Privacy-Preserving Decentralized Biometric Identity Verification in Car-Sharing System

In the real world, we rely on governments to issue identity credentials in the form of physical representations such as passports, birth certificates, and driver's licenses. These documents contain information that is kept by a central authority, usually in protected digital storage. However, we use physical copies of these documents independently of those centralized systems for identification purposes because of their convenience and portability. For example, we can open a bank account or travel on an airline by using only our driver's license as it represents a verified set of data about us [8]. However, in a digital world, people tend to use KYC systems to identify themselves. Customer identification, authentication, and verification form the foundation of KYC procedures, which are essential for many businesses, including banking, telecommunications, and shared services like car rentals [9]. The KYC process is designed to prevent identity theft, financial fraud, money laundering and terrorist financing.

However, existing KYC processes are often seen as intrusive, time-consuming, and prone to errors. A major concern is that they typically require customers to share sensitive personal information, posing privacy risks. Additionally, traditional KYC procedures are often manual, which can lead to human errors and inefficiencies [10]. An innovative area where efficient and reliable KYC procedures are critical is in the field of contactless car-sharing applications. These applications allow users to rent cars for short periods, often by the minute. The process is entirely app-based, with users locating, unlocking, and starting cars directly from the app [11]. To ensure secure transactions and prevent unauthorized usage, car-sharing services must implement robust KYC procedures. When a user signs up, they provide their personal details and driver's license information. The system then verifies this information against various databases to ensure its accuracy and validity. Fig. 1 shows the sequence diagram of the current contactless car-sharing system.

Fig. 1. Sequence diagram of the current contactless car-sharing system.

Download Original Figure

Current authentication systems used in contactless car-sharing environments typically authenticate users during enrollment. Mobile app authentication requires users to authenticate themselves through a dedicated car-sharing mobile app, which communicates with the vehicle to unlock the doors and start the engine. However, after a user is enrolled and has booked a car, such applications do not verify the driver's identity, and they have no ability to do so. This can lead to identity fraud, as the car may be booked by a certified driver, but the actual driver may not have a valid driver's license.

In a digital era, the management of digital identities has become a critical issue. Traditional centralized identity systems pose significant privacy and security concerns, resulting in a growing interest in decentralized identity management systems. SSI, DID, and VC are innovative technologies that could revolutionize the way we manage and verify identities in the digital world. SSI is a concept that allows individuals or organizations to have complete control over their digital identities [12]. Unlike traditional identity systems, where identities are managed by a central authority, in an SSI model, individuals hold their identities and control how their personal information is shared and used. A crucial element of SSI is the DID, a type of identifier that is self-created, globally unique, and not reliant on any centralized registry, identity provider, or certificate authority [13]. DIDs are stored on a decentralized network, such as a blockchain, and can be resolved to DID documents that contain public key material, authentication descriptors, and service endpoints, enabling secure, privacy-preserving communication and interaction. VCs, on the other hand, are digital equivalents of physical credentials, such as driver's licenses, passports, or university degrees [14]. They are tamper-evident and cryptographically verifiable, meaning they can be trusted to be genuine and not manipulated. The issuer of a VC can be independently verified, and the holder of the VC can prove they are the legitimate owner without exposing the actual data contained in the credential.

These technologies can provide significant benefits. They offer enhanced privacy, as users can control who accesses their data and for what purpose. They improve security by eliminating the need for centralized databases that can be targeted by hackers. One potential application of these technologies is in KYC processes. An individual could hold a VC that proves their identity, issued by a trusted authority. When they need to prove their identity, they present the VC, which can be cryptographically verified by the relying party. The individual doesn't need to provide any additional personal data, and the relying party doesn't need to conduct any further checks. This could streamline KYC processes, reduce privacy risks, and provide a better user experience.

Fig. 2 shows the traditional DID scheme. This structure benefits the biometric system by allowing full control of identifiers of the subject with an individual biometric identifier, independent of different heterogeneous providers. Thus, biometrics could significantly improve currently distributed digital identity schemes based on the blockchain. In terms of on-chain challenges, DIDs help transfer most of the processing load from the main blockchain to the off-chain network. A DID document consists of three fundamental parts: an authentication key, an authentication method, and a service endpoint. Whoever has access to the key is entitled to access the DID document. Therefore, we suggest future research use biometric data only in combination with similar specifications, i.e., off-chain, minimizing both the quantity and sensitivity of personal data stored on-chain.

Fig. 2. The traditional DID scheme.

Download Original Figure

Blockchain technology, initially conceived for the cryptocurrency Bitcoin, has been recognized for its potential to transform various industries [15]. A blockchain is a distributed ledger that allows multiple parties to reach a consensus on a single version of shared digital history. Its immutable nature and transparency make it a highly reliable system for many applications, including authentication and verification [16]. In the context of digital identity, blockchain can be used to store DIDs and their associated public keys securely. This allows individuals to prove their identity without revealing any personal data, enhancing privacy and security. Furthermore, the cryptographic nature of the blockchain ensures the integrity of the DIDs, making it nearly impossible for identities to be forged or altered.

Moreover, blockchain and smart contracts can be used to verify transactions and interactions. For example, in a blockchain-based voting system, a smart contract could automatically verify each vote's validity, ensuring that only eligible voters can vote and that each voter can only vote once [17]. This can significantly increase the transparency and integrity of the voting process, strengthening trust in the system.

In the realm of decentralized data storage and management, a critical evaluation of cost-effectiveness and efficiency is paramount. The choice between utilizing blockchain (or smart contracts) and alternative storage solutions such as the IPFS (InterPlanetary File System) hinges significantly on the associated costs [18]. Analyzing the cost implications, it is observed that storing 1 kB of data via a smart contract execution on the Ethereum blockchain consumes approximately 2,155,120 gas. Given the Ethereum price of 1,574.26 USD as of October 18, 2023, the resultant cost equates to around 47 USD per 1 kB of data. In a practical application where encrypted biometric features approximating 446 kB need to be stored, the financial expenditure escalates to an approximate value of 20,962 USD. Additionally, the storage of a public key, which typically encompasses substantial data, in this case around 47.3 MB, further inflates the cost to an estimated 2,223,100 USD.

Considering such substantial costs, even the exploration of alternative networks does not present a viable economic solution due to the inherently high expenses associated with substantial data storage on blockchain technologies. Thus, an optimized approach involves leveraging IPFS for the storage of substantial content such as encrypted biometric features and public keys. Concurrently, the blockchain can be utilized efficiently by storing only the DID URI linked with the Content Identifier (CID). This strategic approach significantly reduces the data storage requirements on the blockchain to an estimated 100 kB, thereby reducing the execution cost to about 451,325 gas. Based on the pricing as of October 18, 2023, this translates to a cost of approximately 9.9572 USD, representing a pragmatic and cost-efficient strategy for decentralized data storage and management. Consequently, by implementing IPFS and blockchain, we still ensure that there is no single point of failure, and since only encrypted versions of biometrics are stored online, privacy is preserved.

Homomorphic encryption is a transformative cryptographic technique that facilitates computations on encrypted data without necessitating its decryption. This ensures that sensitive data remains confidential throughout computational processes, thereby bolstering its security and privacy. The concept remained largely theoretical until 2009, when Craig Gentry presented the first fully homomorphic encryption (FHE) scheme [19]. This FHE scheme utilized lattice-based cryptography and allowed both addition and multiplication on encrypted data. The significance of homomorphic encryption lies in its potential applications, especially in cloud computing. It enables data owners to outsource computations to cloud servers without compromising the confidentiality of their data. Since Gentry's pioneering work, there has been a surge in research dedicated to optimizing and enhancing the efficiency of homomorphic encryption schemes. Notable advancements include leveled homomorphic encryption, which allows users to set a limit on the depth of computations [20], and bootstrapping techniques that refresh ciphertexts to reduce noise [21]. These innovations are paving the way for the practical implementation of homomorphic encryption in real-world scenarios, such as secure voting systems, private medical data analysis, and encrypted search.

In practical application scenarios like neural networks, the introduction of hierarchical Galois keys proves to be highly efficient. For example, with the use of the proposed hierarchical Galois keys, the implementation of networks such as ResNet-20 and ResNet-18 becomes more feasible, as evidenced by the reduced memory requirements and the maintenance of competitive classification accuracies in encrypted domains. Furthermore, homomorphic encryption, leveraging the innovative use of Galois keys and other optimizations, finds substantial applications in supply chain security, regulatory compliance, and private data analytics. This cryptographic method enables secure third-party computations, adherence to rigorous data protection regulations such as the GDPR, and private and secure data analytics operations.

Galois automorphisms are intrinsic to field theory in mathematics, with profound applications in homomorphic encryption, particularly in schemes like the Brakerski-Fan-Vercauteren (BFV) and Cheon-Kim-Kim-Song (CKKS). A Galois automorphism is defined as an isomorphism from a field to itself that preserves field operations, mathematically represented as

for all (a,b) in a field (F), where (\sigma: F to F) is a bijective map.

In the context of HE, Galois automorphisms facilitate essential operations such as rotation and permutation on encrypted data, enhancing the utility of encryption schemes for complex operations without decryption. This is pivotal in algorithms related to AI and machine learning (ML), where encrypted data can be manipulated efficiently, preserving privacy and security.

Schroff et al. [22] introduced FaceNet, a remarkable system proficient at directly learning a mapping from face images to a compact Euclidean space where distances authentically signify face similarity. In this well-constructed space, conventional tasks like face recognition, verification, and clustering become straightforward, utilizing FaceNet embeddings as pivotal feature vectors. Employing a deep convolutional network, this methodology is distinct, optimizing the embedding directly and bypassing the intermediate bottleneck layer optimization common in previous deep learning strategies. A unique online triplet mining method is used for training, employing triplets of nearly aligned matching/non-matching face patches. This innovative approach enhances representational efficiency, enabling exemplary face recognition performance while requiring only 128 bytes per face.

The FaceNet model architecture, as depicted in Fig. 3(a), encompasses a batch input layer and a profound CNN, succeeded by L₂ normalization, culminating in the generation of face embeddings. The influential triplet loss is applied during the training phase.

Fig. 3. FaceNet structure and model.

Download Original Figure

Triplet Loss plays a crucial role in diminishing the distance between an anchor and a positive (of identical identity) while concurrently maximizing the distance with a negative from a different identity. The process is shown in Fig. 3(b). Triplet Loss, essential for optimization during training, is computed using the equation:

where:

The squared L₂ distance metric is crucial in measuring similarities between embeddings. This metric computes the square of the Euclidean distance between two points in the embedding space, ensuring effective differentiation between various face embeddings.

Here, D(x,y) symbolizes the squared L₂ distance between the embeddings of images (x) and (y).

The onboarding process consists of two phases: registration and verification.

The car rental process is streamlined compared to traditional methods. By enhancing the security of the onboarding process, reliance on additional KYC services is eliminated, as falsifying a digital license becomes infeasible. Car-sharing companies can verify users by accessing records on the blockchain. Thus, while the basic car rental process remains unchanged, the verification component is simplified. Users apply for a rental through the car-sharing app, presenting their digital driver's license. The car-sharing company verifies the VC_Pk against the blockchain and approves or denies the user's application. Other processes such as booking and payment, are outside the scope of this thesis and remain unchanged.

The user, upon entering the rented vehicle, captures their biometric image using the in-car camera. The vehicle extracts features using the prescribed method (Algorithm 1) and encrypts them with the user's HE_Sk. These encrypted features are sent to the car-sharing company, which then retrieves the previously stored encrypted features from IPFS to compute the Euclidean distance as outlined in Algorithm 8. The car-sharing company sends the encrypted result back to the vehicle, where the user decrypts it with their HE_Sk, enabling the car to decide whether to grant engine access. This crucial phase of the authentication process is delineated in Algorithm 10.

This report presents a comprehensive evaluation of an authentication system based on various metrics and processing times of image comparisons. The evaluation metrics include the false acceptance rate (FAR), false rejection rate (FRR), acceptance rate (AR), and rejection rate (RR). Additionally, the report analyzes the average processing times involved in each step of the image comparison process.

4.2.1. Evaluation Metrics

The evaluation metrics are calculated based on the number of true positives (TP), true negatives (TN), false positives (FP), and false negatives (FN) observed during the authentication process. Fig.6 shows the system evaluation metrics, where the formulas for the metrics are as follows:

Fig. 6. System evaluation metrics.

Download Original Figure

Algorithm 8. Calculating squared euclidean distance between encrypted vectors.

Download Excel Table

Algorithm 9. Serialization of squared euclidean distance.

Download Excel Table

Algorithm 10. Decrypting and verifying the squared euclidean distance.

Download Excel Table

• False acceptance rate (FAR):

  $\frac{FP}{FP+TN}=0.0429 \left(or 4.29\%\right)$

• False rejection rate (FRR):

  $\frac{FN}{FN+TP}=0.3214 \left(or 32.14\%\right)$

• Acceptance rate (AR):

  $\frac{TP}{TP+FN}=0.6786 \left(or 67.86\%\right)$

• Rejection rate (RR):

  $\frac{TN}{TN+FP}=0.9571\left(or 95.71\%\right)$

4.2.2. Processing Time

In the examination of system efficiency, a detailed temporal analysis was conducted for each discrete stage of the image comparison workflow. The constituent processes scrutinized were the feature extraction, the encryption of these features, the computation of the Euclidean distance in an encrypted form, and the final decryption and result determination. Fig. 7 shows the time per two image execution. For each of these operations, the average time required was meticulously recorded, facilitating a comprehensive understanding of the time allocation across the entire procedure. These averages were then aggregated to determine the total average duration necessary to complete a single image comparison. The average time per step with average total final time can be seen in Fig. 8. The findings from this temporal evaluation are meticulously tabulated, providing insights into the performance and scalability of the system, and are expounded upon in the ensuing discussion.

Fig. 7. Time per two image execution.

Download Original Figure

Fig. 8. Average time per step with average total final time.

Download Original Figure

4.2.3. System Performance Evaluation for Different Threshold

In the analysis of the facial recognition system's performance across various thresholds of Euclidean distance, four key metrics were evaluated: false acceptance rate (FAR), false rejection rate (FRR), acceptance rate (AR), and rejection rate (RR). Fig. 9 illustrates how these metrics vary as the threshold level changes and values are displayed in the Table 3. As observed, with increasing thresholds, FAR generally tends to decrease, indicating fewer instances where the system incorrectly accepts a non-face as a face. Conversely, FRR typically increases with higher thresholds, reflecting more instances of the system failing to recognize a true face. The acceptance rate (AR), representing the proportion of true faces correctly identified, tends to increase with lower thresholds. In contrast, the rejection rate (RR), depicting the proportion of non-faces correctly rejected, usually decreases as the threshold is lowered.

Fig. 9. System performance evaluation for different thresholds.

Download Original Figure

Table 3. System performance evaluation for different threshold.

Euclidean distance	FAR (%)	FRR (%)	AR (%)	RR (%)
10	0.00	100.00	0.00	100.00
20	2.14	98.57	1.43	97.86
30	2.14	92.86	7.14	97.86
40	3.57	83.57	16.43	96.43
50	4.29	70.00	30.00	95.71
90	5.00	33.5	66.43	95.00
100	4.29	32.14	67.86	95.71
110	4.29	27.86	72.14	95.71
120	4.29	26.43	73.57	95.71
130	4.29	22.86	77.14	95.71
140	5.0	21.43	78.57	95.00
150	10.00	18.57	81.43	90.00
160	16.43	11.43	88.57	83.57
170	22.14	6.43	93.57	77.86
180	30.00	2.14	97.86	70.00
190	36.43	0.71	99.29	63.57
200	45.00	0.71	99.29	55.00

Download Excel Table

The Fig. 10 focuses on determining the equal error rate (EER) of the system, a crucial metric in biometric systems, representing the point where FAR and FRR are equal. This balance point is vital in evaluating the overall reliability and accuracy of the system. The EER was computed by identifying the threshold at which the absolute difference between FAR and FRR was minimal. In this analysis, the EER was found to be approximately 13.93% at a threshold of 160. This value indicates the system’s trade-off point, where both types of errors (accepting false positives and rejecting true positives) are equally probable. The lower the EER, the higher the accuracy of the system. Thus, in this context, an EER of 13.93% suggests a moderate level of accuracy for the facial recognition system under evaluation, highlighting a significant consideration for practical applications and further optimization.

Fig. 10. Equal error rate (EER).

Download Original Figure

In Table 4, we present a comprehensive comparison of our proposed system with key related works in the field. This comparison focuses on several vital parameters that are pivotal in assessing the sophistication and robustness of contemporary biometric systems.

Firstly, the aspect of HE, a critical component for ensuring data privacy and security, is universally adopted across all the compared systems, including ours. This approach is evident in the works of Sperling et al. [24], Gomez Barrero et al. [25], Yasuda et al. [26], and Alberto Torres et al.[27] , underscoring its significance in the field.

A significant distinction arises in the decentralized approach parameter. Our system uniquely integrates a decentralized framework, enhancing data integrity and reducing reliance on centralized data control, setting it apart from the approaches taken by other related works. This decentralization not only bolsters security but also aligns with modern trends in data management and privacy [28]. In the realm of AI-driven verification, our system stands out by leveraging advanced artificial intelligence algorithms for verification processes, a feature not presented in the referenced works. This integration signifies a leap forward in verification accuracy and efficiency. On the other hand, the work from [29] presents an innovative approach to anti-theft solutions for vehicles. While our methodology addresses a similar challenge, it offers distinct advantages in terms of applicability across different industries where user verification is crucial. A key feature of our solution is that it does not require data storage within the vehicle, allowing for greater flexibility and adaptability. Additionally, while [29] highlights the challenges facial recognition technology faces, such as varying lighting conditions, angles, and other environmental factors, we contend that physiological biometrics offer a more reliable and immutable form of identification. These biometric markers are inherently more difficult to replicate or bypass compared to behavioral patterns, which can exhibit a significant degree of similarity among different individuals. This underscores the potential for error in systems relying solely on behavioral data, further emphasizing the robustness of physiological biometrics as a security measure.

User-centric Management, which empowers users with greater control over their biometric data, is another unique feature of our system, distinguishing it from the other cited works. This approach aligns with the growing emphasis on user privacy and autonomy in data management. Regarding Off-chain Data Storage, all the systems under comparison, including ours, employ this method. This is indicative of a shared recognition of the importance of secure and efficient data storage solutions outside the blockchain. Our system also uniquely facilitates Temporary Access, a feature not seen in the other works. This adds a layer of flexibility and user control, especially useful in scenarios requiring time-bound access permissions. Finally, in terms of Protection Against Adversary Attacks, our system, along with the system proposed by Sperling et al., demonstrates robust mechanisms to safeguard against various cyber threats, an aspect where some of the other compared systems fall short. Overall, this comparative analysis underscores the advanced features and enhanced security measures of our proposed system, setting it apart from existing works in significant ways.

In comparing our system's performance with that of Alberto Torres et al. [27], a substantial enhancement in pro-cessing time is evident. Our system demonstrates an impressive average time of only 1.4 seconds per image pair comparison. This duration encompasses the entire gamut of operations, including key generation, encryption, decryption, and Euclidean distance calculation. In contrast, the system evaluated by Alberto Torres et al. [27] required 10.4 minutes for each comparison of two biometric templates in an encrypted domain. This marked reduction in processing time represents a significant advancement in the efficiency of biometric systems. However, it is crucial to acknowledge that the computations in our study were conducted on a different biometric template. This distinction is important as it might influence the direct comparability of the two systems' performance metrics. Nevertheless, the improvement in processing speed in our system is a noteworthy achievement in the realm of biometric template comparison, potentially contributing to more efficient and practical applications in the field.

Our research methodology is focused primarily on the mechanisms of authentication and verification, without delving into the intricacies of the car rental process itself or the operational aspects of in-car hardware. It's important to clarify several key aspects of our approach to ensure a comprehensive understanding: