No abstract

Biometric techniques are often used as an extra security factor in authenticating human users. Numerous biometrics have been proposed and evaluated, each with its own set of benefits and pitfalls. Static biometrics (such as fingerprints) are geared for discrete operation, to identify users, which typically involves some user burden. Meanwhile, behavioral biometrics (such as keystroke dynamics) are well-suited for continuous, and sometimes more unobtrusive, operation. One important application domain for biometrics is de-authentication: a means of quickly detecting absence of a previously-authenticated user and immediately terminating that user's active secure sessions. De-authentication is crucial for mitigating so-called Lunchtime Attacks, whereby an insider adversary takes over (before any inactivity timeout kicks in) authenticated state of a careless user who walks away from her computer.Motivated primarily by the need for an unobtrusive and continuous biometric to support effective de-authentication, we introduce PoPa -a new hybrid biometric based on a human user's seated posture pattern. PoPa captures a unique combination of physiological and behavioral traits. We describe a low-cost fully functioning prototype that involves an office chair instrumented with 16 tiny pressure sensors. We also explore (via user experiments) how PoPa can be used in a typical workplace to provide continuous authentication (and de-authenication) of users. We experimentally assess viability of PoPa in terms of uniqueness by collecting and evaluating posture patterns of a cohort of users. Results show that PoPa exhibits very low false positive, and even lower false negative, rates. In particular, users can be identified with, on average, 91.0% accuracy. Finally, we compare pros and cons of PoPa with those of several prominent biometric-based de-authentication techniques.

Exciting recent advances in genome sequencing, coupled with greatly reduced storage and computation costs, make genomic testing increasingly accessible to individuals. Already today, one’s digitized DNA can be easily obtained from a sequencing lab and later used to conduct numerous tests by engaging with a testing facility. Due to the inherent sensitivity of genetic material and the often-proprietary nature of genomic tests, privacy is a natural and crucial issue. While genomic privacy received a great deal of attention within and outside the research community, genomic security has not been sufficiently studied. This is surprising since the usage of fake or altered genomes can have grave consequences, such as erroneous drug prescriptions and genetic test outcomes. Unfortunately, in the genomic domain, privacy and security (as often happens) are at odds with each other. In this paper, we attempt to reconcile security with privacy in genomic testing by designing a novel technique for a secure and private genomic range query protocol between a genomic testing facility and an individual user. The proposed technique ensures authenticity and completeness of user-supplied genomic material while maintaining its privacy by releasing only the minimum thereof. To confirm its broad usability, we show how to apply the proposed technique to a previously proposed genomic private substring matching protocol. Experiments show that the proposed technique offers good performance and is quite practical. Furthermore, we generalize the genomic range query problem to sparse integer sets and discuss potential use cases.

Recent spectacular advances in genome sequencing coupled with greatly reduced storage and computation costs, make genomic testing increasingly accessible to individuals. Today one can easily get his/her DNA digitized by a sequencing lab and store the result on a local device before performing a range of tests by engaging with a testing facility. Due to the inherent sensitivity of genetic material and often proprietary tests, privacy is the natural and key issue. However, heretofore insufficient attention paid to genomic security might have grave consequences, such as incorrect drug prescriptions or erroneous parentage outcomes. Unfortunately, in genomic testing privacy and security are at odds with each other. In this paper, we reconcile security with privacy in a particular setting of genomic range queries. We do so by designing a novel technique in the form of a secure and private sparse-set range query between genomic testing facilities and individuals. The proposed technique maintains authenticity and completeness of user-supplied genomic material, while maintaining its privacy by releasing only the minimum thereof. Our experiments show that this approach is highly practical in terms of performance, for all parties involved.

No abstract