Paper 2014/203

Privacy-Preserving Implicit Authentication

Nashad Ahmed Safa, Reihaneh Safavi-Naini, and Siamak F. Shahandashti


In an implicit authentication system, a user profile is used as an additional factor to strengthen the authentication of mobile users. The profile consists of features that are constructed using the history of user actions on her mobile device over time. The profile is stored on the server and is used to authenticate an access request originated from the device at a later time. An access request will include a vector of recent measurements of the features on the device, that will be subsequently matched against the features stored at the server, to accept or reject the request. The features however include private information such as user location or web sites that have been visited. We propose a privacy-preserving implicit authentication system that achieves implicit authentication without revealing information about the usage profiles of the users to the server. We propose an architecture, give a formal security model and a construction with provable security in two settings where: (i) the device follows the protocol, and (ii) the device is captured and behaves maliciously.

Note: This is a full version of the paper by the same title appearing in the proceedings of the 29th International Information Security and Privacy Conference IFIP SEC 2014 (conference version: An extended journal version appears in Computers and Security (online version: The accepted manuscript is available as ePrint report 2015/707 (

Available format(s)
Cryptographic protocols
Publication info
Published elsewhere. Minor revision. Information Security and Privacy Conference IFIP SEC 2014
Implicit AuthenticationUser PrivacyHomomorphic EncryptionProvable SecurityBehavioural Features
Contact author(s)
siamak f s @ gmail com
2015-07-24: last of 2 revisions
2014-03-18: received
See all versions
Short URL
Creative Commons Attribution


      author = {Nashad Ahmed Safa and Reihaneh Safavi-Naini and Siamak F.  Shahandashti},
      title = {Privacy-Preserving Implicit Authentication},
      howpublished = {Cryptology ePrint Archive, Paper 2014/203},
      year = {2014},
      doi = {10.1007/978-3-642-55415-5_40},
      note = {\url{}},
      url = {}
Note: In order to protect the privacy of readers, does not use cookies or embedded third party content.