Abstract
Facial biometric templates are permanent identifiers: once exposed, the underlying identity cannot be reissued, so single-copy storage is a critical single point of failure. This study protects facial templates by combining a non-invertible BioHashing transform and authenticated encryption with a threshold secret-sharing layer that distributes the protected record across independent storage nodes and reconstructs it only when a quorum of shares is collected. Two threshold schemes, previously proposed by our group for fingerprint and for general confidential data, are, for the first time, applied to facial templates and compared on a common platform as a resource-aware architecture: a non-positional polynomial notation scheme with the Chinese remainder theorem, and a verifiable multivariable-function scheme. Both reconstruct the template exactly and, across 2000 trials per attack, resist or detect every attack in our evaluation (for example, malicious-share tampering is detected in 100% of 2000 trials and stolen-token recovery succeeds in 0 of 2000), whereas a single read breach of one-copy storage discloses the template in full. Below the threshold they differ: the polynomial scheme is a compact, deterministic ramp scheme for edge and Internet-of-Things nodes that discloses only ciphertext bytes and, under separate key and token storage, neither the biometric nor the key; the multivariable scheme adds native share verification and, in its randomized single-secret mode, provides information-theoretic perfect secrecy for a single high-value secret, while for the packed record it is a verified ramp. Rather than ranking the schemes, we quantify this trade-off. Because the protection layer is lossless, recognition accuracy is inherited unchanged from the face encoder; on the LFW verification protocol, the complete pipeline attains an equal error rate of 2.12% ± 0.57% (95% CI [1.77%, 2.47%]) against a per-fold raw-embedding cosine baseline of 1.37% ± 0.62%.