Determining a relationship between a probe and a reference under homomorphic encryption with a feature-independent lookup table

Abstract

A method of creating a lookup table for determining a relationship between a probe and a reference under encryption comprises determining (101) a probability density function corresponding to a projection of a point belonging to the unit d-ball of a space onto an axis, determining (103) a cumulative distribution function of the probability density function, determining (105) an inverse of the cumulative distribution function, determining (107) border values of cells of the lookup table based on the cumulative distribution function inverse, determining (109) a first score component for each cell, determining (111) a second score component for each cell, and calculating (113) feature comparison scores by performing a mathematical operation on each first score component and each corresponding second score component. A cell's score components are integrations of the probability density function over normalized possible feature values between the cell's border values on the respective axes of the lookup table.

Description

DETERMINING A RELATIONSHIP BETWEEN A PROBE AND A REFERENCEUNDER HOMOMORPHIC ENCRYPTION WITH A FEATURE-INDEPENDENTLOOKUP TABLEFIELD OF THE INVENTIONThe invention relates to a computer-implemented method of creating a lookup table of feature comparison scores of a plurality of features for determining a relationship between a probe and a reference under encryption.The invention also relates to computer program products enabling a computer system to perform such a method.The invention further relates to a system for creating a lookup table of feature comparison scores of a plurality of features for determining a relationship between a probe and a reference under encryption.BACKGROUND OF THE INVENTIONModem recognition technologies, e.g. biometric recognition technologies, lean on deep neural networks (DNNs) to extract distinctive representations of samples, e.g. biometric samples such as facial images, called feature vectors. Thus, the recognition task becomes the comparison of two feature vectors against each other by calculating a (dissimilarity score, usually via the cosine similarity or the squared Euclidean distance (SED). Studies have shown that from biometric feature vectors, it is possible to infer personal information (e.g., gender, age, health condition, ethnicity, occupation, etc.) and reconstruct raw biometric samples (e.g., facial images) of individuals, known as model inversion attacks. The plaintext access to those feature vectors enables an undesirable personal information inference that intensifies the severeness of social issues, such as gender inequality and discrimination, due to biased decision-making models.Furthermore, the plaintext access to those feature vectors permits the reconstruction of the raw biometric sample from a given reference template or probe, which leads to security issues such as identity fraud and impersonation attacks. ISO / IEC24745:2022 provides examples of biometric information privacy threats, e.g. that biometric references may be used to link subjects across different applications in the same database or across different databases. Therefore, feature vectors extracted from DNNs areextremely sensitive and require strong protection. Biometric template protection schemes (BTPs) try to preserve, protect and safeguard biometric information (e.g., biometric feature vector) with a maintained recognition performance. BTPs come in different flavors, each approaching the biometrics privacy challenges with distinct techniques (e.g., helper data and Bloom fdters).Among existing BTPs, homomorphic encryption (HE) based BTPs seem promising in tackling these issues since they carry both the biometric information and its processing to an encrypted domain. Generally, HE-based BTPs compare two encrypted biometric feature vectors against each other by measuring a (dis-)similarity score under encryption and then delivering, to the party of interest, either 1) a final score (followed by a clear-text comparison with the threshold yielding the recognition decision) or 2) the final recognition decision (that was preceded by an encrypted comparison with the threshold). Calculating such a (dis-)similarity score under encryption involves a number of homomorphic multiplications proportional to the feature vector’s dimension. The failure of HE to handle computations with many multiplications hurts those solutions’ efficiency.The first multiplication-free biometric recognition (MFBR) scheme is the homomorphically encrypted log likelihood-ratio classifier (HELR) introduced in the paper “Fast and accurate likelihood ratio-based biometric verification secure against malicious adversaries” by A. Bassit, F. Hahn, J. Peeters, T. Kevenaar, R. Veldhuis, and A. Peter, published in IEEE Transactions on Information Forensics and Security, vol. 16, 2021. This scheme pre-computes the log likelihood-ratio (LLR) and organizes it into lookup tables, reducing the biometric recognition into three operations: selection of the individual scores from the tables, their addition to calculate a final score, and the comparison of the final score with the biometric threshold.However, to determine a score, this classifier requires prior knowledge about the statistics of the features learned from training the LLR. In general, this prior knowledge is hard to acquire for large-scale applications. Hence, the HELR classifier requires training data, and homomorphic multiplications represent a burden for recognition performance.SUMMARY OF THE INVENTIONIt is the first objective of the invention to provide a method that makes it possible to determine a relationship between a probe and a reference under encryption without homomorphic multiplications and without training.It is the second objective of the invention to provide a system that makes it possible to determine a relationship between a probe and a reference under encryption without homomorphic multiplications and without training.In the first aspect of the invention, a computer-implemented method of creating a lookup table of feature comparison scores of a plurality of features for determining a relationship between a probe and a reference under encryption comprises determining a probability density function corresponding to a projection of a point belonging to the unit ball of a space onto an axis, the space having a number of dimensions which is equal to the number of features in the plurality of features, determining a cumulative distribution function of said probability density function, determining an inverse of said cumulative distribution function, and determining border values of cells of said lookup table based on said inverse of said cumulative distribution function, said border values applying to both a first axis and a second axis of said lookup table.The method further comprises determining a first score component for each respective cell of said cells, said first score component being an integration of said probability density function over normalized possible values of said plurality of features in an interval between said border values of said respective cell on said first axis of said lookup table, determining a second score component for each respective cell of said cells, said second score component being an integration of said probability density function over normalized possible values of said plurality of features in an interval between said border values of said respective cell on said second axis of said lookup table, and calculating, for each respective cell of said cells, a feature comparison score by performing a mathematical operation on said first score component calculated for said respective cell and said second score component calculated for said respective cell. The method may be performed by software running on a programmable device. This software may be provided as a computer program product.To construct a suitable lookup table that allows feature comparison scores to be determined without training, a proper probability density function (PDF) that represents a random observation of the features, and its cumulative distribution function (CDF), need to be determined. Then, the table’s cell borders are determined, by equiprobably dividing the proper PDF, and the representative value of a cell, i.e., the feature comparison scores, are determined.Feature vectors are typically extracted with a DNN. Finding the proper PDF and its CDF that define the feature vectors which resulted from a DNN would normally be tricky and dependent on the DNN’s training and architecture, which may lead to a differentdistribution per architecture. To avoid this, given that the feature vectors resulting from a DNN are points spread on the IRdspace, the feature vectors are normalized to bring them on the surface of the unit d-ball. A normalized vector of dimension d can be seen as a point on the unit d-ball. Thus, the PDF of the projection of a point on the d-ball on an axis is derived to determine the PDF corresponding to the coordinates of the normalized vector, and based on the inverse CDF of this PDF, the observed projected point is quantized equiprobably using the inverse CDF of the point projection on the unit d-ball.The lookup table may be used, for example, in the HELR framework disclosed in the above-mentioned paper “Fast and accurate likelihood ratio-based biometric verification secure against malicious adversaries”, which does not use homomorphic multiplications. Instead of using ICDF(p,0,l), like in this paper, the inverse CDF of the point projection on the unit d-ball is used. ICDF(p,0,l) is the inverse of the CDF of an J\f(0, 1) at the cumulative probability p. Common (dis-)similarity measures that do not require training to learn the features’ statistics, such as the cosine similarity and the squared Euclidean distance, may be used instead of the log likelihood ratio used in this paper. The created lookup table is feature-independent and data-independent.Said feature comparison score may be calculated, for each respective cell of said cells, by multiplying said first score component calculated for said respective cell and said second score component calculated for said respective cell.Said feature comparison score may be calculated, for each respective cell of said cells, by calculating the square of a difference between said first score component calculated for said respective cell and said second score component calculated for said respective cell.Said feature comparison score may be calculated, for each respective cell of said cells, by performing said mathematical operation on said first score component calculated for said respective cell and said second score component calculated for said respective cell to calculate an intermediate comparison score and by quantizing said intermediate comparison score to an integer value.Said probe may be a biometric probe, said reference may be a biometric reference, and said features may be biometric features.Said probability density function may correspond to a projection, onto said axis, of points which are uniformly distributed over the unit ball. A well-trained DNN (i.e., feature extractor) may be able to achieve an (near-)optimal recognition performance if the features are uniformly distributed over the d-ball.In the second aspect of the invention, a computer-implemented method of creating probe information for determining a relationship between a probe and a reference under encryption comprises obtaining a lookup table created with the above-described method, obtaining a normalized and quantized value of each of a plurality of features for said probe, selecting an identifier per respective feature of said plurality of features based on said normalized and quantized value of said respective feature and said border values on said first axis of said lookup table, said identifier identifying a line of cells on said second axis of said lookup table, and determining, for inclusion in said probe information, an index per feature of said plurality of features based on said selected identifiers. The method may be performed by software running on a programmable device. This software may be provided as a computer program product.Said identifiers may be selected from an ordered set of identifiers, said identifiers being ordered according to feature value, and said indices may be created by mapping a respective identifier selected for a respective feature of said plurality of features to a permuted identifier from a permutation of said ordered set of identifiers, said respective identifier having a certain order number in said ordered set of identifiers and said permuted identifier having said same certain order number in said permutation. By using permuted identifiers, others, including the receiver of the probe information, may be prevented from determining from the probe information of multiple probes which probes have similar features.In a third aspect of the invention, a computer-implemented method of creating reference information for determining a relationship between a probe and a reference under encryption comprises obtaining a lookup table created with the abovedescribed method, obtaining a normalized and quantized value of each of a plurality of features for said reference, selecting, from said lookup table, a line of cells per respective feature of said plurality of features on said first axis of said lookup table based on said normalized and quantized value of said respective feature and said border values on said second axis of said lookup table, creating a vector for each of said selected lines of cells, and creating said reference information by homomorphically encrypting each of said vectors. The method may be performed by software running on a programmable device. This software may be provided as a computer program product.An order in which said feature comparison scores of said lines of cells are stored in said vectors may be different from an order in which said feature comparison scores are stored in said lines of cells on said first axis in said lookup table. This may be used if the indices in the probe information are permuted identifiers.In the fourth aspect of the invention, a computer-implemented method of determining or enabling to determine a relationship between a probe and a reference under encryption comprises obtaining probe information, e.g. created with the above-described method of creating probe information, said probe information comprising an index per feature of a plurality of features, obtaining reference information, e.g. created with the above-described method of creating reference information, said reference information comprising a plurality of homomorphically encrypted vectors, each vector comprising a plurality of feature comparison scores, determining an evaluation of said relationship by summing up relevant feature comparison scores of said homomorphically encrypted vectors without decrypting said homomorphically encrypted vectors, said relevant feature comparison scores corresponding to said indices, and determining or enabling to determine said relationship between said probe and said reference based on said evaluation. The method may be performed by software running on a programmable device. This software may be provided as a computer program product.Said evaluation of said relationship may be determined by rotating said vectors or further vectors, each of said further vectors being a sum of vectors that correspond to the same indices, such that said feature comparison scores or said sums of feature comparison scores are in a same specific slot of said vectors or said further vectors, summing up said rotated vectors or said rotated further vectors, and isolating said specific slot from said sum of said rotated vectors or said sum of said rotated further vectors.Said reference information may comprise a homomorphically encrypted concatenation of said vectors and said evaluation of said relationship may be determined by creating a probe mask based on said probe information, obtaining a homomorphically encrypted ciphertext by multiplying said probe mask with said homomorphically encrypted concatenation of said vectors and summing up all individual slots of said ciphertext. The probe information and the reference information may be created with the above-described methods or may be created with the HELR lookup table, for example.By concatenating all rows into one big vector and encrypting them at once as one ciphertext instead of many ciphertexts, the encrypted reference information / template may be made more compact (one ciphertext) and the runtime for the encrypted decision mode may be decreased.In the fifth aspect of the invention, a system for creating a lookup table of feature comparison scores of a plurality of features for determining a relationship between a probe and a reference under encryption comprises at least one processor configured to determine a probability density function corresponding to a projection of a point belongingto the unit ball of a space onto an axis, the space having a number of dimensions which is equal to the number of features in the plurality of features, determine a cumulative distribution function of said probability density function, determine an inverse of said cumulative distribution function, and determine border values of cells of said lookup table based on said inverse of said cumulative distribution function, said border values applying to both a first axis and a second axis of said lookup table.The at least one processor is further configured to determine a first score component for each respective cell of said cells, said first score component being an integration of said probability density function over normalized possible values of said plurality of features in an interval between said border values of said respective cell on said first axis of said lookup table, determine a second score component for each respective cell of said cells, said second score component being an integration of said probability density function over normalized possible values of said plurality of features in an interval between said border values of said respective cell on said second axis of said lookup table, and calculate, for each respective cell of said cells, a feature comparison score by performing a mathematical operation on said first score component calculated for said respective cell and said second score component calculated for said respective cell.Moreover, a computer program for carrying out the methods described herein, as well as a non-transitory computer readable storage-medium storing the computer program are provided. A computer program may, for example, be downloaded by or uploaded to an existing device or be stored upon manufacturing of these systems.A non-transitory computer-readable storage medium stores at least a first software code portion, the first software code portion, when executed or processed by a computer, being configured to perform executable operations for creating a lookup table of feature comparison scores of a plurality of features for determining a relationship between a probe and a reference under encryption.The executable operations comprise determining a probability density function corresponding to a projection of a point belonging to the unit ball of a space onto an axis, the space having a number of dimensions which is equal to the number of features in the plurality of features, determining a cumulative distribution function of said probability density function, determining an inverse of said cumulative distribution function, and determining border values of cells of said lookup table based on said inverse of said cumulative distribution function, said border values applying to both a first axis and a second axis of said lookup table.The executable operations further comprise determining a first score component for each respective cell of said cells, said first score component being an integration of said probability density function over normalized possible values of said plurality of features in an interval between said border values of said respective cell on said first axis of said lookup table, determining a second score component for each respective cell of said cells, said second score component being an integration of said probability density function over normalized possible values of said plurality of features in an interval between said border values of said respective cell on said second axis of said lookup table, and calculating, for each respective cell of said cells, a feature comparison score by performing a mathematical operation on said first score component calculated for said respective cell and said second score component calculated for said respective cell.As will be appreciated by one skilled in the art, aspects of the present invention may be embodied as a device, a method or a computer program product. Accordingly, aspects of the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment (including firmware, resident software, micro-code, etc.) or an embodiment combining software and hardware aspects that may all generally be referred to herein as a "circuit", "module" or "system." Functions described in this disclosure may be implemented as an algorithm executed by a processor / microprocessor of a computer. Furthermore, aspects of the present invention may take the form of a computer program product embodied in one or more computer readable medium(s) having computer readable program code embodied, e.g., stored, thereon.Any combination of one or more computer readable medium(s) may be utilized. The computer readable medium may be a computer readable signal medium or a computer readable storage medium. A computer readable storage medium may be, for example, but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples of a computer readable storage medium may include, but are not limited to, the following: an electrical connection having one or more wires, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In the context of the present invention, a computer readable storage medium may be any tangible medium that can contain, or store, a program for use by or in connection with an instruction execution system, apparatus, or device.A computer readable signal medium may include a propagated data signal with computer readable program code embodied therein, for example, in baseband or as part of a carrier wave. Such a propagated signal may take any of a variety of forms, including, but not limited to, electro-magnetic, optical, or any suitable combination thereof. A computer readable signal medium may be any computer readable medium that is not a computer readable storage medium and that can communicate, propagate, or transport a program for use by or in connection with an instruction execution system, apparatus, or device.Program code embodied on a computer readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber, cable, RF, etc., or any suitable combination of the foregoing. Computer program code for carrying out operations for aspects of the present invention may be written in any combination of one or more programming languages, including an object oriented programming language such as Java(TM), Smalltalk, C++ or the like and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The program code may execute entirely on the user's computer (e.g. a desktop PC or a mobile device), partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer, or entirely on the remote computer or server. In the latter scenario, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection may be made to an external computer (for example, through the Internet using an Internet Service Provider).Aspects of the present invention are described below with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the present invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor, in particular a microprocessor or a central processing unit (CPU), of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer, other programmable data processing apparatus, or other devices create means for implementing the functions / acts specified in the flowchart and / or block diagram block or blocks.These computer program instructions may also be stored in a computer readable medium that can direct a computer, other programmable data processing apparatus,or other devices to function in a particular manner, such that the instructions stored in the computer readable medium produce an article of manufacture including instructions which implement the function / act specified in the flowchart and / or block diagram block or blocks.The computer program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other devices to cause a series of operational steps to be performed on the computer, other programmable apparatus or other devices to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide processes for implementing the functions / acts specified in the flowchart and / or block diagram block or blocks.The flowchart and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of devices, methods and computer program products according to various embodiments of the present invention. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of code, which comprises one or more executable instructions for implementing the specified logical function(s).It should also be noted that, in some alternative implementations, the functions noted in the blocks may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams and / or flowchart illustrations, and combinations of blocks in the block diagrams and / or flowchart illustrations, can be implemented by special purpose hardware-based systems that perform the specified functions or acts, or combinations of special purpose hardware and computer instructions.BRIEF DESCRIPTION OF THE DRAWINGSThese and other aspects of the invention are apparent from and will be further elucidated, by way of example, with reference to the drawings, in which:Fig. 1 is a block diagram of an embodiment of the system for creating a lookup table;Fig. 2 is a flow chart of an embodiment of the method of creating a lookup table;Fig. 3 illustrates the projection of a point belonging to the unit d-ball of a space onto an axis;Fig. 4 illustrates the determination of border values of cells of the lookup table;Fig. 5 shows an example of the lookup table;Fig. 6 is a flow chart of a first embodiment of the method of creating probe information;Fig. 7 is a flow chart of a second embodiment of the method of creating probe information;Fig. 8 a flow chart of a first embodiment of the method of creating reference information;Fig. 9 a flow chart of a second embodiment of the method of creating reference information;Fig. 10 is a flow chart of a first embodiment of the method of determining or enabling to determine a relation between a probe and a reference under encryption;Fig. 11 is a flow chart of a second embodiment of the method of determining or enabling to determine a relation between a probe and a reference under encryption;Fig. 12 shows a correlation between the results of determining the relationship with and without the lookup table created with the method of Fig. 2;Fig. 13 is a block diagram of an exemplary data processing system for performing the methods of the invention;Fig. 14 is a flow chart of a third embodiment of the method of creating probe information; andFig. 15 is a flow chart of a third embodiment of the method of determining or enabling to determine a relation between a probe and a reference under encryption.Corresponding elements in the drawings are denoted by the same reference numeral.DETAILED DESCRIPTION OF THE DRAWINGSFig. 1 is a block diagram of an embodiment of the system for creating a lookup table of feature comparison scores of a plurality of features for determining a relationship between a probe and a reference under encryption: a system 1. Fig. 1 further shows a client device 11 , an authentication server 21 of a privacy-compliant service provider, and a database server 31. The client device 11 is configured to create probe information and reference information for determining the relationship under encryption. The database server 31 is configured to enable the authentication server 21 to determine the relationship.The system 1 comprises a receiver 3, a transmitter 4, a processor 5, and a memory 7. The processor 5 is configured to determine a probability density functioncorresponding to a projection of a point belonging to the unit ball of a space onto an axis, determine a cumulative distribution function of the probability density function, determine an inverse of the cumulative distribution function, and determine border values of cells of the lookup table based on the inverse of the cumulative distribution function. The space has a number of dimensions which is equal to the number of features in the plurality of features. This unit ball is also referred to as the unit d-ball, where d is the number of dimensions of the space. The border values apply to both a first axis and a second axis of the lookup table.The processor is further configured to determine a first score component for each respective cell of the cells and determine a second score component for each respective cell of the cells. The first score component is an integration of the probability density function over normalized possible values of the plurality of features in an interval between the border values of the respective cell on the first axis of the lookup table. The second score component is an integration of the probability density function over normalized possible values of the plurality of features in an interval between the border values of the respective cell on the second axis of the lookup table.The integrations may be calculated as part of the score determination or may be calculated before the scores are determined. The processor 5 is further configured to calculate, for each respective cell of the cells, a feature comparison score by performing a mathematical operation on the first score component calculated for the respective cell and the second score component calculated for the respective cell. This lookup table is used for determining a relationship between a probe and a reference under encryption. The processor 5 may be configured to transmit, via the transmitter 4, the lookup table to the client device 11 or to another system from which the client device 11 can obtain the lookup table, for example. The lookup table does not need to be kept secret and may be made publicly available / downloadable from anywhere, e.g. on a server of the privacy-compliant service provider. The probe may be a biometric probe, the reference may be a biometric reference, and the features may be biometric features, for example.The client device 11 comprises a receiver 13, a transmitter 14, a processor 15, and a memory 17. The processor 15 is configured to obtain, e.g. receive via receiver 13, a lookup table from the system 1 or from another system, obtain a normalized and quantized value of each of a plurality of features for the reference, select, from the lookup table, a line of cells per respective feature of the plurality of features on the first axis of the lookup table based on the normalized and quantized value of the respective feature and the border values on the second axis of the lookup table, create a vector for each of the selected lines of cells, and create the reference information by homomorphically encrypting each of the vectors,typically with a public key associated with the privacy-compliant service provider. The vectors may be encrypted separately or jointly. The processor 15 is configured to transmit, via the transmitter 14, the reference information to the authentication server 21.The processor 15 is further configured to obtain a normalized and quantized value of each of a plurality of features for the probe and select an identifier per respective feature of the plurality of features based on the normalized and quantized value of the respective feature and the border values on the first axis of the lookup table. The identifier identifies a line of cells on the second axis of the lookup table. The processor 15 is further configured to determine, for inclusion in the probe information, an index per feature of the plurality of features based on the selected identifiers. The processor 15 is configured to transmit, via the transmitter 14, the probe information to the authentication server 21. The transmitted probe information includes the index per feature.The authentication server 21 comprises a receiver 23, a transmitter 24, a processor 25, and a memory 27. The processor 25 is configured to receive, via receiver 23, reference information from the client device 11 and to transmit, via transmitter 24, the reference information to the database server 31. The processor 25 is further configured to receive, via receiver 23, probe information from the client device 11, transmit, via transmitter 24, the probe information to the database server 31, receive, via receiver 23, result information from the database server 31 in response to providing the probe information, and determine the relationship between the probe and the reference based on an evaluation comprised in the result information.The result information may comprise a final score encrypted with a public key associated with the privacy-compliant service provider. The processor 25 may be configured to determine the relationship between the probe and the reference by decrypting the encrypted final score with the private key corresponding to this public key and comparing the decrypted final score with a threshold.The database server 31 comprises a receiver 33, a transmitter 34, a processor 35, and a memory 37. The processor 35 is configured to receive, via receiver 33, the reference information from the authentication server 21 The reference information comprises a plurality of homomorphically encrypted vectors. Each vector comprises a plurality of feature comparison scores. The reference information is provided by the client device 11 to the authentication server 21 and by the authentication server 21 to the database server 31 in the enrollment phase. The processor 35 is configured to receive, via receiver 33, the probe information from the authentication server 21. The probe information comprises an index per feature of a plurality of features.The processor 35 is further configured to determine an evaluation of the relationship by summing up relevant feature comparison scores of the homomorphically encrypted vectors without decrypting the homomorphically encrypted vectors. The relevant feature comparison scores correspond to the indices. The processor 35 is further configured to transmit, via transmitter 34, result information, which comprises the evaluation, to the authentication server 21 to enable the authentication server 21 to determine the relationship between the probe and the reference based on the evaluation.In the embodiments shown in Fig. 1, the systems 1, 21, and 31 comprise one processor 5, one processor 25, and one processor 35, respectively. In an alternative embodiment, one or more of the systems 1, 21, and 31 comprise multiple processors. The processors 5, 25, and 35 may be general-purpose processors, e.g., ARM, Qualcomm, AMD, or Intel processors, or application-specific processors. The processors 5, 25, and 35 may run Google Android, Apple iOS, a Unix-based operating system, or Windows as operating system, for example.The receivers 3, 23, and 33 and the transmitters 4, 24, and 34 of the systems 1, 21, and 31, respectively, may use one or more wired or wireless communication technologies such as Ethernet, Wi-Fi, LTE, and / or 5G New Radio to communicate with other devices on the Internet. The receiver and the transmitter of a system may be combined in a transceiver. The systems 1, 21, and 31 may comprise other components typical for a digital device.In the embodiment shown in Fig. 1, the client device 11 comprises one processor 15. In an alternative embodiment, the client device 11 comprises multiple processors. The processor 15 may be a general -purpose processor, e.g., an ARM, Qualcomm, AMD, or Intel processor, or an application-specific processor. The processor 15 may run Google Android, Apple iOS, a Unix-based operating system, or Windows as operating system, for example.The receiver 13 and the transmitter 14 of the client device 15 may use one or more wired or wireless communication technologies such as Ethernet, Wi-Fi, LTE, and / or 5G New Radio to communicate with other devices on the Internet. The receiver 13 and the transmitter 14 may be combined in a transceiver. The client device 15 may comprise other components typical for a client device, e.g., a battery and / or a power connector.An embodiment of the computer-implemented method of creating a lookup table of feature comparison scores of a plurality of features for determining a relationship between a probe and a reference under encryption is shown in Fig. 2. This method may be performed by the system 1 of Fig. 1, for example. The probe may be a biometric probe, thereference may be a biometric reference, and the features may be biometric features, for example.A step 101 comprises determining a probability density function (PDF) corresponding to a projection of a point belonging to the unit ball of a space onto an axis. The space has a number of dimensions which is equal to the number of features in the plurality of features. This unit ball is also referred to as the unit d-ball, where d is the number of dimensions of the space. This PDF is the PDF of every coordinate of a d-dimensional normalized feature vector. Preferably, the probability density function corresponds to a projection, onto the axis, of points which are uniformly distributed over the unit ball. This results in a performance similar to the baseline.Fig. 3 illustrates the projection of a point belonging to the surface area of the unit d-ball onto the x-axis. In the example of Fig. 3, the projection axis is the x axis 51. Let X denote the random variable after projection on the x-axis 51. Let x denote a realization 55 of that random variable. Let <p(x) denote the angle of a point on the d-ball that is projected onto x. Let Sd-i denote the surface 53 of a d-ball given-1, where r denotes the radius and T denotes the Gamma functionThe probability mass of the points on the d-ball is uniformly distributed over the d-ball. The probability mass that a point on the d-ball is projected onto the x-axis is the mass contained on the surface of the (d-l)-ball with center x and radius 56: l — x2= sin (cp (x)) .In order to derive the PDF / x(xthe equation / %(x)=maY be used. Fig. 3 shows thatnormalization factor. The same probability density function can be used for both the x-axis and the y-axis. Thus, (x) = / y(x) = fy(x). In view of the above, the probability density function (x) may be calculated with the following equation:where the Beta function B(x,y) = Jotx-1(l — t)y-1dt, x E[- 1,1], and d is the number of dimensions of the space.A step 103 comprises determining a cumulative distribution function (CDF) of the probability density function. The cumulative distribution function may be calculated with the following equation:- where B(x, y) = J tx-1(l — t)y-1dt, d is the number of dimensions of the space, and n= d-2.A step 105 comprises determining an inverse of the cumulative distribution function. For calculating the inverse CDF, Brent’s method implemented in SciPy (e.g. (release 1.9.0) may be used to compute the numerical inverse of the CDF at a specific point, see e.g. htps: / / scipy.org / .A step 107 comprises determining border values of cells of the lookup table based on the inverse of the cumulative distribution function. The border values apply to both a first axis and a second axis of the lookup table. A single lookup table is used for all features, which is possible, because all features follow the same PDF. The raw values of different features may have different ranges but they are normalized to fall within the same range [-1,1]. The raw values are further quantized to accommodate the lookup table. A feature quantization maps the continuous domain of real numbers to a finite set of bins, which is needed to limit the possible feature values. The size of the lookup table depends on the chosen number of feature quantization levels N.The bins’ borders, and thus the cell borders, may be determined with a variation on the algorithm shown below. The below algorithm is taken from the paper “Fast and accurate likelihood ratio-based biometric verification secure against malicious adversaries” by A. Bassit, F. Hahn, J. Peeters, T. Kevenaar, R. Veldhuis, and A. Peter, IEEE Transactions on Information Forensics and Security, vol. 16, 2021. In the below algorithm, ICDF(p,0,l) is the inverse of the CDF of a 7\f(0,l) at the cumulative probability p. In the variation on this algorithm, the inverse CDF of the point projection on the unit d-ball is used instead of ICDF(p,0,l).Input: N: number of feature quantization levelsOutput: Bn: array containing the bins’ borders of size N -1; for j 1 to N -1 do p =j / N ;Bn[j]=ICDF(p,O,l); end forFig. 4 illustrates the determination of border values of cells of the lookup table. Fig. 4 shows an example of a lookup table 61 with four feature quantization levels and feature vectors of dimension d. The border values 63, 64, and 65 are the same for both axes and each correspond to the inverse CDF of the projection of a point belonging to the unit d- ball onto an axis. The calculation of the feature comparison scores, including the feature comparison score of cell 69, will be described in relation to steps 109-113.Fig. 5 shows an example of the lookup table created with the method of Fig.2. In general, one of the axes of the lookup table corresponds to the potential reference and the other axis corresponds to the potential probe. In the example of Fig. 5, the y axis of the lookup table 71 represents possible values of the reference and the x axis of the lookup table 71 represents possible features values of the probe. In the example of Fig. 5, the lookup table 71 has eight feature quantization levels and feature vectors of dimension d. There is only one lookup table for all dimensions / features and a higher number of dimensions / features does not increase the size of the lookup table. The lookup table 71 contains 8x8=64 feature comparison scores.A step 109 comprises determining a first score component for each respective cell of the cells. The first score component is an integration of the probability density function over normalized possible values of the plurality of features in an interval between the border values of the respective cell on the first axis of the lookup table. The integrations may be calculated as part of the score determination or may be calculated before the scores are determined (either in step 109 or in a separate step). If the first axis is the x axis, a first score component Ex[x|Bnx] may be calculated as follows:Bnxis the interval between the border values of the cell x,y with respect to the x-axis. The interval Bnxhas one of the three forms [- l,Bn[l]), [Bn[j],Bn[j+l], or [Bn[N- 1], 1] . For example, the border value 65 of Fig. 4 corresponds to Bn[l], the border value 64 of Fig. 4 corresponds to Bn[2], and the border value 63 of Fig. 4 corresponds to Bn[3], Equation (3) defines the expectation over the cell’s borders with respect to the x-axis Bnx.A step 111 comprises determining a second score component for each respective cell of the cells. The second score component is an integration of the probability density function over normalized possible values of the plurality of features in an intervalbetween the border values of the respective cell on the second axis of the lookup table. The integrations may be calculated as part of the score determination or may be calculated before the scores are determined (either in step 111 or in a separate step). If the second axis is the y axis, a second score component Er[y|Bny] may be calculated as follows:Bnyis the interval between the border values of the cell x,y with respect to the y-axis. The interval Bnyhas one of the three forms [- 1 ,Bn

[0001] ), [Bn[j],Bn[j+l], or [Bn[N- 1], 1] . Equation (3) defines the expectation over the cell’s borders with respect to the y-axis Bny.A step 113 comprises calculating, for each respective cell of the cells, a feature comparison score by performing a mathematical operation on the first score component calculated for the respective cell and the second score component calculated for the respective cell. By performing step 113, the creation of the lookup table is completed.The feature comparison score may be calculated, for example, for each respective cell of the cells, by multiplying the first score component calculated for the respective cell and the second score component calculated for the respective cell, i.e. by calculating the inner product, as shown below in Equation (5). Equation (6) represents the probability of a cell.Alternatively, the feature comparison score may be calculated, for example, for each respective cell of the cells, by calculating the square of a difference between the first score component calculated for the respective cell and the second score component calculated for the respective cell, i.e. by calculating the squared Euclidian distance, as shown below in Equation (7).The feature comparison scores Ex,Y[x,y B72] may be intermediate comparison scores which are then quantized to integers. Given that the feature comparison scores Ex r[x,y|Bn]arereal -valued, another quantization mapping may be applied, that may be referred to as cell quantization, to convert the real values of the intermediate comparison scores to integers, making them suitable for homomorphic encryption (HE) schemes with an integer plaintext space. The cell quantization takes the cell’s intermediate comparison score, divides it by a quantization step A, and rounds it to the nearest integer. The resulting lookup table, e.g. lookup table 71 of Fig. 5, consists of precomputed integer values. An example of a final feature comparison score is score 77 (“5”) of Fig. 5.In summary, to generate the lookup table, first, the borders of a cell are determined by equiprobably cutting the x-axis and y-axis according to the PDF of the projection of a point belonging to the unit d-ball onto an axis. Then, a table of NxN cells is defined, where N denotes the feature quantization levels, and each cell’s borders are determined according to the bins Bn for both axes x and y. Subsequently, the cell’s feature comparison score is calculated with the joint conditional expectation Equation (5) or the joint conditional expectation Equation (7) for independent X and Y . A lookup table generated with Equation (5) is also referred to as an MFIP (Multiplication-Free Inner Product) lookup table and a lookup table generated with Equation (7) is also referred to as an MFSED (Multiplication-Free Squared Euclidean Distance) lookup table.A first embodiment of the computer-implemented method of creating reference information for determining a relationship between a probe and a reference under encryption is shown in Fig. 6. This method may be performed by the client device 11 of Fig. 1, for example. The probe may be a biometric probe, the reference may be a biometric reference, and the features may be biometric features, for example.A step 131 comprises obtaining a lookup table created with the method of Fig. 2. A step 133 comprises obtaining a normalized and quantized value of each of a plurality of features for the reference. The same normalization and feature quantization performed in step 107 of Fig. 2 is performed in step 133.A step 135 comprises selecting, from the lookup table, a line of cells per respective feature of the plurality of features on the first axis of the lookup table based on the normalized and quantized value of the respective feature, as obtained in step 133, and the border values on the second axis of the lookup table, as obtained in step 131. A step 137 comprises creating a vector for each of the lines of cells selected in step 135. A step 139 comprises creating the reference information by homomorphically encrypting each of thevectors created in step 137, e.g. with a public key associated with a privacy -compliant service provider. The vectors may be encrypted separately or jointly.A second embodiment of the computer-implemented method of creating reference information for determining a relationship between a probe and a reference under encryption is shown in Fig. 7. The second embodiment of Fig. 7 is an extension of the first embodiment of Fig. 6. In the embodiment of Fig. 7, step 137 of Fig. 6 is implemented by a step 141. Step 131 comprises obtaining a lookup table created with the method of Fig. 2, e.g. the lookup table 71 of Fig. 5. Step 133 comprises obtaining a normalized and quantized value of each of a plurality of features for the reference. The result is reference feature vector 81, i.e. (ri,... ,ri,... ,rd).Step 135 comprises selecting, from the lookup table, a line of cells per respective feature of the plurality of features on the first axis of the lookup table based on the normalized and quantized value of the respective feature, as obtained in step 133, and the border values on the second axis of the lookup table, as obtained in step 131. In the example of Fig. 5, the y axis of the lookup table 71 represents possible values of the reference and the x axis of the lookup table 71 represents possible features values of the probe. This means that rows of the lookup table 71 would be selected in step 135. In Fig. 5, row 73 corresponds to bin 1. In the example of Fig. 7, rows 82, which comprise rows #2, #5, and #7 of lookup table 71, are selected. Row #7 (the row corresponding to bin #7) is selected for feature #1, row #5 is selected for feature #i, and row #2 is selected for feature #d.Step 141 comprises creating a vector for each of the lines of cells selected in step 135 such that the order in which the feature comparison scores of the lines of cells are stored in the vectors is different from an order in which the feature comparison scores are stored in the lines of cells on the first axis in the lookup table. Step 141 may comprise applying a permutation function to the selected lines of cells. Different permutation functions may be applied to different lines of cells. The same permutation fimction(s) will be used in relation to the probe.In the example of Fig. 7, a permutation function 7Ti is applied to the row selected for feature fi (row #7), a permutation function nt is applied to the row selected for feature fi (row #5), and a permutation function nd is applied to the row selected for feature fi (row #2). This results in the creation of vectors 83. In the example of Fig. 7, of the vectors 83, the vector which corresponds to feature fi is (0,2, 1,-2, 3,-1, -3,0), which is a permutation of row #7 of the lookup table 71 (-3, -2, -1,0,0, 1,2,3). Step 139 comprises creating the reference information by homomorphically encrypting each of the vectors created in step 141, which results in homomorphically encrypted vectors 84.In the example shown in Fig. 7, the vectors are encrypted separately. In an another example shown in Fig. 14, the vectors are encrypted jointly by concatenating the vectors and then homomorphically encrypting the result. This results in reference information 401.A first embodiment of the computer-implemented method of creating probe information for determining a relationship between a probe and a reference under encryption is shown in Fig. 8. This method may be performed by the client device 11 of Fig. 1, for example. The probe may be a biometric probe, the reference may be a biometric reference, and the features may be biometric features, for example.A step 151 comprises obtaining a lookup table created with the method of Fig. 2. A step 153 comprises obtaining a normalized and quantized value of each of a plurality of features for the probe. The same normalization and feature quantization performed in step 107 of Fig. 2 is performed in step 153.A step 155 comprises selecting an identifier per respective feature of the plurality of features based on the normalized and quantized value of the respective feature, as obtained in step 151, and the border values on the first axis of the lookup table, as obtained in step 153. The identifier identifies a line of cells on the second axis of the lookup table. A step 157 comprises determining, for inclusion in the probe information, an index per feature of the plurality of features based on the identifiers selected in step 155.A second embodiment of the computer-implemented method of creating probe information for determining a relationship between a probe and a reference under encryption is shown in Fig. 9. The second embodiment of Fig. 9 is an extension of the first embodiment of Fig. 8. In the embodiment of Fig. 9, step 155 of Fig. 8 is implemented by a step 161 and step 157 of Fig. 8 is implemented by a step 163. Step 151 comprises obtaining a lookup table created with the method of Fig. 2, e.g. the lookup table 71 of Fig. 5. Step 153 comprises obtaining a normalized and quantized value of each of a plurality of features for the probe. The result is probe feature vector 86, i.e. (pi,... ,pi,... ,pd).Step 161 comprises selecting an identifier per respective feature of the plurality of features based on the normalized and quantized value of the respective feature, as obtained in step 151, and the border values on the first axis of the lookup table, as obtained in step 153. The identifier identifies a line of cells on the second axis of the lookup table. In the example of Fig. 5, the y axis of the lookup table 71 represents possible values of the reference and the x axis of the lookup table 71 represents possible features values of the probe. This means that columns of the lookup table 71 would be selected in step 161. In Fig. 5, column 75 corresponds to bin 1.In step 161, the identifiers are selected from an ordered set of identifiers. The identifiers are ordered according to feature value. For example, in the lookup table 71, the bins of possible feature values are numbered 1 to 8, as there are eight feature quantization levels. In the example of Fig. 9, column #2 (the column corresponding to bin #2) is selected for feature #1, column #6 is selected for feature #i, and column #4 is selected for feature #d. In the example of Fig. 9, the vector 87 of selected identifiers is (2,... , 6,... , 4). While the identifiers are selected from a set ordered according to feature value, the vector itself is ordered according to feature.Step 163 comprises determining, for inclusion in the probe information, an index per feature of the plurality of features based on the identifiers selected in step 161. In step 163, the indices are created by mapping a respective identifier selected for a respective feature of the plurality of features to a permuted identifier from a permutation of the ordered set of identifiers. The respective identifier has a certain order number in the ordered set of identifiers and the permuted identifier has the same certain order number in the permutation.Step 163 may comprise applying a permutation function to the identifiers selected in step 161. Different permutation functions may be applied to different identifiers. The one or more used permutation functions are the same one or more permutation functions that were used in relation to the reference.In the example of Fig. 9, a permutation function 7Ti is applied to the identifier of the column selected for feature fi (column #2), a permutation function nt is applied to the identifier of the column selected for feature fi (column #6), and a permutation function nd is applied to the identifier of the column selected for feature fd (column #4). This results in the creation of a vector 88, which comprises (4,... ,1,... ,5).For example, permutation function 7Ti permutes a vector (ai,a2,a3,a4,a5,a6,a7,as) into (a4,a7,ae,a2,a8,a3,ai,a5). Applying this permutation function to the row selected for feature fi (row #7), i.e. (-3, -2, -1,0,0, 1,2,3) creates a permutation (0,2, 1,-2, 3,- l,-3,0). Applying this permutation function 7Ti to the identifier of the column selected for feature fi, i.e. 2, creates a permuted identifier 4 (a2 is the fourth element of the permuted vector).A first embodiment of the computer-implemented method of determining or enabling to determine a relationship between a probe and a reference under encryption is shown in Fig. 10. This method may be performed by the database server 31 of Fig. 1, for example. The probe may be a biometric probe, the reference may be a biometric reference, and the features may be biometric features, for example.A step 181 comprises obtaining probe information created with the method of Fig. 6 or Fig. 7. The probe information comprises an index per feature of a plurality of features. A step 183 comprises obtaining reference information created with the method of Fig. 8 or Fig. 9. The reference information comprises a plurality of homomorphically encrypted vectors. Each vector comprises a plurality of feature comparison scores.A step 185 comprises determining an evaluation of the relationship by summing up relevant feature comparison scores of the homomorphically encrypted vectors obtained in step 183 without decrypting the homomorphically encrypted vectors. The relevant feature comparison scores correspond to the indices obtained in step 181. A step 187 comprises determining or enabling to determine the relationship between the probe and the reference based on the evaluation determined in step 185.A second embodiment of the computer-implemented method of determining or enabling to determine a relationship between a probe and a reference under encryption is shown in Fig. 11. The second embodiment of Fig. 11 is an extension of the first embodiment of Fig. 10.Step 181 comprises obtaining probe information created with the method of Fig. 6 or Fig. 7. The probe information comprises an index per feature of a plurality of features, e.g. vector 88 shown in Fig. 9. Step 183 comprises obtaining reference information created with the method of Fig. 8 or Fig. 9. The reference information comprises a plurality of homomorphically encrypted vectors, e.g. vectors 84 shown in Fig. 7. Each vector comprises a plurality of feature comparison scores.Step 185 comprises determining an evaluation of the relationship by summing up relevant feature comparison scores of the homomorphically encrypted vectors obtained in step 183 without decrypting the homomorphically encrypted vectors. The relevant feature comparison scores correspond to the indices obtained in step 181. In the example of Fig. 11, a representation 90 of the vectors 84 of Fig. 7 shows the relevant feature comparison scores which correspond to five of the indices of the vector 88 of Fig. 9. The representation 90 not only represents the indices of the features fi, fi, and fd, but also the indices of the features fn and fi+i. Thus, the vector 88 shown in Fig. 9 more specifically comprises the (permuted) indices (4,... , 1,1, 4,..., 5). The feature comparison scores of features (fi,..,fi-i,fi,fi+i,...,fd) are referred to as scores (si,..,Si-i,Si,Si+i,...,Sd).In the embodiment of Fig. 11, step 185 comprises steps 191, 193, 195, and 197. Step 191 comprises creating further vectors 91 from the vectors 84 by summing up vectors which correspond to same indices. In the example of Fig. 11, three further vectors are created for the five vectors corresponding to features fi,fi-i,fi,fi+i,and fd. The two vectorscorresponding to features fi-i and fi have the same index (#1) indicated in the probe information (for these features) and are therefore summed up.The score 92 of the first further vector is the sum of score SM, score Si, and any other score in the first slot of any vector with index 1 indicated in the probe information. The two vectors corresponding to features fi and fi+i also have the same index (#4) indicated in the probe information and are therefore summed up. The score 93 of the second further vector is the sum of score Si, score Si+i, and any other score in the fourth slot of any vector with index 4 indicated in the probe information. The score 94 of the third further vector is the sum of score Sd and any other score in the fifth slot of any vector with index 5 indicated in the probe information.Step 193 comprises rotating further vectors 91 such that the sums of the feature comparison scores, including scores / sums 92, 93, and 94, are in a same specific slot. In the example of Fig. 11, the second further feature vector (index #4) is rotated 3 times and the third further feature vector (index #4) is rotated four times so that all sums are in the first slot. This results in rotated further vectors 95. Alternatively, the further vectors 91 may rotated such that they are in a same specific slot other than the first slot.Step 195 comprises summing up the rotated further vectors 95. This results in a sum vector 96. In the example of Fig. 11, the first slot of sum vector 96 comprises a score 97 (stot) which is a sum of all the scores in first slot of the rotated further vectors 95. In an a alternative embodiment, step 191 is omitted and no further vectors are created. In this alternative embodiment, the vectors 84 are rotated in step 193 instead of the further vectors such that the feature comparison scores are in a same specific slot of the (rotated) vectors. In this alternative embodiment, the rotated vectors are summed up in step 195 instead of the rotated further vectors 95. This alternative embodiment may require more processing resources. The sum -then-rotate approach reduces the number of rotations to d-1 where d is the length of one vector.Step 197 comprises isolating the specific slot from the sum of the rotated vectors or the sum of the rotated further vectors. This isolation may be performed with multiplication-free first plaintext slot isolation: Let n = (0, n2, • , ur) be a randomly sampled vector of size equals to the ring dimension with a zero in its first coordinate. The first plaintext slot of a ciphertext ct is isolated by adding ct with an encryption of u (additive blinding), assuming that u is freshly sampled. The vector u may be generated and encrypted beforehand but should not be reused.In the example of Fig. 11, the first slot is isolated from the sum vector 96 and the evaluation determined in step 197 is therefore equal to score 97. Step 187 comprisesdetermining or enabling to determine the relationship between the probe and the reference based on the evaluation determined in step 197. For example, step 187 may comprise transmitting the encrypted final score 97 to a privacy -compliant service provider. The privacy-compliant service provider may then determine the relationship between the probe and the reference by decrypting the encrypted final score 97 with its private key and comparing the decrypted final score with a threshold. Alternatively, an encrypted comparison with the threshold may be performed.In the embodiment of Fig. 11, the reference information obtained in step 183 comprises a plurality of homomorphically encrypted vectors which have been encrypted separately. In an alternative embodiment shown in Fig. 15, the reference information obtained in step 183 comprises a homomorphically encrypted concatenation of vectors, e.g. reference information 401 of Fig. 14.In the embodiment of Fig. 15, step 185 of Fig. 10 is implemented by steps 411, 413, and 415. Step 411 comprises creating a probe mask based on the probe information obtained in step 181. In the example of Fig. 15, a probe mask 402 corresponding to the permuted probe information 88 is formed as a concatenation of vectors of the form (• • -,0,1,0,- • •) where 1 is at the desired position to be selected.Step 413 comprises obtaining a homomorphically encrypted ciphertext by multiplying the probe mask with the homomorphically encrypted concatenation of the vectors. In the example of Fig. 15, the encrypted reference information / template 401 is multiplied, via one scalar multiplication, with the probe mask 402 to yield a ciphertext 403 of selected encrypted individual scores at their respective positions and zero elsewhere.Step 415 comprises summing up all individual slots of the ciphertext. In the example of Fig. 15, the final score ciphertext 97 is formed by summing over the plaintext slots of the selected individual scores ciphertext 403. The method of Fig. 15 may also be used when the method of Fig. 2 is not used, e.g. when HELR lookup tables are used instead of MFIP or MFSED lookup tables.Fig. 12 shows a comparison of the use of MFIP and MFSED lookup tables versus non-quantized and non-precomputed IP and SED expressed in terms of Pearson correlation coefficient for three different dimensions of feature vectors. The MFIP and MFSED lookup tables are parametrized by a feature vector of dimension d, a number of feature quantization levels N=2n, (n being the number of feature quantization bits) and a cell quantization step A.The MFIP and MFSED have been studied under different combinations of these parameters to understand the performance impact of these parameters. In Fig. 12, the x-axis indicates the number of bits (n) used in the feature quantization level. In the solid curve, the lookup table is tested without rounding, while in the dashed curves, the table is tested with two different rounding values A=0.01 and A=0.001, respectively. The quality of the lookup tables has been assessed in terms of the Pearson correlation coefficient by generating 200000 synthetic normalized feature vectors. The inner product is compared against the precomputed inner product from the MFIP and the SED is compared against the pre-computed SED from the MFSED.Fig. 12 shows that the larger the lookup table’s size gets (smaller quantization steps, more feature quantization bits), the more accurate the table gets; the Pearson coefficient converges to 1. The score quantization step A has a faint impact on the table’s accuracy, starting from values strictly smaller than 0.01, while it has a huge impact on the score range; the smaller A gets, the larger the score range becomes. The latter affects the runtime of the encrypted comparison with the threshold setting, which runs fast for smaller score ranges. The lookup table achieves an optimal accuracy starting from the size 23X 23without score / cell quantization and with score / cell quantization for A=0.001 for the three dimensions (128, 256 and 512). For A=0.01, the accuracy is maintained for feature vectors of low dimensions (128), while for high dimensions (256 and 512), the accuracy drops. The majority of the cells being rounded to zero causes information loss and thus reduces the accuracy.Tables 1 and 2 show a comparison for 512-dimensional feature vectors between an Inner Product baseline system, the MFIP system described above, and a State- Of-The-Art (SOTA) system described in the paper “Secure face matching using fully homomorphic encryption” by V. N. Boddeti, in 2018 IEEE 9th International Conference on Biometrics Theory, Applications and Systems (BTAS), pp. 1-10, IEEE, 2018. In MFIP vl, the vectors were encrypted separately. In MFIP v2, the vectors were encrypted jointly. As shown in the tables, MFIP is several times faster than the SOTA system.Table 1Table 2Fig. 13 depicts a block diagram illustrating an exemplary data processing system that may perform the method as described with reference to Figs. 2, 6-11, and 14-15.As shown in Fig. 13, the data processing system 300 may include at least one processor 302 coupled to memory elements 304 through a system bus 306. As such, the data processing system may store program code within memory elements 304. Further, the processor 302 may execute the program code accessed from the memory elements 304 via a system bus 306. In one aspect, the data processing system may be implemented as a computer that is suitable for storing and / or executing program code. It should be appreciated, however, that the data processing system 300 may be implemented in the form of any systemincluding a processor and a memory that is capable of performing the functions described within this specification.The memory elements 304 may include one or more physical memory devices such as, for example, local memory 308 and one or more bulk storage devices 310. The local memory may refer to random access memory or other non-persistent memory device(s) generally used during actual execution of the program code. A bulk storage device may be implemented as a hard drive or other persistent data storage device. The processing system 300 may also include one or more cache memories (not shown) that provide temporary storage of at least some program code in order to reduce the number of times program code must be retrieved from the bulk storage device 310 during execution.Input / output (I / O) devices depicted as an input device 312 and an output device 314 optionally can be coupled to the data processing system. Examples of input devices may include, but are not limited to, a keyboard, a pointing device such as a mouse, or the like. Examples of output devices may include, but are not limited to, a monitor or a display, speakers, or the like. Input and / or output devices may be coupled to the data processing system either directly or through intervening I / O controllers.In an embodiment, the input and the output devices may be implemented as a combined input / output device (illustrated in Fig. 7 with a dashed line surrounding the input device 312 and the output device 314). An example of such a combined device is a touch sensitive display, also sometimes referred to as a “touch screen display” or simply “touch screen”. In such an embodiment, input to the device may be provided by a movement of a physical object, such as e.g. a stylus or a finger of a user, on or near the touch screen display.A network adapter 316 may also be coupled to the data processing system to enable it to become coupled to other systems, computer systems, remote network devices, and / or remote storage devices through intervening private or public networks. The network adapter may comprise a data receiver for receiving data that is transmitted by said systems, devices and / or networks to the data processing system 300, and a data transmitter for transmitting data from the data processing system 300 to said systems, devices and / or networks. Modems, cable modems, and Ethernet cards are examples of different types of network adapter that may be used with the data processing system 300.As pictured in Fig. 13, the memory elements 304 may store an application 318. In various embodiments, the application 318 may be stored in the local memory 308, he one or more bulk storage devices 310, or separate from the local memory and the bulk storage devices. It should be appreciated that the data processing system 300 may further execute an operating system (not shown in Fig. 13) that can facilitate execution of theapplication 318. The application 318, being implemented in the form of executable program code, can be executed by the data processing system 300, e.g., by the processor 302. Responsive to executing the application, the data processing system 300 may be configured to perform one or more operations or method steps described herein.Various embodiments of the invention may be implemented as a program product for use with a computer system, where the program(s) of the program product define functions of the embodiments (including the methods described herein). In one embodiment, the program(s) can be contained on a variety of non-transitory computer-readable storage media, where, as used herein, the expression “non-transitory computer readable storage media” comprises all computer-readable media, with the sole exception being a transitory, propagating signal. In another embodiment, the program(s) can be contained on a variety of transitory computer-readable storage media. Illustrative computer-readable storage media include, but are not limited to: (i) non-writable storage media (e.g., read-only memory devices within a computer such as CD-ROM disks readable by a CD-ROM drive, ROM chips or any type of solid-state non-volatile semiconductor memory) on which information is permanently stored; and (ii) writable storage media (e.g., flash memory, floppy disks within a diskette drive or hard-disk drive or any type of solid-state random-access semiconductor memory) on which alterable information is stored. The computer program may be run on the processor 302 described herein.The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. As used herein, the singular forms "a," "an," and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. It will be further understood that the terms "comprises" and / or "comprising," when used in this specification, specify the presence of stated features, integers, steps, operations, elements, and / or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or groups thereof.The corresponding structures, materials, acts, and equivalents of all means or step plus function elements in the claims below are intended to include any structure, material, or act for performing the function in combination with other claimed elements as specifically claimed. The description of embodiments of the present invention has been presented for purposes of illustration, but is not intended to be exhaustive or limited to the implementations in the form disclosed. Many modifications and variations will be apparent to those of ordinary skill in the art without departing from the scope of the present invention. The embodiments were chosen and described in order to best explain the principles and somepractical applications of the present invention, and to enable others of ordinary skill in the art to understand the present invention for various embodiments with various modifications as are suited to the particular use contemplated.

Claims

CLAIMS:

1. A computer-implemented method of creating a lookup table (61,71) of feature comparison scores of a plurality of features for determining a relationship between a probe and a reference under encryption, said method comprising:- determining (101) a probability density function corresponding to a projection of a point belonging to the unit ball of a space onto an axis, the space having a number of dimensions which is equal to the number of features in the plurality of features;- determining (103) a cumulative distribution function of said probability density function;- determining (105) an inverse of said cumulative distribution function;- determining (107) border values (63-65) of cells of said lookup table(61.71) based on said inverse of said cumulative distribution function, said border values applying to both a first axis and a second axis of said lookup table (61,71);- determining (109) a first score component for each respective cell (69) of said cells, said first score component being an integration of said probability density function over normalized possible values of said plurality of features in an interval between said border values (63-65) of said respective cell on said first axis of said lookup table (61,71);- determining (111) a second score component for each respective cell (69) of said cells, said second score component being an integration of said probability density function over normalized possible values of said plurality of features in an interval between said border values (63-65) of said respective cell on said second axis of said lookup table(61.71); and- calculating (113), for each respective cell (69) of said cells, a feature comparison score (77) by performing a mathematical operation on said first score component calculated for said respective cell (69) and said second score component calculated for said respective cell (69).

2. A method as claimed in claim 1, wherein said feature comparison score is calculated, for each respective cell of said cells, by multiplying said first score component calculated for said respective cell and said second score component calculated for said respective cell.

3. A method as claimed in claim 1, wherein said feature comparison score is calculated, for each respective cell of said cells, by calculating the square of a difference between said first score component calculated for said respective cell and said second score component calculated for said respective cell.

4. A method as claimed in any one of the preceding claims, wherein said feature comparison score is calculated, for each respective cell of said cells, by performing said mathematical operation on said first score component calculated for said respective cell and said second score component calculated for said respective cell to calculate an intermediate comparison score and by quantizing said intermediate comparison score to an integer value.

5. A method as claimed in any one of the preceding claims, wherein said probe is a biometric probe, said reference is a biometric reference, and said features are biometric features.

6. A method as claimed in any one of the preceding claims, wherein said probability density function corresponds to a projection, onto said axis, of points which are uniformly distributed over the unit ball.

7. A computer-implemented method of creating probe information for determining a relationship between a probe and a reference under encryption, said method comprising:- obtaining (151) a lookup table (61,71) created with the method of any one of claims 1 to 6;- obtaining (153) a normalized and quantized value (86) of each of a plurality of features for said probe;- selecting (155) an identifier (87) per respective feature of said plurality of features based on said normalized and quantized value (86) of said respective feature and said border values (63-65) on said first axis of said lookup table (61,71), said identifier (87) identifying a line of cells (73) on said second axis of said lookup table (61,71); and- determining (157), for inclusion in said probe information, an index (88) per feature of said plurality of features based on said selected identifiers (87).

8. A method as claimed in claim 7, wherein said identifiers are selected (161) from an ordered set of identifiers, said identifiers being ordered according to feature value, and said indices are created by mapping (163) a respective identifier selected for a respective feature of said plurality of features to a permuted identifier from a permutation of said ordered set of identifiers, said respective identifier having a certain order number in said ordered set of identifiers and said permuted identifier having said same certain order number in said permutation.

9. A computer-implemented method of creating reference information for determining a relationship between a probe and a reference under encryption, said method comprising:- obtaining (131) a lookup table (61,71) created with the method of any one of claims 1 to 6;- obtaining (133) a normalized and quantized value (81) of each of a plurality of features for said reference;- selecting (135), from said lookup table (61,71), a line of cells (75) per respective feature of said plurality of features on said first axis of said lookup table (61,71) based on said normalized and quantized value (81) of said respective feature and said border values (63-65) on said second axis of said lookup table (61,71);- creating (137) a vector (83) for each of said selected lines of cells (75); and- creating (139) said reference information (84) by homomorphically encrypting each of said vectors (83).

10. A method as claimed in claim 9, wherein an order in which said feature comparison scores of said lines of cells are stored in said vectors is different from an order in which said feature comparison scores are stored in said lines of cells on said first axis in said lookup table (61,71).

11. A computer-implemented method of determining or enabling to determine a relationship between a probe and a reference under encryption, said method comprising:- obtaining (181) probe information created with the method of claim 7 or 8, said probe information comprising an index per feature of a plurality of features;- obtaining (183) reference information created with the method of claim 9 or 10, said reference information comprising a plurality of homomorphically encrypted vectors, each vector comprising a plurality of feature comparison scores;- determining (185) an evaluation of said relationship by summing up relevant feature comparison scores of said homomorphically encrypted vectors without decrypting said homomorphically encrypted vectors, said relevant feature comparison scores corresponding to said indices; and- determining (187) or enabling to determine said relationship between said probe and said reference based on said evaluation.

12. A method as claimed in claim 11, wherein said evaluation of said relationship is determined by rotating (193) said vectors or further vectors (91), each of said further vectors (91) being a sum of vectors which correspond to same indices, such that said feature comparison scores or said sums of feature comparison scores are in a same specific slot of said vectors or said further vectors, summing up (195) said rotated vectors or said rotated further vectors (95), and isolating (197) said specific slot (97) from said sum (96) of said rotated vectors or said sum of said rotated further vectors (95).

13. A method as claimed in claim 11, wherein said reference information comprises a homomorphically encrypted concatenation (401) of said vectors and said evaluation of said relationship is determined by creating (411) a probe mask (402) based on said probe information, obtaining (413) a homomorphically encrypted ciphertext (403) by multiplying said probe mask (402) with said homomorphically encrypted concatenation (402) of said vectors and summing up (415) all individual slots of said homomorphically encrypted ciphertext (403).

14. A computer program or suite of computer programs comprising at least one software code portion or a computer program product storing at least one software code portion, the software code portion, when run on a computer system, being configured for performing the method of any one of claims 1 to 13.

15. A system (1) for creating a lookup table of feature comparison scores of a plurality of features for determining a relationship between a probe and a reference under encryption, said system (1) comprising at least one processor (5) configured to:- determine a probability density function corresponding to a projection of a point belonging to the unit ball of a space onto an axis, the space having a number of dimensions which is equal to the number of features in the plurality of features,- determine a cumulative distribution function of said probability density function,- determine an inverse of said cumulative distribution function,- determine border values of cells of said lookup table based on said inverse of said cumulative distribution function, said border values applying to both a first axis and a second axis of said lookup table,- determine a first score component for each respective cell of said cells, said first score component being an integration of said probability density function over normalized possible values of said plurality of features in an interval between said border values of said respective cell on said first axis of said lookup table,- determine a second score component for each respective cell of said cells, said second score component being an integration of said probability density function over normalized possible values of said plurality of features in an interval between said border values of said respective cell on said second axis of said lookup table, and - calculate, for each respective cell of said cells, a feature comparison score by performing a mathematical operation on said first score component calculated for said respective cell and said second score component calculated for said respective cell.

Images