Investigating Data Protection Mechanisms for EEG Biometric Authentication

EEG data is an intriguing new biometric authentication medium. However, users may not be comfortable with the idea of presenting data about their intimate brain state without protections in place. Furthermore, EEG data used for authentication should be considered sensitive, as its leakage could also assist an attacker in exploiting the user in the future. This paper investigates four potential approaches to performing authentication of users with EEG data, without using the raw unprotected EEG signals. The strategies tested were: homomorphic encryption, BioHashing, fuzzy hashing, and Bloom filter templates. These strategies were compared against a baseline model using the standard False Acceptance Rate (FAR), False Rejection Rate (FRR), and Half Total Error Rate (HTER) metrics. HTER was a particular focus, as a representation of a balance between FAR and FRR. Testing found that homomorphic encryption came with significant execution time overhead but performed closest to baseline with an HTER of 0.005. BioHashing exhibited an HTER of 0 or near 0 when the authentication threshold was equally low (e.g., 0.3 or less). Fuzzy hashing consistently reported an HTER between 0.1 and 0.15. Finally, the Bloom filter template approach varied, but hovered close to 0.1 HTER. Fuzzy hashing is designed to accommodate variation in data, which explains its capability when applied to biometric data. Additionally, the combination of normalization with the probabilistic nature of Bloom filter data structures appear to similarly enable their application to this problem. This testing helped to show that authentication with protection mechanisms is possible and could potentially be reliable. Additionally, these tests demonstrated the novel application of fuzzy hashing and Bloom filter templates to EEG-based biometric authentication.