---
_id: '48063'
abstract:
- lang: eng
  text: "<jats:p>Brainwaves have demonstrated to be unique enough across individuals
    to be useful as biometrics. They also provide promising advantages over traditional
    means of authentication, such as resistance to external observability, revocability,
    and intrinsic liveness detection. However, most of the research so far has been
    conducted with expensive, bulky, medical-grade helmets, which offer limited applicability
    for everyday usage. With the aim to bring brainwave authentication and its benefits
    closer to real world deployment, we investigate brain biometrics with consumer
    devices. We conduct a comprehensive measurement experiment and user study that
    compare five authentication tasks on a user sample up to 10 times larger than
    those from previous studies, introducing three novel techniques based on cognitive
    semantic processing. Furthermore, we apply our analysis on high-quality open brainwave
    data obtained with a medical-grade headset, to assess the differences. We investigate
    both the performance, security, and usability of the different options and use
    this evidence to elicit design and research recommendations. Our results show
    that it is possible to achieve Equal Error Rates as low as 7.2% (a reduction between
    68–72% with respect to existing approaches) based on brain responses to images
    with current inexpensive technology. We show that the common practice of testing
    authentication systems only with known attacker data is unrealistic and may lead
    to overly optimistic evaluations. With regard to adoption, users call for simpler
    devices, faster authentication, and better privacy.</jats:p>\r\n          <jats:p
    />"
author:
- first_name: Patricia
  full_name: Arias-Cabarcos, Patricia
  last_name: Arias-Cabarcos
- first_name: Matin
  full_name: Fallahi, Matin
  last_name: Fallahi
- first_name: Thilo
  full_name: Habrich, Thilo
  last_name: Habrich
- first_name: Karen
  full_name: Schulze, Karen
  last_name: Schulze
- first_name: Christian
  full_name: Becker, Christian
  last_name: Becker
- first_name: Thorsten
  full_name: Strufe, Thorsten
  last_name: Strufe
citation:
  ama: Arias-Cabarcos P, Fallahi M, Habrich T, Schulze K, Becker C, Strufe T. Performance
    and Usability Evaluation of Brainwave Authentication Techniques with Consumer
    Devices. <i>ACM Transactions on Privacy and Security</i>. 2023;26(3):1-36. doi:<a
    href="https://doi.org/10.1145/3579356">10.1145/3579356</a>
  apa: Arias-Cabarcos, P., Fallahi, M., Habrich, T., Schulze, K., Becker, C., &#38;
    Strufe, T. (2023). Performance and Usability Evaluation of Brainwave Authentication
    Techniques with Consumer Devices. <i>ACM Transactions on Privacy and Security</i>,
    <i>26</i>(3), 1–36. <a href="https://doi.org/10.1145/3579356">https://doi.org/10.1145/3579356</a>
  bibtex: '@article{Arias-Cabarcos_Fallahi_Habrich_Schulze_Becker_Strufe_2023, title={Performance
    and Usability Evaluation of Brainwave Authentication Techniques with Consumer
    Devices}, volume={26}, DOI={<a href="https://doi.org/10.1145/3579356">10.1145/3579356</a>},
    number={3}, journal={ACM Transactions on Privacy and Security}, publisher={Association
    for Computing Machinery (ACM)}, author={Arias-Cabarcos, Patricia and Fallahi,
    Matin and Habrich, Thilo and Schulze, Karen and Becker, Christian and Strufe,
    Thorsten}, year={2023}, pages={1–36} }'
  chicago: 'Arias-Cabarcos, Patricia, Matin Fallahi, Thilo Habrich, Karen Schulze,
    Christian Becker, and Thorsten Strufe. “Performance and Usability Evaluation of
    Brainwave Authentication Techniques with Consumer Devices.” <i>ACM Transactions
    on Privacy and Security</i> 26, no. 3 (2023): 1–36. <a href="https://doi.org/10.1145/3579356">https://doi.org/10.1145/3579356</a>.'
  ieee: 'P. Arias-Cabarcos, M. Fallahi, T. Habrich, K. Schulze, C. Becker, and T.
    Strufe, “Performance and Usability Evaluation of Brainwave Authentication Techniques
    with Consumer Devices,” <i>ACM Transactions on Privacy and Security</i>, vol.
    26, no. 3, pp. 1–36, 2023, doi: <a href="https://doi.org/10.1145/3579356">10.1145/3579356</a>.'
  mla: Arias-Cabarcos, Patricia, et al. “Performance and Usability Evaluation of Brainwave
    Authentication Techniques with Consumer Devices.” <i>ACM Transactions on Privacy
    and Security</i>, vol. 26, no. 3, Association for Computing Machinery (ACM), 2023,
    pp. 1–36, doi:<a href="https://doi.org/10.1145/3579356">10.1145/3579356</a>.
  short: P. Arias-Cabarcos, M. Fallahi, T. Habrich, K. Schulze, C. Becker, T. Strufe,
    ACM Transactions on Privacy and Security 26 (2023) 1–36.
date_created: 2023-10-14T12:11:55Z
date_updated: 2023-10-14T12:12:42Z
doi: 10.1145/3579356
intvolume: '        26'
issue: '3'
keyword:
- Safety
- Risk
- Reliability and Quality
- General Computer Science
language:
- iso: eng
page: 1-36
publication: ACM Transactions on Privacy and Security
publication_identifier:
  issn:
  - 2471-2566
  - 2471-2574
publication_status: published
publisher: Association for Computing Machinery (ACM)
status: public
title: Performance and Usability Evaluation of Brainwave Authentication Techniques
  with Consumer Devices
type: journal_article
user_id: '92804'
volume: 26
year: '2023'
...
---
_id: '31844'
abstract:
- lang: eng
  text: "<jats:p>Encrypting data before sending it to the cloud ensures data confidentiality
    but requires the cloud to compute on encrypted data. Trusted execution environments,
    such as Intel SGX enclaves, promise to provide a secure environment in which data
    can be decrypted and then processed. However, vulnerabilities in the executed
    program give attackers ample opportunities to execute arbitrary code inside the
    enclave. This code can modify the dataflow of the program and leak secrets via
    SGX side channels. Fully homomorphic encryption would be an alternative to compute
    on encrypted data without data leaks. However, due to its high computational complexity,
    its applicability to general-purpose computing remains limited. Researchers have
    made several proposals for transforming programs to perform encrypted computations
    on less powerful encryption schemes. Yet current approaches do not support programs
    making control-flow decisions based on encrypted data.</jats:p>\r\n          <jats:p>\r\n
    \           We introduce the concept of\r\n            <jats:italic>dataflow authentication</jats:italic>\r\n
    \           (DFAuth) to enable such programs. DFAuth prevents an adversary from
    arbitrarily deviating from the dataflow of a program. Our technique hence offers
    protections against the side-channel attacks described previously. We implemented
    two flavors of DFAuth, a Java bytecode-to-bytecode compiler, and an SGX enclave
    running a small and program-independent trusted code base. We applied DFAuth to
    a neural network performing machine learning on sensitive medical data and a smart
    charging scheduler for electric vehicles. Our transformation yields a neural network
    with encrypted weights, which can be evaluated on encrypted inputs in\r\n            <jats:inline-formula
    content-type=\"math/tex\">\r\n              <jats:tex-math notation=\"LaTeX\"
    version=\"MathJax\">\\( 12.55 \\,\\mathrm{m}\\mathrm{s} \\)</jats:tex-math>\r\n
    \           </jats:inline-formula>\r\n            . Our protected scheduler is
    capable of updating the encrypted charging plan in approximately 1.06 seconds.\r\n
    \         </jats:p>"
author:
- first_name: Andreas
  full_name: Fischer, Andreas
  last_name: Fischer
- first_name: Benny
  full_name: Fuhry, Benny
  last_name: Fuhry
- first_name: Jörn
  full_name: Kußmaul, Jörn
  last_name: Kußmaul
- first_name: Jonas
  full_name: Janneck, Jonas
  last_name: Janneck
- first_name: Florian
  full_name: Kerschbaum, Florian
  last_name: Kerschbaum
- first_name: Eric
  full_name: Bodden, Eric
  id: '59256'
  last_name: Bodden
  orcid: 0000-0003-3470-3647
citation:
  ama: Fischer A, Fuhry B, Kußmaul J, Janneck J, Kerschbaum F, Bodden E. Computation
    on Encrypted Data Using Dataflow Authentication. <i>ACM Transactions on Privacy
    and Security</i>. 2022;25(3):1-36. doi:<a href="https://doi.org/10.1145/3513005">10.1145/3513005</a>
  apa: Fischer, A., Fuhry, B., Kußmaul, J., Janneck, J., Kerschbaum, F., &#38; Bodden,
    E. (2022). Computation on Encrypted Data Using Dataflow Authentication. <i>ACM
    Transactions on Privacy and Security</i>, <i>25</i>(3), 1–36. <a href="https://doi.org/10.1145/3513005">https://doi.org/10.1145/3513005</a>
  bibtex: '@article{Fischer_Fuhry_Kußmaul_Janneck_Kerschbaum_Bodden_2022, title={Computation
    on Encrypted Data Using Dataflow Authentication}, volume={25}, DOI={<a href="https://doi.org/10.1145/3513005">10.1145/3513005</a>},
    number={3}, journal={ACM Transactions on Privacy and Security}, publisher={Association
    for Computing Machinery (ACM)}, author={Fischer, Andreas and Fuhry, Benny and
    Kußmaul, Jörn and Janneck, Jonas and Kerschbaum, Florian and Bodden, Eric}, year={2022},
    pages={1–36} }'
  chicago: 'Fischer, Andreas, Benny Fuhry, Jörn Kußmaul, Jonas Janneck, Florian Kerschbaum,
    and Eric Bodden. “Computation on Encrypted Data Using Dataflow Authentication.”
    <i>ACM Transactions on Privacy and Security</i> 25, no. 3 (2022): 1–36. <a href="https://doi.org/10.1145/3513005">https://doi.org/10.1145/3513005</a>.'
  ieee: 'A. Fischer, B. Fuhry, J. Kußmaul, J. Janneck, F. Kerschbaum, and E. Bodden,
    “Computation on Encrypted Data Using Dataflow Authentication,” <i>ACM Transactions
    on Privacy and Security</i>, vol. 25, no. 3, pp. 1–36, 2022, doi: <a href="https://doi.org/10.1145/3513005">10.1145/3513005</a>.'
  mla: Fischer, Andreas, et al. “Computation on Encrypted Data Using Dataflow Authentication.”
    <i>ACM Transactions on Privacy and Security</i>, vol. 25, no. 3, Association for
    Computing Machinery (ACM), 2022, pp. 1–36, doi:<a href="https://doi.org/10.1145/3513005">10.1145/3513005</a>.
  short: A. Fischer, B. Fuhry, J. Kußmaul, J. Janneck, F. Kerschbaum, E. Bodden, ACM
    Transactions on Privacy and Security 25 (2022) 1–36.
date_created: 2022-06-09T10:28:03Z
date_updated: 2022-06-09T10:29:19Z
department:
- _id: '76'
doi: 10.1145/3513005
intvolume: '        25'
issue: '3'
keyword:
- Safety
- Risk
- Reliability and Quality
- General Computer Science
language:
- iso: eng
page: 1-36
publication: ACM Transactions on Privacy and Security
publication_identifier:
  issn:
  - 2471-2566
  - 2471-2574
publication_status: published
publisher: Association for Computing Machinery (ACM)
status: public
title: Computation on Encrypted Data Using Dataflow Authentication
type: journal_article
user_id: '15249'
volume: 25
year: '2022'
...