Security of Sensitive Data in Face Recognition System Applications: A Novel Encryption Approach

Background and Aim: The design of secure systems that can protect sensitive data is becoming a major area of research due to the growing number of applications that use the Internet. In mobile banking applications which use face recognition as unlock feature, the face data is encrypted and protected in a dedicated chip within the device called Secure Enclave that enhances the security of the application. This cutting-edge development is now being used by individuals in their personal devices like smartphones and tablets for accessing their own bank accounts and to perform online transactions. Since encrypted face data is stored locally on devices rather than in the bank’s database, it remains susceptible to security breaches, potentially allowing unauthorized access. While face recognition systems provide benefits like enhanced security, surveillance, and personalized marketing, they also raise privacy, security, ethical, and legal concerns. To address these challenges, this study proposes an encryption method for applications employing face recognition as an authentication feature. Methodology: The proposed method encrypts facial encodings generated by the face recognition model by utilizing Internet Protocol (IP) addresses as a dynamic key generation source. This approach ensures unique encryption for each communication, significantly reducing vulnerability to attacks. One of the widely used face recognition models in mobile applications is Dlib’s face recognition model which provides accurate facial embeddings. Results and Conclusion: The method is evaluated using the ‘‘pins_dataset’’ containing 10,000 images of 100 unique identities and an accuracy of 90.1% is achieved. The same accuracy is observed when testing face recognition without encrypting the facial encodings, demonstrating efficacy of the encryption algorithm. Additionally, the encryption algorithm’s time complexity is evaluated as O (1), confirming its ability to perform encryption with constant time complexity, making it suitable for real-time applications.