Building Cloud Based Biometric Services
Building Cloud Based Biometric Services
Over the next few years the amount of biometric data being at the disposal of various agencies and
authentication service providers is expected to grow significantly. Such quantities of data require not
only enormous amounts of storage but unprecedented processing power as well. To be able to face this
future challenges more and more people are looking towards cloud computing, which can address these
challenges quite effectively with its seemingly unlimited storage capacity, rapid data distribution and
parallel processing capabilities. Since the available literature on how to implement cloud-based
biometric services is extremely scarce, this paper capitalizes on the most important challenges
encountered during the development work on biometric services, presents the most important standards
and recommendations pertaining to biometric services in the cloud and ultimately, elaborates on the
potential value of cloud-based biometric solutions by presenting a few existing (commercial) examples.
In the final part of the paper, a case study on fingerprint recognition in the cloud and its integration into
the e-learning environment Moodle is presented.
Povzetek: Predstavljene so metode za biometrično razpoznavanje oseb, realizirane v oblaku.
1 Introduction
When talking about Internet authentication, in most necessary to devise highly scalable biometric technology,
cases, people are still talking about passwords. One of capable of operating on enormous amounts of data,
the biggest problems with current authentication which, in turn, induces the need for sufficient storage
approaches is the existence of too many password- capacity and significant processing power.
account pairings for each user, which leads to forgetting The first solution that comes to mind with respect to
or using the same username and password for multiple the outlined issues is moving the existing biometric
sites [1]. A possible solution to this problem can be technology to a cloud platform that ensures appropriate
found in the use of biometrics [2]. Biometric scalability of the technology, sufficient amounts of
authentication techniques, which try to validate the storage, parallel processing capabilities, and with the
identity of an user based on his/her physiological or widespread availability of mobile devices also provides
behavioral traits, are already quite widely used for local an accessible entry point for various applications and
authentication purposes (for private use), while their use services that rely on mobile clients. Hence, cloud
on the Internet is still relatively modest. The main reason computing is capable of addressing issues related to the
for this setting is open issues pertaining mainly to the next generation of biometric technology, but at the same
accessibility and scalability of existing biometric time, offers new application possibilities for the existing
technology. generation of biometric systems [4], [5].
Similar issues are also encountered in other However, moving the existing biometric technology
deployment domains of biometric technology, such as to the cloud is a nontrivial task. Developers attempting to
forensics, law-enforcement and alike. For example, tackle this task need to be aware of:
according to [3], the biometric databases of the Federal
Bureau of Investigation, the US State Department, the most common challenges and obstacles
Department of Defense, or the Department of Homeland encountered, when moving the technology to a
Security are expected to grow significantly over the next cloud platform,
few yours to accommodate several hundred millions (or
even billions) of identities. Such expectations make it
116 Informatica 37 (2013) 115–122 P. Peer et al.
standards and recommendations pertaining to both addition to presenting a case study on a specific
cloud-based services as well as biometrics in modality.
general, and
existing solutions that can be analysed for 3 Biometrics and cloud computing
examples of good practices.
1
Conducted in the scope of the KC CLASS (CLoud Assisted ServiceS)
project. [6]
Building Cloud-based Biometric Services Informatica 37 (2013) 115–122 117
2
We will refer to the template generation and matching
components as the biometric engine in the remainder of the paper.
118 Informatica 37 (2013) 115–122 P. Peer et al.
While the presented configuration makes full use of 4.2 Standards and recommendations
the merits of the cloud platform, it may not be
There are several standards and recommendations that
conformant with the local legislation. Therefore, the
are relevant in the context of both biometric recognition
possibility of using a locally hosted database needs to be
as well as cloud computing. These include internet
considered when designing a cloud-based biometric
protocols, data formats, communication and security
system. Such a setting may limit the scalability of the
protocols, recommendations for cloud application design,
technology to a certain extent, but is reasonable as it
recommendations for biometric technology design etc.
makes potential market-ready technology more easily
Since this field is too broad to be covered completely, the
adjustable to currently existing legislation. Another
focus of this paper is only on a small number of
possible solution to the legislation problem could also be
important standards related to biometric recognition
found in the use hybrid clouds.
technology in the cloud.
The first group of standards of interest for every
4 Integrating biometrics in the cloud developer working in the field of biometric recognition
are standards that allow for interoperability among
4.1 Challenges and obstacles different vendors (e.g. [22], [23]). These standards define
interchange formats for biometric data and (next to
When developing biometric technology for the cloud,
interoperability) also enable consolidation of different
one inevitably encounters a number of challenges and
biometric databases. The standard in [23], for example,
obstacles that need to be addressed. Next to meeting
specifies interchange formats for face images and as such
performance criteria and selecting the most suitable
defines full-frontal and token face images (defined by the
platform for the development work, current legislation
location of the eyes) and ensures that enrolled images
pertaining to cloud computing and biometrics in general,
meet a sufficient quality standard for arbitrary face
privacy concerns and data protection issues all represent
recognition technology. Similar standards also exist for
major challenges for the development process [4].
other biometric traits [24].
The challenges pointed out above are addressed in
The second group of standards of relevance to cloud-
different ways. The performance of the biometric
based biometrics is the OASIS standard for Biometric
recognition technology can systematically be evaluated
Identity Assurance Services (BIAS) [25]. The open
using established reproducible scientific methodology.
standard defines all specifications for SOAP-based
Here, publicly available databases with predefined
biometric services and is conveniently supported by a
experimental protocols and performance criteria are
reference implementation (for fingerprints) provided by
typically employed to produce performance estimates
NIST. The ISO/IEC JTC 001/SC 37 has just recently
that can be compared with performance estimates of
approved a project to internationalize the above
previously assessed technology.
mentioned BIAS standard.
The platform used in the development work is
commonly selected according to ones preferences or with
respect to the planned characteristics of the final product 4.3 Deployment possibilities and existing
(i.e. deployable in a private or public cloud etc.). solutions
When it comes to legal, privacy and data protection Cloud-based biometric technology offers attractive
concerns, there are usually no universal solutions, as they deployment possibilities, such as smart spaces, ambient
differ from country to country. In the case of Slovenia, intelligence environments, access control applications,
for example, the information officer has composed mobile application, and alike. While traditional (locally
several guidelines/recommendations both for the cloud as deployed) technology has been around for some time
well as biometric technology. The recommendations now, cloud-based biometric recognition technology is
relating to biometric technology, biometric data relatively new. There are, however, a number of existing
protection and template storage can be found in [20] and solutions already on the market, these include (among
fall in the domain of ZVOP-1 (in Slovenian: Zakon o others) the solutions by Animetrics [15], BioID [16] and,
varstvu osebnih podatkov), while the guidelines for cloud of course, Face.com [17], which has recently been
computing are accessible from [21]. acquired by Facebook.
5 A case study: fingerprint implemented locally. For our case study, we decided to
move the biometric engine as well as the biometric
recognition in the cloud database to the cloud. A block diagram of the complete
cloud-based biometric service design is shown in Fig. 3.
5.1 Goal and setup Note that the verification process with the described
The goal of the case study presented in the remainder is design is conducted using the following scenario:
to put the general guidelines presented in the previous i) the fingerprint of a given user is first captured via a
sections into practice and provide more detailed fingerprint scanner (here scanner libraries that allow
(technical) information on the process of integrating capturing fingerprint images need to be integrated
biometric technology into a cloud platform. The basis of into the local (desktop or/and web) application);
the case study represents a prototype fingerprint ii) the application then communicates through a
recognition systems, named FingerIdent [26]. A local test (REST) API with the biometric web service hosted
version of this prototype system is already installed at the in the cloud and sends an encoded image to the
Faculty of Computer and Information Science, fingerprint processing library (i.e. FingerIdent
University of Ljubljana, in front of the Computer Vision library) that provides the functionality for the cloud
Laboratory. service;
The functionality of the existing local version of the iii) the transmitted fingerprint image is processed in the
FingerIdent system can be divided into two main cloud and finally the result is sent back to the local
categories: application.
i) user registration (enrollment), during which a The security of the presented solution is provided on
biometric template of a given user is constructed different levels through:
and stored in the system’s database, and
the use of the HTTPS protocol for data transfer,
ii) user verification, during which the identity claim of
the use of certificates (the SSL protocol),
a given user is validated.
the encryption of passwords and other data (such as
The registration process uses a fingerprint reader to biometric templates) in the database, and
capture the (biometric) fingerprint data. In the next phase the protection of the access to the cloud-service
the quality of the captured sample is evaluated and if it is with a complex 40-digit password.
found to be adequate, the system extracts features from it
and stores them in the form of a biometric template in the The cloud-based service is designed modularly,
database. During the verification process features from which makes upgrading the service a relatively simple
the captured “live” fingerprint are again extracted and task. Equally important is the fact that the same design is
compared to those stored in the database. The also suitable for other biometric modalities and allows
comparison is made based on pattern matching for devising multi-modal person authentication as well.
procedures, which form the foundation for the validation
of the identity claim. An illustration of both functions is 5.3 Moodle with fingerprint verification
shown in Fig. 2. To demonstrate the effectiveness of the presented
To reach the goal of devising a cloud-based solution and to provide a proof-of-concept, the e-learning
biometric service, one needs to migrate the presented environment Moodle [27] is augmented with biometric
functionality of the local FingerIdent system to the cloud authentication capabilities by integrating it with the
and provide the necessary infrastructure for accessing the cloud-based fingerprint verification service.
biometric service. Details on this procedure are given in Since Moodle is also designed modularly, the
the next section. biometric authentication procedure is implemented as an
additional (optional) authentication scheme, which can
5.2 Designing cloud biometric services complement the existing procedures and provide an
It was emphasized in Section 3.3 that a decision has to be additional level of access security. A block diagram of
made with respect to which components of the biometric the integration is shown in Fig. 4.
system should be moved to the cloud and which
120 Informatica 37 (2013) 115–122 P. Peer et al.
The main problem faced during integration is the The solution developed in the scope of this case
compatibility of various fingerprint readers with different study uses an ActiveX component to access the
browsers. Each manufacturer of fingerprint readers offers hardware. ActiveX components are officially supported
their own protocols and libraries to access the only on Internet Explorer, which represents a weakness
corresponding hardware. A standard is not yet available. in the implementation. As future work, an extension of
the presented solution is planned, so it can work with
Building Cloud-based
based Biometric Services Informatica 37 (2013) 115–122 121
http://animetrics.com/cloud-face-recognition-
services/, last visited: 03.10.2012.
[16] Homepage of the BioID cloud-based biometric
recognition solution, available from:
http://www.bioid.com/, last visited: 03.10.2012.
[17] Homepage of the Face.com cloud-based face
recognition solution, available from:
http://face.com/, last visited: 03.10.2012.
[18] Homepage of Ceelox ID Online, available from:
http://www.ceelox.com/ceeloxidonline.html, last
visited: 05.12.2012.
[19] Homepage of PasswordBank IDaaS, available from:
http://www.passwordbank.com/passwordbank-
private-cloud, last visited: 05.12.2012.
[20] Homepage of the Slovenian Information
Commissioner, biometrics, available from:
https://www.ip-rs.si/varstvo-osebnih-
podatkov/informacijske-tehnologije-in-osebni-
podatki/biometrija/, last visited: 03.10.2012.
[21] Information Commissioner, Cloud Security
Alliance Slovenia Chapter, Slovenski institut za
revizijo, Slovenski odsek ISACA, Zavod e-Oblak,
Eurocloud Slovenia, “Varstvo osebnih podatkov &
računalništvo v oblaku,” pp. 31, 2012, available
from: https://www.ip-rs.si/fileadmin/user_upload/
Pdf/smernice/Smernice_rac_v_oblaku.pdf, last
visited: 03.10.2012.
[22] Information technology, “Biometric data
interchange formats – Part 5: Face image analysis,”
Documents ISO/IEC 19794-5:2005, 2004, available
from: http://www.iso.org, last visited: 03.10.2012.
[23] Information technology, “Face recognition format
for data interchange,” Document 385-2004 ANSI
INCITS, 2004, available from: http://www.iso.org,
last visited: 03.10.2012.
[24] NIST standard, ANSI/NIST-ITL 1-2011, NIST
Special Publication 500-290, Data Format
for the Interchange of Fingerprint, Facial & Other
Biometric Information, available from:
http://www.nist.gov/itl/iad/ig/ansi_standard.cfm,
last visited: 03.10.2012.
[25] OASIS standard, “Biometric Identity Assurance
Services (BIAS) SOAP Profile Version 1.0,” pp.
210, May 2012, available from: https://www.oasis-
open.org/committees/tc_home.php?wg_abbrev=bia
s, last visited: 03.10.2012.
[26] M. Tovšak, J. Bule, P. Peer, "Upgrading a system
for verification based on fingerprints," in:
Electrotechnical and Computer Science Conference
(ERK), vol. B, pp. 135-138, 2011.
[27] Moodle, open-source e-learning software platform,
available from: http://moodle.org, last visited:
06.12.2012.