Cancelable biometric schemes generate secure biometric templates by combining user specific tokens and biometric data. The main objective is to create irreversible, unlinkable, and revocable templates, with high accuracy of comparison. In this paper, we cryptanalyze two recent cancelable biometric schemes based on a particular locality sensitive hashing function, index-of-max (IoM): Gaussian Random Projection-IoM (GRP-IoM) and Uniformly Random Permutation-IoM (URP-IoM). As originally proposed, these schemes were claimed to be resistant against reversibility, authentication, and linkability attacks under the stolen token scenario. We propose several attacks against GRP-IoM and URP-IoM, and argue that both schemes are severely vulnerable against authentication and linkability attacks. We also propose better, but not yet practical, reversibility attacks against GRP-IoM. The correctness and practical impact of our attacks are verified over the same dataset provided by the authors of these two schemes.

Smart cards are involved in most of activities, and they gather and record plenty of personal data. A manual interpretation of these raw data is difficult without specifications. This task becomes really tedious applied to plenty of devices. The paper introduces the first method to automatically retrieve textual information from memory dumps of smart cards. Given the data structure and encoding are assumed to be unknown, the method is based on text statistics and characteristics of smart cards to discard false positives. The experiments performed on more than 350 memory dumps revealed that the method can automatically retrieve more than 99% of textual information available in a dump, while keeping the false positive rate as low as 5.5%.

One time passwords are commonly used for authentication purposes in electronic transactions. Nevertheless, providing such a one time password is not really a strong authentication proof %as it can be given by an impostor. because the token generating the passwords can be given by an impostor. In order to cope with this problem, biometric recognition is more and more employed. Even if biometric data are strongly linked with the user, their revocability nor diversity is possible, without an adapted post-processing. Biometric template protection schemes, including the BioHashing algorithm, are used to manage the underlying privacy and security issues. These schemes are used for the protection of several biometric modalities, but are not necessary adapted for all of them. In this paper, we propose a new protocol combining protected biometric data and a classical synchronous one time password to enhance the security of user authentication while preserving usability and privacy. Behavioral biometrics is used to provide a fast and a usable solution for users. We show through experimental results the efficiency of the proposed method.

Biometric cryptosystems represent emerging techniques for biometric template protection. These cryptosystems are vulnerable to different types of attacks, as brute force attacks or correlation attacks if several templates are compromised. Another biometric security issue comes from certain biometric data (as fingerprint or face image) that can leave traces, but are, in the same time, the most commonly biometric modalities used in mobile security. In this paper, a new attack based on the alteration of original user data is investigated on fuzzy Vault biometric cryptosystems. We assume that the attacker uses a modified version of the real user image to gain unauthorized access to the system (mobile phone). Experimental results carried out using fingerprint and face modalities show that this assumption has serious impact on the security of this type of biometric cryptosystems.

E-health information systems give rise to many security and privacy concerns. Security of these systems involves a large amount of sensitive data shared by several actors, such as doctors or nurses in various institutions. However, the privacy preserving issue, including data minimization and data sovereignty, is not necessary treated. This paper presents an e-health infrastructure intended to minimize personal data disclosure, with an access to right system based on a secret sharing. We analyze the security of the proposed infrastructure in accordance with medical constraints through contactless transactions.

A post-processing function is used to reduce or eliminate statistical weaknesses of physical random number generators. The output bias of a n-bit input m-bit output function is examined, when the input bits are biased. For this purpose, the definition of (n, m, t)-corrector is introduced; many characterizations and properties of a corrector are presented. It appears as a generalization of the notion of resilience for a vectorial function. Several constructions of correctors from old correctors are also proposed.