Affiliations: [a] School of Information Systems, Singapore Management University, Singapore. E-mails: sunshine.tian86@gmail.com, robertdeng@smu.edu.sg | [b] Computer and Information Science, University of Oregon, USA. E-mail: yingjiul@uoregon.edu | [c] School of Electrical Engineering and Computing, University of Newcastle, NSW, Australia. E-mail: nan.li@newcastle.edu.au | [d] School of Software and Microelectronics, Peking University, Beijing, China. E-mail: wpf9808@pku.edu.cn | [e] Department of Computer Science and Engineering, Oakland University, USA. E-mail: anyiliu@oakland.edu
Abstract: In this paper, we introduce the first general framework for strong privacy-preserving biometric-based remote user authentication based on oblivious RAM (ORAM) protocol and computational fuzzy extractors. We define formal security models for the general framework, and we prove that it can achieve user authenticity and strong privacy. In particular, the general framework ensures that: (1) a strong privacy and a log-linear time-complexity are achieved by using a new tree-based ORAM protocol; (2) a constant bandwidth cost is achieved by exploiting computational fuzzy extractors in the challenge-response phase of remote user authentications.
