Broken Heart: Privacy Leakage Analysis on ECG-Based Authentication Schemes

Abstract

Authentications using biometrics, such as fingerprint recognition and electrocardiogram (ECG), have been actively used in various applications. Unlike traditional authentication methods, such as passwords or PINs, biometric-based authentication has an advantage in terms of security owing to its capability of liveness detection. Among the various types of biometrics, ECG-based authentication is widely utilized in many fields. Because of the inherent characteristics of ECG, however, the incautious design of ECG-based authentication may result in serious leakage of personal private information. In this paper, we extensively investigate ECG-based authentication schemes previously proposed in the literature and analyze possible privacy leakages by employing machine learning and deep learning techniques. We found that most schemes suffer from vulnerabilities that lead to the leakage of personal information, such as gender, age, and even diseases. We also identified some privacy-insensitive ECG fiducial points by utilizing feature selection algorithms. Based on these features, we present a privacy-preserving ECG-based authentication scheme.