Homomorphic encryption is a powerful mechanism that allows sensitive data, such as biometric data, to be compared in a protected way, revealing only the comparison result when the private key is known. This is very useful for non-device-centric authentication architectures with clients that provide protected data and external servers that authenticate them. While many reported solutions do not follow standards and are not resistant to quantum computer attacks, this work proposes a secure biometric authentication scheme that applies homomorphic encryption based on the Classic McEliece public-key encryption algorithm, which is a round 4 candidate of the NIST post-quantum standardization process. The scheme applies specific steps to transform the features extracted from biometric samples. Its use is proposed in a non-device-centric biometric authentication architecture that ensures user privacy. Irreversibility, revocability and unlinkability are satisfied and the scheme is robust to stolen-device, False-Acceptance Rate (FAR) and similarity-based attacks as well as to honest-but-curious servers. In addition to the security achieved by the McEliece system, which remains stable over 40 years of attacks, the proposal allows for very reduced storage and communication overheads as well as low computational cost. A practical implementation of a non-device-centric facial authentication system is illustrated based on the generation and comparison of protected FaceNet embeddings. Experimental results with public databases show that the proposed scheme improves the accuracy and the False-Acceptance Rate of the unprotected scheme, maintaining the False-Rejection Rate, allows real-time execution in clients and servers for Classic McEliece security parameter sets of 128 and 256 bits (mceliece348864 and mceliece6688128, respectively), and reduces storage requirements in more than 90.5% compared to the most reduced-size homomorphic encryption-based schemes with post-quantum security reported in the literature.

Nowadays, biometrics based on vein patterns as a trait is a promising technique. Vein patterns satisfy universality, distinctiveness, permanence, performance, and protection against circumvention. However, collectability and acceptability are not completely satisfied. These two properties are directly related to acquisition methods. The acquisition of vein images is usually based on the absorption of near-infrared (NIR) light by the hemoglobin inside the veins, which is higher than in the surrounding tissues. Typically, specific devices are designed to improve the quality of the vein images. However, such devices increase collectability costs and reduce acceptability. This paper focuses on using commercial smartphones with ordinary cameras as potential devices to improve collectability and acceptability. In particular, we use smartphone applications (apps), mainly employed for medical purposes, to acquire images with the smartphone camera and improve the contrast of superficial veins, as if using infrared LEDs. A recognition system has been developed that employs the free IRVeinViewer App to acquire images from wrists and dorsal hands and a feature extraction algorithm based on SIFT (scale-invariant feature transform) with adequate pre- and post-processing stages. The recognition performance has been evaluated with a database composed of 1000 vein images associated to five samples from 20 wrists and 20 dorsal hands, acquired at different times of day, from people of different ages and genders, under five different environmental conditions: day outdoor, indoor with natural light, indoor with natural light and dark homogeneous background, indoor with artificial light, and darkness. The variability of the images acquired in different sessions and under different ambient conditions has a large influence on the recognition rates, such that our results are similar to other systems from the literature that employ specific smartphones and additional light sources. Since reported quality assessment algorithms do not help to reject poorly acquired images, we have evaluated a solution at enrollment and matching that acquires several images subsequently, computes their similarity, and accepts only the samples whose similarity is greater than a threshold. This improves the recognition, and it is practical since our implemented system in Android works in real-time and the usability of the acquisition app is high.