Flexible and Robust Privacy-Preserving Implicit Authentication

Abstract

Abstract. Implicit authentication consists of a server authenticating a user based on the user's usage profile, instead of/in addition to relying on something the user explicitly knows (passwords, private keys, etc.). While implicit authentication makes identity theft by third parties more difficult, it requires the server to learn and store the user's usage profile. Recently, the first privacy-preserving implicit authentication system was presented, in which the server does not learn the user's profile. It uses an ad hoc two-party computation protocol to compare the user's fresh sampled features against an encrypted stored user's profile. The protocol requires storing the usage profile and comparing against it using two different cryptosystems, one of them order-preserving; furthermore, features must be numerical. We present here a simpler protocol based on set intersection that has the advantages of: i) requiring only one cryptosystem; ii) not leaking the relative order of fresh feature samples; iii) being able to deal with any type of features (numerical or non-numerical).

Privacy-Enhancing Context Authentication from Location-Sensitive Data

“…Many existing contextual authentication proposals, summarised in Table 1, use device measurements in unprotected form-giving rise to privacy concerns especially when authentication decisions are outsourced to a remote server [8,23,28]. As noted previously, studies have already shown that users are generally reluctant towards disclosing, in particular, their GPS location to device applications [3][4][5]9].…”

“…Current approaches to privacy-enhancing continuous authentication have employed homomorphic encryption, e.g. Paillier [19], and garbled circuits for two-party computation (2PC) [8,12,23,28]. However, challenges still remain with respect computational complexity and storage overhead, which is exemplified by worst cases of 31.2s and 45.9s to compute authentication decisions in [8] and [28] respectively.…”

“…However, while a security proof is provided, the scheme is neither implemented nor evaluated in practice. Domingo-Ferrer et al [8] develop the work from [23] by presenting an additional approach based on the set intersection of homomorphically encrypted feature vectors to authenticate users. The set intersection is used to compute the dissimilarity function between the encrypted user profile and incoming feature vectors to support categorical features, beyond only numerical features supported in [23].…”

Privacy-Preserving Technologies

“…The collection of these data, however, may be too privacy-invasive. Proposals such as those by Safa et al (2014), Domingo-Ferrer et al (2015) and Blanco-Justicia and Domingo-Ferrer (2018) make use of homomorphic encryption and secure multiparty computation to authenticate users from their past behaviour without forcing them to disclose their profiles.…”

The Ethics of Cybersecurity

“…The collection of these data, however, may be too privacy-invasive. Proposals such as those by Safa et al (2014), Domingo-Ferrer et al (2015) and Blanco-Justicia and Domingo-Ferrer (2018) make use of homomorphic encryption and secure multiparty computation to authenticate users from their past behaviour without forcing them to disclose their profiles.…”