论文标题
隐私保护行为导向身份验证方案的密码分析
Cryptanalysis of a privacy-preserving behavior-oriented authentication scheme
论文作者
论文摘要
连续身份验证已被提议作为对直接由人类（例如智能手机）直接处理的计算机设备的基于密码的身份验证的互补安全机制。连续身份验证存在一些隐私问题，因为某些用户功能和操作已向身份验证服务器揭示，而该服务器不被认为是不信任的。 Wei等人。在2021年提出了一种使用同构加密的行为身份验证的隐私权协议。加密可防止服务器获得采样的用户功能。在本文中，我们表明了Wei等人。方案对于诚实但有趣的服务器和活动的窃听者都是不安全的。我们提出了两次攻击：第一次攻击使身份验证服务器能够从加密数据中获取秘密用户密钥，纯文本行为模板和明文身份验证行为数据。第二次攻击使主动窃听器能够从传输的加密数据中恢复明文身份验证行为数据。
Continuous authentication has been proposed as a complementary security mechanism to password-based authentication for computer devices that are handled directly by humans, such as smart phones. Continuous authentication has some privacy issues as certain user features and actions are revealed to the authentication server, which is not assumed to be trusted. Wei et al. proposed in 2021 a privacy-preserving protocol for behavioral authentication that utilizes homomorphic encryption. The encryption prevents the server from obtaining sampled user features. In this paper, we show that the Wei et al. scheme is insecure regarding both an honest-but-curious server and an active eavesdropper. We present two attacks: The first attack enables the authentication server to obtain the secret user key, plaintext behavior template and plaintext authentication behavior data from encrypted data. The second attack enables an active eavesdropper to restore the plaintext authentication behavior data from the transmitted encrypted data.
