Vulnerability Assessment Method for an Enhanced User Authentication System Based on Electrocardiogram in the Critical Infrastructure Environment

초록

Since inversion attacks lead to personal information leakage of artificial intelligence (AI) models, a continuous vulnerability assessment is necessary. However, existing attack scenarios mainly target image-based AI models, so they are not suitable as verification scenarios for electrocardiogram (ECG)-based user authentication systems. To this end, we propose the KMG-InvAttack, a novel attack scenario to verify vulnerabilities in ECG user authentication systems. This method efficiently extracts personal ECG information from user authentication systems by approximating the ECG signal and capturing personalized ECG feature distributions under different environmental conditions. We also add Gaussian noise to bridge the gap between public data and anonymized private information in a black-box environment. Our empirical verification confirmed that 40% of the user authentication system's private information can be extracted using public data alone, demonstrating a 43.4% higher extraction rate than the baseline. These findings highlight the serious risks of current ECG user authentication systems and the urgent need for privacy protection measures for AI models.

키워드