Abstract
In an implicit authentication system, a user profile is used as an additional factor to strengthen the authentication of mobile users. The profile consists of features that are constructed using the history of user actions on her mobile device over time. The profile is stored on a server and is used to authenticate an access request originated from the device at a later time. An access request will include a vector of recent features measurements on the device that will be matched against the stored features to accept or reject the request. The features however include private information such as user location or web sites they have visited. In this paper we propose privacy-preserving implicit authentication which achieves implicit authentication without revealing unnecessary information about the users’ usage profiles to the server. We propose an architecture, give formal security models, and propose constructions with provable security. We consider two security models, namely for cases where the device behaves semi-honestly or maliciously.
Chapter PDF
Similar content being viewed by others
Keywords
References
ARM TrustZone, http://www.arm.com/products/processors/technologies/trustzone
Baudron, O., Fouque, P.-A., Pointcheval, D., Stern, J., Poupard, G.: Practical Multi-Candidate Election System. In: Proc. 20th ACM Symposium on Principles of Distributed Computing, pp. 274–283. ACM (2001)
Boldyreva, A., Chenette, N., Lee, Y., O’Neill, A.: Order-Preserving Symmetric Encryption. In: Joux, A. (ed.) EUROCRYPT 2009. LNCS, vol. 5479, pp. 224–241. Springer, Heidelberg (2009)
Čapkun, S., Čagalj, M., Srivastava, M.: Secure Localization with Hidden and Mobile Base Stations. In: Int’l Conf. on Computer Communication, INFOCOM 2006 (2006)
Čapkun, S., Hubaux, J.-P.: Secure Positioning of Wireless Devices with Application to Sensor Networks. In: INFOCOM 2005: 24th Annual Joint Conf. of the IEEE Computer and Communications Societies, vol. 3, pp. 1917–1928. IEEE (2005)
Chang, K.-H., Hightower, J., Kveton, B.: Inferring Identity Using Accelerometers in Television Remote Controls. In: Tokuda, H., Beigl, M., Friday, A., Brush, A.J.B., Tobe, Y. (eds.) Pervasive 2009. LNCS, vol. 5538, pp. 151–167. Springer, Heidelberg (2009)
Chiang, J.T., Haas, J.J., Hu, Y.-C.: Secure and Precise Location Verification Using Distance Bounding and Simultaneous Multilateration. In: 2nd ACM Conference on Wireless Network Security, pp. 181–192. ACM (2009)
Damgård, I., Jurik, M.: Generalisation, A Simplification and Some Applications of Paillier’s Probabilistic Public-Key System. In: Kim, K. (ed.) PKC 2001. LNCS, vol. 1992, pp. 119–136. Springer, Heidelberg (2001)
Gentry, C.: A Fully Homomorphic Encryption Scheme. PhD thesis, Stanford University (2009)
Gentry, C., Halevi, S.: Implementing Gentry’s Fully-Homomorphic Encryption Scheme. In: Paterson, K.G. (ed.) EUROCRYPT 2011. LNCS, vol. 6632, pp. 129–148. Springer, Heidelberg (2011)
Goldreich, O., Micali, S., Wigderson, A.: How to Play Any Mental Game - A Completeness Theorem for Protocols with Honest Majority. In: Proc. 19th ACM Symposium on Theory of Computing, pp. 218–229. ACM (1987)
Haubert, E., Tucek, J., Brumbaugh, L., Yurcik, W.: Tamper-Resistant Storage Techniques for Multimedia Systems. In: Electronic Imaging 2005, pp. 30–40. International Society for Optics and Photonics (2005)
Jakobsson, M., Shi, E., Golle, P., Chow, R.: Implicit Authentication for Mobile Devices. In: Proc. of the 4th USENIX Conf. on Hot Topics in Security. USENIX Association (2009)
Kale, A., Rajagopalan, A., Cuntoor, N., Krüger, V.: Gait-Based Recognition of Humans Using Continuous HMMs. In: Proc. 5th IEEE Int’l Conf. on Automatic Face & Gesture Recognition, pp. 336–341. IEEE (2002)
Krumm, J.: Inference Attacks on Location Tracks. In: LaMarca, A., Langheinrich, M., Truong, K.N. (eds.) Pervasive 2007. LNCS, vol. 4480, pp. 127–143. Springer, Heidelberg (2007)
Leggett, J., Williams, G., Usnick, M., Longnecker, M.: Dynamic Identity Verification via Keystroke Characteristics. International Journal of Man-Machine Studies 35(6), 859–870 (1991)
Möller, S., Perlov, C., Jackson, W., Taussig, C., Forrest, S.R.: A Polymer Semiconductor Write-Once Read-Many-Times Memory. Nature 426(6963), 166–169 (2003)
Monrose, F., Rubin, A.: Authentication via Keystroke Dynamics. In: Proceedings of the 4th ACM Conference on Computer and Communications Security, pp. 48–56. ACM (1997)
Nisenson, M., Yariv, I., El-Yaniv, R., Meir, R.: Towards Behaviometric Security Systems: Learning to Identify a Typist. In: Lavrač, N., Gamberger, D., Todorovski, L., Blockeel, H. (eds.) PKDD 2003. LNCS (LNAI), vol. 2838, pp. 363–374. Springer, Heidelberg (2003)
Paillier, P.: Public-Key Cryptosystems Based on Composite Degree Residuosity Classes. In: Stern, J. (ed.) EUROCRYPT 1999. LNCS, vol. 1592, pp. 223–238. Springer, Heidelberg (1999)
Safa, N.A., Safavi-Naini, R., Shahandashti, S.F.: Privacy-Preserving Implicit Authentication. Cryptology ePrint Archive, Report 2014/203 (2014), http://eprint.iacr.org/2014/203
Shahandashti, S.F., Safavi-Naini, R., Ogunbona, P.: Private Fingerprint Matching. In: Susilo, W., Mu, Y., Seberry, J. (eds.) ACISP 2012. LNCS, vol. 7372, pp. 426–433. Springer, Heidelberg (2012)
Singelee, D., Preneel, B.: Location Verification Using Secure Distance Bounding Protocols. In: IEEE International Conference on Mobile Adhoc and Sensor Systems Conference, pp. 840–846. IEEE (2005)
Tan, K., Yan, G., Yeo, J., Kotz, D.: A Correlation Attack Against User Mobility Privacy in a Large-Scale WLAN Network. In: Proc. of the 2010 ACM Workshop on Wireless of the Students, by the Students, for the Students, pp. 33–36. ACM (2010)
Tsai, C.-S., Lee, C.-C., Hwang, M.-S.: Password Authentication Schemes: Current Status and Key Issues. IJ Network Security 3(2), 101–115 (2006)
Wang, D.-S., Li, J.-P.: A New Fingerprint-Based Remote User Authentication Scheme Using Mobile Devices. In: Int’l Conf. on Apperceiving Computing and Intelligence Analysis (ICACIA 2009), pp. 65–68. IEEE (2009)
Yao, A.C.-C.: How to Generate and Exchange Secrets. In: 27th Annual Symposium on Foundations of Computer Science, pp. 162–167. IEEE (1986)
Author information
Authors and Affiliations
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2014 IFIP International Federation for Information Processing
About this paper
Cite this paper
Safa, N.A., Safavi-Naini, R., Shahandashti, S.F. (2014). Privacy-Preserving Implicit Authentication. In: Cuppens-Boulahia, N., Cuppens, F., Jajodia, S., Abou El Kalam, A., Sans, T. (eds) ICT Systems Security and Privacy Protection. SEC 2014. IFIP Advances in Information and Communication Technology, vol 428. Springer, Berlin, Heidelberg. https://doi.org/10.1007/978-3-642-55415-5_40
Download citation
DOI: https://doi.org/10.1007/978-3-642-55415-5_40
Publisher Name: Springer, Berlin, Heidelberg
Print ISBN: 978-3-642-55414-8
Online ISBN: 978-3-642-55415-5
eBook Packages: Computer ScienceComputer Science (R0)