Cryptology ePrint Archive: Report 2015/707

Reconciling User Privacy and Implicit Authentication for Mobile Devices

Siamak F. Shahandashti and Reihaneh Safavi-Naini and Nashad Ahmed Safa

Abstract: In an implicit authentication system, a user profile is used as an additional factor to strengthen the authentication of mobile users. The profile consists of features that are constructed using the history of user actions on her mobile device over time. The profile is stored on the server and is used to authenticate an access request originated from the device at a later time. An access request will include a vector of recent measurements of the features on the device, that will be subsequently matched against the features stored at the server, to accept or reject the request. The features however include private information such as user location or web sites that have been visited. We propose a privacy-preserving implicit authentication system that achieves implicit authentication without revealing information about the usage profiles of the users to the server. We propose an architecture, give a formal security model and a construction with provable security in two settings where: (i) the device follows the protocol, and (ii) the device is captured and behaves maliciously.

Category / Keywords: cryptographic protocols / Implicit Authentication, User Privacy, Homomorphic Encryption, Provable Security, Behavioural Features

Original Publication (in the same form): Computers & Security

Date: received 15 Jul 2015

Contact author: siamak f s at gmail com

Available format(s): PDF | BibTeX Citation

Note: This manuscript has been accepted for publication in Computers & Security. The manuscript will undergo copyediting, typesetting, and review of the resulting proof before it is published in its final form. Please note that during the production process errors may be discovered which could affect the content, and all disclaimers that apply to the journal apply to this manuscript. A definitive version is published in Computers & Security (2015) under DoI: 10.1016/j.cose.2015.05.009 (online version: This is an extended version of a paper that appeared in the proceedings of the 29th International Information Security and Privacy Conference IFIP SEC 2014 (full version: This work is licensed under the Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 International License. It can be shared as long as the original work is credited, but cannot be changed in any way or used commercially. A copy of this license is available online (link:

Version: 20150718:125313 (All versions of this report)

Short URL:

[ Cryptology ePrint archive ]