Xuechun Mao,Ying Chen,Cong Deng,Xiaqing Zhou
A novel privacy-preserving biometric authentication scheme
Most existing secure biometric authentication schemes are server-centric, and users must fully trust the server to store, process, and manage their biometric data. As a result, users’ biometric data could be leaked by outside attackers or the service provider itself. This paper first constructs the EDZKP protocol based on the inner product, which proves whether the secret value is the Euclidean distance of the secret vectors. Then, combined with the Cuproof protocol, we propose a novel user-centric biometric authentication scheme called BAZKP. In this scheme, all the biometric data remain encrypted during authentication phase, so the server will never see them directly. Meanwhile, the server can determine whether the Euclidean distance of two secret vectors is within a pre-defined threshold by calculation. Security analysis shows BAZKP satisfies completeness, soundness, and zero-knowledge. Based on BAZKP, we propose a privacy-preserving biometric authentication system, and its evaluation demonstrates that it provides reliable and secure authentication.
A novel privacy-preserving biometric authentication scheme

Most existing secure biometric authentication schemes are server-centric, and users must fully trust the server to store, process, and manage their biometric data. As a result, users’ biometric data could be leaked by outside attackers or the service provider itself. This paper first constructs the EDZKP protocol based on the inner product, which proves whether the secret value is the Euclidean distance of the secret vectors. Then, combined with the Cuproof protocol, we propose a novel user-centric biometric authentication scheme called BAZKP. In this scheme, all the biometric data remain encrypted during authentication phase, so the server will never see them directly. Meanwhile, the server can determine whether the Euclidean distance of two secret vectors is within a pre-defined threshold by calculation. Security analysis shows BAZKP satisfies completeness, soundness, and zero-knowledge. Based on BAZKP, we propose a privacy-preserving biometric authentication system, and its evaluation demonstrates that it provides reliable and secure authentication.

Biometric authentication has been popular in services such as access control to authenticate individuals based on their biometrics. In contrast to the passwords or tokens used in conventional authentication systems, biometric data, such as fingerprint, face, or gait, can physically authenticate an individual with high assurance. Biometric data is unique and safe for every individual. With the help of powerful computer and network technology, biometrics offer the advantages of uniqueness, permanence, and reliability. However, biometric data is prone to diverse variations and distortions due to inherent and environmental noise. Thus, biometric authentication generally employs an error tolerance mechanism. Namely, the service provider uses a biometric vector w as a template stored in a central database, and then the user submits a new vector w′ to the service provider for authentication. The user’s authentication will succeed if w and w′ are close enough under a certain distance metric. This biometric authentication model above is server-centric, as the service provider is responsible for securing the templates and receiving the user’s biometric information in plain text. This model has several unavoidable drawbacks. First, users must completely trust the service provider to protect their templates. However, malicious service providers may misuse the templates for profit, and security attacks may result in template leakage and violation of user privacy. Second, the templates must be recovered in plaintext for distance computation and comparison, which makes it possible for adversaries to spy on the registered or freshly submitted templates. To meet these challenges, it is necessary to propose a secure, privacy-preserving, and user-centered scheme [1, 2]. To address these issues, we propose a biometric authentication zero-knowledge proof (BAZKP) scheme that preserves the benefits of biometric authentication while enhancing its security. The BAZKP is a security, privacy-protection, and user-centered authentication scheme that combines biometric technology with a zero-knowledge proof (ZKP) protocol to authenticate users while maintaining anonymity. We also provide security proofs to show that our scheme guarantees privacy for users. Moreover, we have developed a privacy-preserving biometric authentication system to accomplish a complete life cycle of BAZKP.

Goldwasser et al. [3] first mentioned the ZKP in 1985, which enables a prover to convince a verifier that some statement is true without revealing anything more than the truth of the statement. Then, lots of research on ZKP protocols and many kinds of ZKP protocols were proposed, such as zk-SNARK and range proof. Maller et al. [4] proposed the first zk-SNARK with entirely succulent verification for general arithmetic circuits with SRS, known as Sonic. After that, Gabizon et al. proposed a more efficient zk-SNARK which is called PLONK [5]. To make improvements on the efficiency of zk-SNARK, Lately Bünz et al. proposed Super Sonic [6]. On the other hand, Brickell et al. [7] stated the first correlative algorithm of range proof. After that, in 1998, Chan et al. [8] proposed a kind of range proof whose security depends on modulus. It is called CTF. Using Lagrange’s four-square theorem [9], Lipmaa [10] published a proof of any range for the first time. In 2005, based on Lagrange’s four-square theorem, Groth [11] demonstrated that 4y+ 1 could be represented as the sum of the squares of some three integers if y was a non-negative integer. Bootle et al. [12] improved the efficiency of ZKP by using the inner product method and recursion. In 2018, Bünz et al. proposed a range proof scheme which is called Bulletproofs [13]. Based on these works, Deng et al. [14] presented the Cuproof, a novel range proof scheme for any range. The time, communication costs and proof size of that scheme are maintained within a constant range regardless of how large the proof interval is.

The two primary types of biometrics applications [15] are biometric authentication and biometric identification. The existing research mainly focused on privacy-preserving biometric identification [16, 17], in which a server database is assumed to contain the templates of the registered users and their corresponding identities. Barni et al. [16] presented a privacy preserving protocol for fingerprint-based authentication. In 2018, Zhou et al. [18] proposed a user-centric biometric authentication system that allows users to use the proposed lightweight encryption approach to encrypt their templates. To improve the performance of each biometric system, Hammad et al. [19] proposed a secure multimodal biometric system using convolution neural network (CNN) and Q-Gaussian multi-support vector machine (QG-MSVM) based on different level fusion.

In recent years, privacy protection has become a crucial area of research and many researchers conducting extensive studies in this field. Zhang et al. [20] proposed a new privacy-preserving biometric identification scheme, in which they introduced perturb terms in each biometric data. Zhou et al. [18] proposed a user-centric biometric authentication scheme that enabled end-users to encrypt their own templates with the proposed light-weighted encryption scheme. Lee et al. [21] presented a new biometric authentication system based on blockchain which provided a decentralized and distributed mechanism for processing biometric authentication. In addition, Azees et al. [22] proposed an efficient anonymous authentication scheme to avoid malicious vehicles entering into the VANET. After that, in 2022, Zhou et al. [23] introduced a security-enhanced solution for VANETs, whichj can resist a signature forgery attack. Liu et al. [24] proposed a novel privacy-preserving DSSE scheme for IIoTH system, which was the first DSSE scheme designed for personal health record (PHR) files database with forward security. Yang et al. [25] proposed a novel oblivious data sharing scheme employing the designed 1-out-of-n oblivious transfer protocol to achieve an efficient location-based service for users while effectively hiding location coordinates and protecting the privacy of users and servers. Wei et al. [26] presented a privacy-preserving implicit authentication framework using users’ behavior features sensed by the mobile intelligent terminal based on the artificial intelligence methodology. An efficient affine cipher-based encryption technique is proposed by Azees et al. [27] to offer a high level of confidentiality with smaller key size compared to existing encryption techniques. To address these security flaws, Subramani et al. [28] proposed a computationally efficient privacy-preserving anonymous authentication scheme for resource-limited WBAN. In 2022, Rajasekaran et al. [29] preserved the privacy and the anonymity of the end-users (patient/doctor) using an anonymous blockchain-based authentication scheme. To overcome IoHT imposes security challenges in maintaining patient data confidentiality and privacy, a novel blockchain-based privacy-preserving authentication scheme is proposed by Rajasekaran et al. [30] as an approach for achieving efficient authentication of the patient without the involvement of a trusted entity. Jegadeesan et al. [31] proposed a public key encryption based computationally efficient mutual authentication protocol for secure data transmission between incubator monitoring systems and doctors or administrators.

The main contributions of this paper are summarized as follows: We employ the inner product to construct the Euclidean Distance Zero-knowledge Proof (EDZKP) protocol and prove that the protocol satisfies perfect completeness, perfect special honest verifier zero-knowledge, and computational witness extended emulation. By combining ZKP with biometric authentication, we construct a novel biometric authentication scheme called BAZKP. In this scheme, the EDZKP protocol guarantees that the secret value v is the Euclidean Distance between the secret vectors w and w′, and the Cuproof protocol proves whether the secret value v is within the range [0, e]. We also provide security proof to show that our scheme guarantees privacy for users. Based on the proposed scheme, we present a privacy-preserving biometric authentication system enabling users to utilize their biometric data for authentication while preserving users privacy. We show its viability and operational efficacy by implementing the proposed system. The experimental data obtained from our tests show the system’s potential for real-world deployment.

Before we state our scheme, we first note some underlying tools. In this paper, is a PPT adversary, which is a probabilistic interactive Turing machine that runs in polynomial time in the security parameter λ.

Groups of unknown order. In order to keep the soundness of our scheme, we use the RSA group where the order of the group is unknown. The RSA group is generated by a trusted setup. RSA group. In the multiplicative group of integers modulo n where n is the product of the large primes p and q. The hardness of computing the order of the group is as the same as the hardness of factoring n. Assumption 1 (Discrete Log Relation Assumption) For all PPT adversaries and for all j ≥ 2, there exists a negligible function μ(λ) such that As Bünz et al. [13] stated, is a non-trivial discrete log relation between g1, …, gj. The discrete log relation assumption ensures that an adversary can’t find a non-trivial relation between randomly selected group elements. This assumption is equivalent to the discrete-log assumption when j ≥ 1. Assumption 2 (Order Assumption) The Order Assumption holds for Setup if for any efficient adversary there exists a negligible function μ(λ) such that Lemma 1 The Order Assumption implies the Discrete Log Relation Assumption. Proof. We show that if adversary breaks the Order Assumption, then we can construct which breaks the Discrete Log Relation Assumption with overwhelming probability. To get a vector and a vector such that where gi ≠ 1, ai ≠ 0 and i ∈ {1, 2, …, j}, we run for n times and it will outputs and such that for j = 1, …, n. And it follows .

We adopt the following definitions from [14] for our notation. Definition 1 (Commitments) A non-interactive commitment scheme consists of a pair of probabilistic polynomial time algorithms (Setup, Com). The setup algorithm pp ← Setup(1λ) generates the public parameters pp with the security parameter λ. The commitment algorithm Compp defines a function Mpp × Rpp → Cpp for a message space Mpp, a randomness space Rpp and a commitment space Cpp determined by pp. For a message x ∈ Mpp, the algorithm draws uniformly at random, and computes the commitment com = Compp(x, r). Definition 2 (Homomorphic Commitments) A homomorphic commitment scheme is a non-interactive commitment scheme such that (Mpp, *), (Rpp, +), and (Cpp, +) are all abelian groups, and for all x1, x2 ∈ Mpp, r1, r2 ∈ Rpp, we have Here (Mpp, *) can be additive or multiplicative. For ease of notation, we drop pp in the subindex. Definition 3 (Hiding Commitment) A commitment scheme is said to be hiding if for every PPT adversary there exists a negligible function μ(λ) such that where the probability is over b, r, Setup and . If μ(λ) = 0 then we say that the scheme is perfectly hiding. Definition 4 (Binding Commitment) A commitment scheme is said to be binding if for every PPT adversary there exists a negligible function μ such that where the probability is over Setup and . If μ(λ) = 0, then we say that the scheme is perfectly binding. In the following content, to ensure that the discrete log in the groups we used is intractable for PPT adversaries, the order of these groups is implicitly dependent on the security parameter. Definition 5 (Pedersen Commitment) being a multiplicative group. Definition 6 (Pedersen Vector Commitment) being a multiplicative group. The Pedersen vector commitment for the group is perfectly hiding and computationally binding under the discrete logarithm assumption. In the definition, r is chosen at random.

In our scheme, we construct the zero-knowledge arguments of knowledge. A zero-knowledge proof of knowledge means a prover can convince a verifier that some statements hold without revealing any information of the knowledge. An argument is a proof that holds when the prover is computationally bounded and certain computational hardness assumptions hold. The formal definitions are as follows. Zero-knowledge arguments consist of three interactive algorithms (Setup, , ), which run in probabilistic polynomial time. Setup is the common reference string generator, is the prover and is the verifier. The algorithm Setup produces a common reference string σ on inputting 1λ. The transcript produced by and is denoted by , when they interact on the inputs s and t. We write where b = 0 if verifier rejects, b = 1 if verifier accepts. We let be a polynomial-time-decidable ternary relation. Given a parameter σ, the w is a witness for a statement u only if . We define the CRS-dependent language as the set of all the statements which have a witness w in the relation . Definition 7 (Argument of Knowledge) The triple is called an argument of knowledge for relation R if it satisfies both the Perfect Completeness and Computational Witness-Extended Emulation as defined in [13], respectively. Definition 8 (Perfect Completeness) has perfect completeness if for all non-uniform polynomial time adversaries Definition 9 (Computational Witness-Extended Emulation) For every deterministic polynomial time there exists an expected polynomial time emulator ε such that for every pair of interactive adversaries , there exists a negligible function μ(λ) where the oracle is given by , and permits rewinding at each round after the prover commits and resuming with fresh randomness for the verifier from this point onwards, then we say has witness-extended emulation. Definition 10 (Public Coin) An argument of knowledge is called public coin if all messages sent from the verifier to the prover are chosen uniformly at random and independent of the prover’s messages, i.e., the challenges correspond to the randomness ρ. Definition 11 (Perfect Special Honest-Verifier Zero-Knowledge) A public coin argument of knowledge is a perfect special honest verifier zero knowledge (SHVZK) argument of knowledge for if there exists a probabilistic polynomial time simulator such that for every pair of interactive adversaries : where ρ is the public coin randomness used by the verifier. The “transcript” can be simulated by S without knowing w. In this definition, the adversary chooses a distribution over statements and witnesses. However, the adversary still cannot distinguish between the simulated and the honestly generated transcripts for valid statements and witnesses. Now we define range proofs. Range proofs are the proofs that the prover knows an opening to a commitment in which the committed value is in a certain range. Range proofs can be used to state that an integer commitment is for a positive number or when two homomorphic commitments are added together, it will not overflow when they are taken modulo the given prime, and these two homomorphic commitments are the commitments to the elements in a prime field. Definition 12 (Zero-Knowledge Range Proof) Given a commitment scheme (Setup, Com) over a message space Mpp which is a set with a total ordering, a zero-knowledge range proof is a SHVZK argument of knowledge for the relation: Theorem 1 (Lagrange’s three-square theorem) If x is a positive integer, then 4x + 1 can be written as the sum of three squares. The proof for Theorem 1 is given in [9, 11] offered an efficient and simple algorithm for finding three such squares. Theorem 1 also means writing 4x + 1 as the sum of three squares implies that x is non-negative.

Let [N] denote the set {1, …, N−1}. Let p and q denote two prime numbers. Let denote the multiplicative group of integers modulo n, where n is the product of p and q, i.e. is a RSA group. Let denote the ring of integers modulo n. Let denote the set of all integers. Let and be vector spaces of dimension j over and , respectively. Let denote . Group elements which represent commitments are capitalized. For example, C = gahα is a Pedersen commitment to a for . means the uniform sampling of an element from . In this paper, is a vector with elements . For an element and a vector , we denote by the vector with bi = c⋅ai. For the two vectors , let denote the inner product and the Hadamard product, respectively. We define vector polynomials where each coefficient pi is a vector in . The inner product between two vector polynomials l(x) and r(x) is defined as Let a‖b denote the concatenation of two vectors: if and then . For 0 ≤ ℓ ≤ s, we use Python notation to denote slices of vectors: Let t(x) = 〈l(x), r(x)〉, then the inner product is defined such that t(x) = 〈l(x), r(x)〉 holds for all . For vectors and we write . For 1 ≤ u we set .

In this section, we introduce our BAZKP scheme. First, we state the EDZKP protocol and the Cuproof protocol, which are essential components of the BAZKP scheme.

In the EDZKP protocol, The vector w,w′,d is a secret vector encrypted by the prover based on its biometric data, where and d = w′−w. The secret value v is the Euclidean Distance between w and w′, i.e. v = 〈d, d〉. We will use the EDZKP protocol to prove the following relationship: Theorem 2 (EDZKP protocol) The EDZKP protocol presented in this section satisfies perfect completeness, perfect special honest verifier zero-knowledge, and computational witness extended emulation. Proof. The proof for Theorem 2 is given in S2 Appendix.

EDZKP Protocol ()    ,      where ti can be computed without knowing l and r, i.e. ti is the coefficient of 〈l(x), r(x)〉, respectively.        

One of the effective range proof protocols is the Cuproof [14] protocol. This protocol can maintain time, communication overhead, and proof size within a fixed range regardless of how large the proof interval is. We use the Cuproof protocol in BAZKP scheme to convince the verifier that the secret number v is in [a, b]. Based on Lagrange three-square theorem, we can find and such that the following conditions hold In this protocol, the . We will prove the following relations: Theorem 3 (Cuproof protocol) The Cuproof protocol presented in this section satisfies perfect completeness, perfect special honest verifier zero-knowledge, and computational witness extended emulation. Proof. The proof for Theorem 3 is given in [14]

Cuproof ():   , ,      where ti can be computed without knowing l′ and r′, i.e. ti is the coefficient of 〈l(x), r(x)〉 respectively.        

The main idea of BAZKP scheme is set out below. Given three vectors , the secret vectors w and w′ are biometric data of , then the vectors w, w′ and d satisfy the following relation: The objective of BAZKP scheme is to persuade the verifier that the secret vectors w,w′ belong to the same person, that is, the Euclidean Distance between w, w′ is smaller than e. Let , v is the Euclidean Distance between w and w′, the goal of this scheme is to prove that the secret value v ∈ [0, e]. In detail, we will prove the following relations: First, we use Pedersen Commitment and Pedersen Vector Commitment to commit v, w,w′,d. Then, let run the EDZKP protocol and the Cuproof protocol to prove the equation w = w′+ d, v = 〈d, d〉, v ∈ [0, e]. The outputs “accept” only when the two protocols are ran successfully.

BAZKP scheme ()  EDZKP protocol  

Theorem 4 (BAZKP Scheme) The BAZKP scheme presented in this section satisfies perfect completeness, perfect special honest verifier zero-knowledge, and computational witness extended emulation.

Proof. Because the EDZKP protocol and the Cuproof protocol satisfy perfect completeness, perfect special honest verifier zero-knowledge, and computational witness extended emulation. Therefore, our BAZKP scheme has perfect completeness, perfect special honest verifier zero-knowledge, and computational witness extended emulation.

This scheme can also be transformed into a NIZK scheme by using the Fiat-Shamir heuristic. For example, we set y = Hash(D‖W),z = Hash(D‖W′),c = Hash(D‖S),x = Hash(D‖K) in EDZKP protocol. And we set y = Hash(A‖S), z = Hash(τx||μ), x = Hash(T1‖T2) in Cuproof protocol.

In this section, we construct a privacy-preserving biometric authentication system based on BAZKP scheme and evaluate its comprehensive performance using fingerprints. Before anything else, we provide some crucial background information on biometric authentication. Then, we demonstrate how to build biometric authentication systems that protect user privacy using our suggested scheme.

The first critical step in biometric authentication is efficiently transforming biometric traits into feature vectors that are easy to compute. We adopt fingerprint vectors w with length 299, generated from the fingerprint minutiae proposed in [32]. The conversion process consists of two sequential stages: generation of the minutia cylinder-code with the MCC SDK and the kernel principal component analysis (KPCA) transformation. Our experiments are carried out using FVC 2002 and FVC 2004. Each of these datasets has a Set A and Set B. We used Set B to generate the fixed-length vector and Set A for the verification. In the following discussion, we assume that a sensor can capture the user’s biometric trait and transform it into a fixed-length vector on the local side.

A privacy-preserving biometric authentication system is composed of four phases: setup, registration, query and authentication. Setup: The user output the public parameters (g, h, g, h). Registration: The user receives the binary fingerprint vector w from the sensor and stores it in his database. Then, the user generates the commitment of w (we use W to represent the commitment of w) and sends the W to the cloud server. The cloud server stores the tuple (g, h, g, h, W). Query: The user uses the sensor to get a new binary fingerprint vector w′. Then, The user generates d by using d = w−w′, where the user’s local database contains w. Then the user sends d and ( ) to the cloud server. Authentication: Once the cloud sever receives W, it finds the tuple (W, g, h, g, h). The server runs the BAZKP scheme. Then, the server will output an authentication result. Fig 1 shows the setup and registration phase, Fig 2 shows the query and authentication phase.

In this section, we briefly analyse the security strength of our proposed system with respect to various security attacks. First, we prove that the BAZKP scheme satisfies perfect completeness, perfect special honest verifier zero-knowledge, and computational witness extended emulation. As a result, our proposed system based on BAZKP scheme also satisfies these properties. Referring to the security analysis in [27–31], we prove that our proposed system can effectively withstand various types of attacks, including replay attacks, man in the middle attacks, impersonation attacks, and message modification attacks. Additionally, our system also supports non-traceability, further enhancing its security capabilities.

In our proposed system, the cloud server receives the tuple (W, g, h, g, h) before authenticating the user’s identity. Once the data is received, the cloud server maps it to the timestamp and user identity and stores them in the database. This approach allows the cloud server to defend against replay attacks by verifying if the mapped data in the database matches the data sent by the user and if the time difference between them falls within a legal interval. Additionally, the proposed system enables mutual authentication to be performed securely between the user and the cloud server, ensuring the system can withstand man in the middle attacks.

Suppose a malicious attacker sends the tuple () to the cloud server where . Once the attacker pass the authentication with overwhelming probability then it means the BAZKP scheme can not meet soundness. Since we have proven that the BAZKP scheme meets soundness, a message modification attack is impossible in the proposed system. Therefore our proposed system can withstand the message modification attack and impersonation attack.

In this proposed system, we utilize Pedersen Vector Commitment to preserve the secret values, specifically W = hθgwhw, based on the hardness of the DL assumption. Consider a scenario where an attacker has captured the value w from W. However, it is impossible for the attacker to compute w from W due to the difficulty of solving the DL assumption. Additionally, the user selects random numbers for each execution in our proposed system, and the BAZKP scheme also meets zero-knowledge. Therefore, our scheme supports non-traceability.

In this section, we present the results of our evaluation and prototype implementation. Then, compare it with other existing related biometric authentication schemes.

As a user-centric biometric authentication system, our system’s performance is evaluated on a personal laptop and a mobile phone. In the simulation, we utilize a mobile phone with Android 13 operating system, 3123 MHz CPU, and 8 GB RAM. We also use a personal laptop with macOS 11.2.2, Apple M1, and 8 GB RAM. The Java library UJMP and the C++ library Armadillo are used for server emulation of mobile phones and computers, respectively. At the same time, the client is written using React. We noticed that performance depends on many factors. The system may not operate at its best due to the above choice. The size of the two primes p, q is set to 1024 bits. A Pedersen hash function over an RSA group whose modulo n = p*q is benchmarked. We generate witness refer to literature [9, 10]. We also set e = 7000, in other words, the user can pass the identity authentication only when the Euclidean distance between w and w′ is less than or equal to 4. The system uses sensors to capture the user’s fingerprints and generate the corresponding vectors. The sensor captures the fingerprint feature points and generates the fingerprint vectors based on the horizontal and vertical coordinates of these fingerprint points, as shown in Fig 3. The final data is the average of the data we obtained by doing 10000 experiments. It is possible to conclude that our scheme’s communication cost is equal to through computation and analysis, indicating that it is kept constant. Fig 4 shows the line charts of the proving time and the verification time of the EDZKP protocol, respectively. Fig 5 shows the line charts of the proving time and the verification time of the BAZKP scheme (not including witness generation), respectively. Table 1 shows our system’s proving time and verification time under the different Euclidean distance. The simulation results show that the proving and verification time of the BAZKP scheme remains almost constant with the increase of the Euclidean distance. From this, we can conclude that no matter how extensive the range is, the proving time and the verification time remain almost unchanged.

Finally, we compare the BAZKP scheme with other similar schemes. Table 2 shows the comparison results between our scheme, literature [20], literature [18], and literature [21]. Lee et al. [21] proposed a biometric authentication scheme that divides the biometric template into fragments and stores them on the blockchain. However, compared with our scheme, the real-time performance of this scheme is low. Similarly, Zhou et al. [18] presented a user-centric biometric authentication scheme, but it encountered an exponential increase in time complexity with the increase in n. In contrast, our solution offers a significant advantage regarding time complexity. Compared with the biometric authentication scheme in [20], our scheme achieves the goal of privacy protection while improving efficiency. In addition, the security of this scheme is based on the RSA assumption and the discrete log assumption, which is relatively secure compared to other schemes.

In this paper, we combine biometrics with ZKP protocol to introduce a biometric authentication scheme for privacy-preserving named BAZKP. The security analysis shows that the scheme satisfies the perfect completeness, perfect special honest verifier zero-knowledge, and computational witness extended emulation. The evaluation results show that, no matter how big the interval of the range proof is, the proof time and the verification time are nearly constant. Finally, based on the BAZKP scheme, we build a user-centric biometric authentication system. We will focus on improving the efficiency and safety of the BAZKP scheme in the future. One approach will be to leverage a more efficient proof-of-zero algorithm to refine the accuracy of biometric templates while preserving privacy. Another approach will be to employ multi-factor authentication, which combines biometric data with other authentication methods, such as passwords or tokens, to boost security. Additionally, combining the BAZKP scheme with blockchain technology can provide additional security and transparency to the authentication process.

Click here for additional data file. Click here for additional data file. Click here for additional data file.