Fundamental limits for biometric identification with a database containing protected templates

In this paper we analyze secret generation in biometric identification systems with protected templates. This problem is closely related to the study of the biometric identification capacity of Willems et al. 2003 and O'Sullivan and Schmid 2002 and the common randomness generation of Ahlswede and Csiszár 1993. In our system two terminals observe biometric enrollment and identification sequences of a number of individuals. It is the goal of these terminals to form a common secret for the sequences that belong to the same individual by interchanging public (helper) messages for all individuals in such a way that the information leakage about the secrets from these helper messages is negligible. It is important to realize that biometric data are unique for individuals and cannot be replaced if compromised. Therefore the helper messages should contain as little as possible information about the biometric data. On the other hand, the second terminal has to establish the identity of the individual who presented his biometric sequence, based on the helper data produced by the first terminal. In this paper we determine the fundamental tradeoff between secret-key rate, identification rate and privacy-leakage rate in biometric identification systems.