ZKSENSE: A Friction-less Privacy-Preserving Human Attestation Mechanism for Mobile Devices

TL;DR

zkSENSE introduces a privacy-preserving, zero-knowledge proof-based system for mobile human attestation that classifies motion sensor data locally, ensuring accurate, seamless, and privacy-preserving verification of humanness with minimal resource use.

Contribution

It is the first system to utilize zero-knowledge proofs for mobile human attestation, moving verification to the device and enhancing privacy and efficiency.

Findings

Achieves 92% accuracy in humanness verification.

Verifies user humanness in about 3 seconds on a Samsung S9.

Consumes negligible battery compared to visual CAPTCHAs.

Abstract

Recent studies show that 20.4% of the internet traffic originates from automated agents. To identify and block such ill-intentioned traffic, mechanisms that verify the humanness of the user are widely deployed, with CAPTCHAs being the most popular. Traditional CAPTCHAs require extra user effort (e.g., solving mathematical puzzles), which can severely downgrade the end-user's experience, especially on mobile, and provide sporadic humanness verification of questionable accuracy. More recent solutions like Google's reCAPTCHA v3, leverage user data, thus raising significant privacy concerns. To address these issues, we present zkSENSE: the first zero-knowledge proof-based humanness attestation system for mobile devices. zkSENSE moves the human attestation to the edge: onto the user's very own device, where humanness of the user is assessed in a privacy-preserving and seamless manner. zkSENSE achieves this by classifying motion sensor outputs of the mobile device, based on a model trained by using both publicly available sensor data and data collected from a small group of volunteers. To ensure the integrity of the process, the classification result is enclosed in a zero-knowledge proof of humanness that can be safely shared with a remote server. We implement zkSENSE as an Android service to demonstrate its effectiveness and practicality. In our evaluation, we show that zkSENSE successfully verifies the humanness of a user across a variety of attacking scenarios and demonstrates 92% accuracy. On a two years old Samsung S9, zkSENSE's attestation takes around 3 seconds (when visual CAPTCHAs need 9.8 seconds) and consumes a negligible amount of battery.