Sensors provide the foundation of many smart applications and cyber–physical systems by measuring and processing information upon which applications can make intelligent decisions or inform their users. Inertial measurement unit (IMU) sensors—and accelerometers and gyroscopes in particular—are readily available on contemporary smartphones and wearable devices. They have been widely adopted in the area of activity recognition, with fall detection and step counting applications being prominent examples in this field. However, these sensors may also incidentally reveal sensitive information in a way that is not easily envisioned upfront by developers. Far worse, the leakage of sensitive information to third parties, such as recommender systems or targeted advertising applications, may cause privacy concerns for unsuspecting end-users. In this paper, we explore the elicitation of age and gender information from gait traces obtained from IMU sensors, and systematically compare different feature engineering and machine learning algorithms, including both traditional and deep learning methods. We describe in detail the prediction methods that our team used in the OU-ISIR Wearable Sensor-based Gait Challenge: Age and Gender (GAG 2019) at the 12th IAPR International Conference on Biometrics. In these two competitions, our team obtained the best solutions amongst all international participants, and this for both the age and gender predictions. Our research shows that it is feasible to predict age and gender with a reasonable accuracy on gait traces of just a few seconds. Furthermore, it illustrates the need to put in place adequate measures in order to mitigate unintended information leakage by abusing sensors as an unanticipated side channel for sensitive information or private traits.

As biometric templates consist of highly correlated features, the real security level offered by biometric authentication systems remains an open research question. In this work we provide new approximations and a lower bound of the security offered by fuzzy commitment schemes. Fuzzy commitment cryptosystems and in general biometric template protection schemes play an important role in allowing for remote storage and processing of biometric data, as they mitigate the threat of biometric template leakage. The use of such schemes would alleviate some of the usability constraints imposed by the state-of-practice local use of biometrics. As such we conduct an in-depth security analysis for IMU based gait authentication systems, where we evaluate the effectiveness of attacks within the scope of two well-defined threat models that target both unprotected and protected systems. A pivotal enabler of our analysis is the development of nine different approaches to gait authentication, which allows us to perform intramodal fusion on these distinct, yet highly correlated biometric templates, and to protect them with a strengthened fuzzy commitment scheme. Our analysis clearly demonstrates the high correlation between the different biometric templates, which, among others, further showcases the threat of biometric template leakage. Furthermore, as our analysis incorporates a threat model that assumes biometric template leakage, it provides metrics for the security provided by the biometric modality itself.

The procedure for extracting a cryptographic key from noisy sources, such as biometrics and physically uncloneable functions (PUFs), is known as fuzzy extractor (FE). Although FE constructions deal with discrete sources, most noisy sources are continuous. In the continuous case, it is required to transform the source to a discrete one. We introduce a 1) model-based uncoupling construction that directly deals with the continuous noisy source and produces helper data uncoupling the discrete representation from the noisy source, guaranteeing the diversity of the discrete representation, and making it more robust and a 2) strengthened uncoupled fuzzy extractor, suitable for privacy-preserving applications, which integrates an additional fixed authentication factor and obtains a key uncoupled to the noisy sources and unlinkable helper data. We present optimal model-based uncoupling constructions for Gaussian sources. Specifically, we show how to: 1) extract one or multiple bits from a single Gaussian source; 2) extract one bit from several unreliable Gaussian sources; and 3) provide a general procedure to obtain an optimal uncoupled FE from Gaussian source(s). Our experiments show that the proposed constructions achieve much higher security levels for wide operational scenarios, approximately doubling the obtained effective key length without affecting false rejection rates.

Mixnets provide communication anonymity against network adversaries by routing packets independently via multiple hops, delaying them artificially at each hop, and introducing cover traffic. We show that these features (particularly the use of cover traffic) significantly diminish the effectiveness of state-of-the-art flow correlation techniques developed to link the two ends of a Tor connection. In this work, we propose novel methods to determine whether a set of endpoints exchanges packets via a mixnet and demonstrate their effectiveness by applying them to the Nym mixnet. We consider Nym in both an idealized lab setup and the official live network, and propose and compare three classifiers to conduct flow matching on it. Our statistical classifier tests whether egress packet timestamps are consistent with ingress timestamps and the (known) routing delay characteristic of the mixnet. In contrast, our two deep learning (DL) classifiers learn to distinguish matched from unmatched flow pairs from collected datasets directly, rather than relying on priors that describe the delay distribution. All three classifiers use our flow merging technique, which enables testing a match for sets of communicating endpoints of any cardinality. Considering a use case where two observed endpoints communicate exclusively to exchange a file through Nym, we find that flow matching is fast and accurate in the idealized lab setup. If flow pairs are aligned using all network observations in a download, we achieve a TPR of circa 0.6 (DL) and 0.47 (statistical) at an FPR of 10-2 after only processing 100 observations. We evaluate classifier performance under key variations of this setup: the absence of loop cover traffic, an increased or decreased average per-mix delay, larger communicating sets (three endpoints) with faster responders, and the presence of realistic network effects (live network). The classifiers' matching performance diminishes on the live network where packet losses and variable propagation delays exist, reducing DL TPR to circa 0.26 and statistical TPR to circa 0.28 at an FPR of 10-2. Informed by the insights of our analyses, we outline countermeasures that can be deployed in mixnets such as Nym to mitigate flow matching threats.

Biometric authentication systems have traditionally relied on the False Match Rate (FMR) to evaluate security against impersonation threats. However, this metric alone is insufficient for assessing vulnerabilities to statistical attacks because it cannot account for the non-uniformity of mismatches and atypical inputs that adversaries may manipulate. To address this issue, we propose a new evaluation framework that overcomes these limitations. The framework includes an estimate of the effective key space of biometrics and metrics that consider non-uniformity in the biometric embedding space. Our findings demonstrate that our framework provides a nuanced understanding of biometric security. Moreover, optimizing for the proposed metric leads to better security against statistical attacks than optimizing the FMR. Furthermore, the framework provides a comparative security analysis with traditional methods like passwords and PIN codes. It also quantifies the impact on security when adversaries partially know their victims, e.g., demographics.