}}_2$ be two non-empty subsets of the metric space $({\mathbb{R}}^2,d)$ with $d(x,y)=\sqrt{{\sum }_{i=1}^2{|x_i-y_i|}^2}$ for all $x,y\in {\mathbb{R}}^2$. We define the distance between two sets as

$$\begin{array}{c}\hfill D_R({\mathcal{R}}_1,{\mathcal{R}}_2)=max\{\underset{r_1\in {\mathcal{R}}_1}{max}\underset{r_2\in {\mathcal{R}}_2}{min}d(r_1,r_2),\underset{r_2\in {\mathcal{R}}_2}{max}\underset{r_1\in {\mathcal{R}}_2}{min}d(r_1,r_2)\}.\end{array}$$

4.2. Continuity of the Privacy Secrecy Capacity Region

Theorem 5.

Let $ϵ\in (0,1)$ and $n\in \mathbb{N}$. Let ${\mathfrak{Q}}_{\mathcal{XY},1}$ and ${\mathfrak{Q}}_{\mathcal{XY},2}$ be two compound sources. If

$$D_H({\mathfrak{Q}}_{\mathcal{XY},1},{\mathfrak{Q}}_{\mathcal{XY},2})\le ϵ,$$

then it holds

$$D_R({\mathfrak{C}}_G({\mathfrak{Q}}_{\mathcal{XY},1}),{\mathfrak{C}}_G({\mathfrak{Q}}_{\mathcal{XY},2}))\le \delta (ϵ,|\mathcal{X}|,|\mathcal{Y}|)$$

(4)

with $\delta (ϵ)=\sqrt{{\delta }_1{(ϵ)}^2+{\delta }_2{(ϵ)}^2},$ where ${\delta }_1(ϵ)=2ϵlog|\mathcal{Y}|+2H_2(ϵ)-ϵlog\frac{ϵ}{|\mathcal{U}|}$ and ${\delta }_2(ϵ)=2ϵlog|\mathcal{Y}||\mathcal{X}|+4H_2(ϵ)-2ϵlog\frac{ϵ}{|\mathcal{U}|}$.

Remark 12.

Note that since the privacy secrecy capacity region for the chosen secret key equals the privacy secrecy capacity region for the chosen secret key, the continuity behaviour holds also for the chosen secret key privacy capacity region.

Remark 13.

This theorem shows that the privacy secrecy capacity region is a continuous function of the uncertainty set. In other words, small variations of the uncertainty set lead to small variations in the capacity region.

Proof. 

A detailed proof can be found in Appendix C. □

Remark 14.

A complete characterisation of the discontinuity behaviour of the AVC capacity under list decoding can be found in [26]. Note that this behaviour, based on Theorem 5, can not occur.

5. Conclusions

In this paper, we considered a biometric authentication model in the presence of source uncertainty. In particular, we studied a model where the actual source realization is not known, however it belongs to a known source set: this is the finite compound source model. We have shown that biometric authentication is robust against source uncertainty and certain classes of attacks. In other words, reliable and secure authentication is possible at positive key rates. We further characterize the minimum privacy leakage rate under source uncertainty. For future work, perfect secrecy for the biometric authentication model and a compound source with infinite sources is of great interest.