A cancelable fingerprint biometric based session key establishment protocol

摘要

Symmetric key cryptography needs the communicating parties to share a secret key. It is desired that a different shared key is established for each communication session. A trusted third party distributes these shared keys through a communication link between communicating parties. As the key is transferred through an insecure communication link attacker can guess the key easily. So maintenance and distribution of keys is a problem. Efficient and reliable techniques are needed that allow two or more remote parties to set up a shared secret key in a dynamic on-demand manner. As a probable solution to this problem, generation of the cryptographic key using the biometric traits of both communicating parties during the transmission session can be done. Thus avoiding key storing and key sharing in session key establishment protocols. However, this biometric based cryptographic key generation has some difficulties of maintaining the privacy of user's biometric data, exchanging of biometric data and revocable key generation from irrevocable biometric. This present methodology addresses the mentioned concern and proposes a session key establishment protocol where communicating parties first transform their biometric template in cancelable one to preserve the privacy of biometric template and exchange transformed template with each other. After that generate a 128- bit session key in their end with the help of their combined cancelable fingerprint templates and a random shuffle key provided to them by a trusted authentication server. Authentication server works as a trusted third party and is located in between the communicating parties. As both parties generates the same session key in their end there is no need to share secret key through insecure channel. This generated biometric based session keys can be used in the session key establishment protocol for better security of data transmission.