A Secure Privacy-Preserving Multimodal Continuous Authentication Protocol for Healthcare Systems

eHealth systems require usable but more robust authentication mechanisms to balance security and usability. Continuous authentication is a security mechanism that passively conducts user authentication throughout the session. Continuous authentication may best fit healthcare systems as it enhances security and improves usability by seamlessly authenticating users. It may face limitations when only one modality is supported, such as keystroke dynamics, gait dynamics, touch dynamics, etc. These modalities collect and utilize user-sensitive data containing information about user behavioral and contextual activities, and other user-sensitive attributes, e.g., user gender, age, etc., may also be derived from such data, which causes privacy concerns. Continuous authentication using multiple modalities may overcome the limitations of a single modality at the cost of compromising user privacy. The more modalities we employ, the more privacy we compromise.

In this paper, we propose a privacy-preserving protocol that supports continuous authentication using multiple modalities. Our proposed protocol protects 1) user-sensitive attributes and 2) the privacy of the type of modality (such as user activities). The biometric performance of the proposed protocol is determined in the following ways: a) individually, on two public datasets, a keystroke dynamics dataset, and a swipe gesture dataset, and b) multimodal, by combining swipe gesture and keystroke data. For multimodal, instead of computing cosine similarity for each action, we comput ed the extended similarity based on multiple (k) keystroke and swipe gesture actions. The experimental evaluation proves that our proposed protocol with the extended technique performs better than the original cosine similarity. The proposed protocol offers efficient biometric performance, low communication and computation costs, and security in the presence of a semi-honest authentication server, malicious users, and external adversaries.