A spatial entropy-based approach to improve mobile risk-based authentication

Abstract

The research presented in this paper develops a novel approach for a risk-based authentication system that takes into account mobile user movement patterns. Inspired by the concept of Shannon's information theory, we introduce a variant version of spatial entropy vectors embedded with time information as a mathematical modeling tool to evaluate regular movement patterns, and spatial entropy vectors derived from user movements range and paces. To support the approach, several algorithms have been designed and implemented. A prototype iPhone application was developed as a proof-of-concept, user movement data has been collected over a predetermined timeframe by accumulating, merging, and saving spatial entropy vectors in a database on the application. The application simulates risk-based authentication by calculating risk factors based on the similarity between current spatial entropy vectors calculated on demand, and historical distributions of movement patterns. Data collected on the field shows that the risk factor is relatively low for similar moving patterns, while different patterns can yield a higher risk factor. Rather than modeling this process by directly storing GPS location data with complicated pathmatching algorithms, the spatial entropy model developed uses sampled location data, but does not keep it, preserving user privacy. Practical applications can be used, for example, to adjust fingerprint authentication threshold in iPhone when combining with the risk factor calculated in real time.

When paths cross: maintaining utility of trajectory data in geomasking

“…As an extension of this concept, trajectory k-anonymity requires that each trajectory be attributable to at least k-1 others, a statistic that necessitates some calculation of route similarity or clustering (Nergiz et al, 2009). Xiong et al (2014) calculate privacy risk factors for GPS data by comparing the spatial entropy vectors of real-time mobility traces to historical distributions. In environments where GPS data may be inaccurate, a raster-based clustering method may be appropriate (Meratnia and de By, 2002).…”

Authentication User’s Privacy: An Integrating Location Privacy Protection Algorithm for Secure Moving Objects in Location Based Services

“…An adversary with the following knowledge can launch an attack; Attacking model Having these pieces of information an attacker may be able to launch three types of attacks namely homogeneity attack [25], query tracking attack [9] and maximum movement boundary (MMB) attack [15].…”

“…But if an attacker possess rectangles from the same user at different times and therefore knows the user's maximum velocity, then it is possible to infer user's approximated location from the overlap of the current rectangle and the maximum movement bound with respect to the previous rectangle, an attack referred to as maximum movement boundary attack [15].…”

“…New query q, instead of searching all the clients in the pre-cloaked set R set . These steps continue until there are no clients to be cloaked together anymore and velocity and changing distances will be calculated (steps [4][5][6][7][8][9][10][11][12][13][14][15][16][17]. The cloaked region requirement of k local and δp is treated as the qualified cloaked region (steps [19][20][21].The subsequent snapshot i in the query lifetime, we respectively check the satisfaction of the δq by adding each client in R i−1 , R i−2 , .…”

“…Some of these attacks include maximum movement boundary attacks [15] inference attack, [16] and query homogeneity attacks [9] and skew attacks [10].This vulnerability of k-amonymity model to attacks meant privacy preservation in continuously querying LBSs requires further investigation [17]. This led to researchers modifying the k-anonymity model with other cloaking techniques in other to overcome these attacks.…”