Mutual Authentication using Fuzzy Fingerprint Vault

Biometric-based authentication can provide strong security guarantee about the identity of users. However, security/privacy of biometric data is particularly important as compromise of the data will be permanent. On the contrary, the security of a typical PKI-based user authentication solution is deteriorated by a simple password once the private key is protected by a simple password. In this paper, we present an implementation to improve the security of the typical PKI-based authentication by protecting the private key with a fingerprint. In addition to the functionality of the mutual authentication, our solution can alleviate the privacy issue of the fingerprint data by storing the fingerprint data not in a database, but in a user-carry device such as a smart card or a USB token. Furthermore, the fingerprint data stored in the user-carry device is conglomerated with the private key, and the private key is released only with the valid fingerprint