Privacy-Preserving Behavioral Authentication on Smartphones

User behavior analytics is playing a growing role in security decisions that grant or deny access to online services. Smartphone sensors can enhance PIN and pattern based mobile authentication by continuously monitoring user behavior. However, these schemes pose a privacy risk when sensitive data is disclosed to online service providers who desire to continuously assess the risk. In this paper we enhance behavioral authentication based on keystroke dynamics with privacy. To prevent service providers from reconstructing the original text typed by consumers, we implement and evaluate 3 privacy-preserving techniques: permutation, substitution and suppression. Applying the permutation technique leads to no measurable change in Equal Error Rate (EER). Thus, the EER while using permutation is the same as when no privacy preserving techniques are used, i.e. 16% for the 'user classification' and 18% for 'user clustering'. Adopting substitution, leads to an absolute increase in EER of 15% for the first task, and 11% for the second one, which gives a total of 31% and 39% respectively. For the suppression technique, the EER increases linearly with the number of keystrokes suppressed.